Risk Management Made Easy

roymoggadmin · #1 20th April 2008, 10:27

I received this email newsletter and I thought this would be of interest to some of the members.

Risk Management Made Easy

Business Continuity - Graceful Degradation and Resumption of Service

Mark Swabey
About fifteen years ago I was involved in a research project exploring how to design control systems that could be managed well in major failure situations. The general problem had emerged as a result of increased automation in the control of major systems such as power generation and aircraft. As long as everything was ok, the automated system did virtually everything and could operate at far greater workload than under direct human control. As things started to go wrong, the control system found it increasingly difficult to cope, usually leading to catastrophic failure - very rapidly. The prime example at that time was Three Mile Island incident - see the NRC fact sheet at http://www.nrc.gov/reading-rm/doc-collections/fact-sheets/3mile-isle.html. A variety of errors led to what could have been a horrifying accident; some in design (sensor placement), some in physical failure (the pressure release valve sticking open), some in operating procedures and some human error (inevitable as more than 300 audible alarms sounded within the first 10 minutes!).
The level of automation within similar power generation control systems and aircraft had increased operational efficiency dramatically while everything was ok, but two common features were becoming apparent:

operators were now not in the control loop and did not retain situational awareness, because there was nothing for them to do
when things started going wrong, they went seriously wrong far more quickly.

We found that we had to design a control system that had to actively involve the operators, maintaining their interest. We also had to ensure that the automation became more focussed on handling a wide range of error situations, especially those that were too fast for operators to react to meaningfully. To ensure that each subsystem was doing what it was supposed to do, more sensors were used and readings compared against a model of the system,.
So what has this to do with business continuity? I have just been struck by some of the parallels in business.

More Details

The Value of Business Continuity Management

I have just read an editorial column by Chris Green FBCI, Chairman of the Business Continuity Institute, writing in the March 2008 issue of Continuity. I was particularly struck by one of his proposals for maintaining investment in business continuity under the current economic climate:
We need to get better still at defining the impacts of business interruption, and translating that into tolerance and appetite. "If we don't produce product xx for three days, we will lose $yy in revenue and run the risk that ...." We can then follow this with equally straightforward analysis: "Investing $zz in resilience and continuity measures will reduce the likelihood of the interruption, and reduce the potential revenue loss to $qq..."
Chris went on to point out that in the increasingly tough financial climate, we need to get tougher and clearer with our messages; by selling the value of our business continuity proposals in terms that the decision-makers understand instantly.
Inevitably, these terms are primarily money and time, followed by other criteria such as reputation and environmental impact.
This is easier said than done. The potential exposure prior to any action, and as a result of actions, is difficult to calculate because of:

The range of potential impact of each risk
The range of probability of each risk
The type of actions being undertaken and their impact.
The effectiveness of each action

This can be attempted with a spreadsheet, but as discussed in the last newsletter, it is virtually impossible to achieve a robust, reliable solution.
So use a reliable solution that makes this so much easier throughout your organisation, allowing you to demonstrate the cost-effectiveness of your proposed actions, even though there is uncertainty in every estimate: Use RiskAid Enterprise.

Mark Swabey