There is no lack of headlines to draw our attention to a range of risks that are present in our world. In a recent risk steering committee meeting, we discussed a range of issues, including economic and pandemic wildcards, the evolution of cyber risks, the war in Ukraine and escalation risks, geopolitical blocs, and the November U.S. election outcomes. (Credit here to Gary Roboff, senior adviser at Shared Assessments, for presenting the challenges.) This list was presented to identify topics to be covered in our October meeting but was not meant to be a comprehensive list of operational risks.
I raised the issue of media and the markets, suggesting that news coverage has begun to mirror social media shrillness in some cases, distorting what is actually at stake. It's difficult to sort out and piece together the actual issues that require sustained attention, largely as a result of a subtle shift in emphasis and aggregation of facts. We can attribute some of this to pre-election jitters, but I think it goes back further, to the way the media came to cover Trump and has continued to cover the current situation.
The International Standards Organization (ISO) defines risk as "the effect of uncertainty upon objectives." The definition is abstract enough to cover a wide range of “objectives” – from lofty financial plans to a desire to maintain sterling institutional reputations, to literal implementations of emergency event response and recovery. COVID has thrown a wrench into those objectives, as institutions have had to become more agile in their response to changing conditions, whether fixing supply chain problems or work from home deployments.
As illustrated in Risk Business’ article, “Operational Resilience: What it means and how to achieve it”, there are four key elements to a resilient program that reduces the impact of such risks. I found myself managing all four at Washington Mutual Bank (WaMu). All four -- business continuity planning, disaster recovery, evacuation planning, and crisis management – involve asset protection and the safety of employees or contractors. From the article:
“A fire might require evacuation, crisis management and business continuity, while a system defect may require disaster recovery and business continuity. Bad press coverage may require crisis management, but not require any business continuity, disaster recovery or evacuation planning.”
At Washington Mutual, we held 10-12 operational scenario tests each year at various WaMu sites and tested all four of these elements. We even ran a pandemic flu scenario. After the 2004 Chicago bank fire and Manhattan’s 9/11, we made sure that we had mapped evacuation sites for employees at target locations. Whenever possible, we included city first response teams in our exercises. Our last scenario tests were conducted in 2008, before JPMorgan Chase acquired the bank. We were still dealing with the economic crisis at that time, and natural disasters were the more prevalent scenarios.
We are in a different environment today. I would recommend Columbia University historian Adam Tooze and his Chartbook #130 on defining “polycrisis” using “crisis pictures – as a way of making sense of what then [in January 2022] looked like a complicated pattern of stresses around the world scene.” His original map became much more complex in February, when Russia invaded Ukraine.
Tooze defines a polycrisis as “not just a situation where you face multiple crises. It is a situation like that mapped in the risk matrix, where the whole is even more dangerous than the sum of the parts.”
For both government agencies and private sector firms that are part of our critical infrastructure, it has become necessary to consider geopolitical risk in planning for resilience, given the rise and range of threats from both Russia and China. Congress took an important step forward on July 27th when it passed the Chips & Science Act, a large investment in U.S. innovation and technology hubs that puts us on a more equal footing with those countries. Together with the tax/healthcare/climate bill that the Senate passed yesterday, we can see that the legislative branch has finally begun to move to reduce certain forms of uncertainty in this country.
Complexity is not just a profoundly dangerous and challenging diagram: it is precisely an imperative to clarify and make intelligible actions that can be taken without panic.