Introduction. Risk management is going to be one of the subjects that will put you on the path to building a 3CFortress. Once you list and analyze the risks for your community and/or corporation the light bulb will come on, lighting the way to surviving the impact. Ignoring the risks means the impact is lurking out there just waiting to rear its ugly head. Can you afford to ignore risks and realistically stay in business when the risk hits? That is the main topic for today.
Risk Management 101
BLUF (Bottom Line Up Front) is this:
1. Identify/Make a list of the Risk (Hazards).
2. Determine what the Probability and Magnitude the Risk presents.
3. What “Stuff” (Assets) is affected or vulnerable from the Risk?
4. Determine the Impacts (Damage) for each Risk.
5. Finally, determine how to prepare, mitigate or reduce the risk.
Simple huh? Of course not but taking the first step will have you taking the road less taken. The road ends with a 3CFortress. Ignoring the risks puts you on the path to destruction or going out of business.
1. When you create a list of risks don’t get caught up in semantics or spin off on whether or not risks are threats, crisis points, hazards, etc. Pull together a team that can put this list together and not hold back. Don’t worry about if this risk requires further analysis or if it truly does affect your 3C. All that is done in later steps.
Here is a list to get you thinking: Fire, explosion, Natural hazards (see below), Hazardous material spill, Terrorism, Workplace violence, Pandemic disease, Utility (Power Grid) outage, Mechanical breakdown, Supplier delivery failure, Cyber attack, Financial crisis, Economic crisis, Earthquakes, etc.
Many of these break down into other areas such as Natural hazards. This includes floods (water rising and wind driven rain), tornadoes, hurricanes, severe drought, winter storms, and wildfires. Terrorism has many faces and that face can be the same as one of the others listed above (chemical spill or cyber attack). If statistics show that perhaps thirty percent of businesses failed during Super Storm Sandy is there any doubt that natural hazards need to be on your list of risks?
A quick note on the economic crisis risk is that the books about the “Aftershock” predict more than fifty percent of business will fail during that crisis period. It would be prudent to think about what events or risks would cause this amount of failures. Repeated several times but risk like this has a severe impact. If you assess a low probability to it the impact is too high to ignore and must be addressed.
Did I miss any? Bet I did so add any that you come up with and save the assessment and analysis for later. Two not on the list that come to mind are EMP (Electro Magnetic Pulse) and Solar Radiation. EMP could come from an accident or terrorist attack. It is similar to the Power Grid going down but has its own unique impacts. Solar radiation could come from a solar flare coming from our Sun. Both can involve severe damages to infrastructure but let’s stick with the most common or one’s that have a high probability of happening.
2. Probability and magnitude can be tough to figure out so don’t be afraid to hire a consultant or professional to help on this step. This is not something to settle with a SWAG (Scientific Wild Ass Guess). Assigning too high of probability or magnitude can lead to incorrect and/or unnecessary costly plans to mitigate or reduce that risk.
You need to have a realistic idea of whether or not this risk or hazard can occur in your 3C area. Preparing for a hurricane in Missouri might seem like a waste of time or zero probability but what do hurricanes start from and break down into? Tropical storms! These storms can bring unusual amounts of rain that forecasters might not predict. Hurricanes might not have a high probability as you go up the USA East Coast but don’t forget the magnitude and impacts that Super Storm Sandy brought with it. Sandy went farther inland than initially expected, much to the surprise of many communities and businesses. Look at how many businesses folded for good after Sandy and you might decide to keep this on your list.
Several risks can be too general or not specific enough. No problem. This is how it begins. Asking several “What if?” questions are a good start. What if Supplier X was unable to deliver one or more critical supplies to your business or community? The 3CFortress concept looks at the “big picture”, system or holistic approach. Going back to the Sandy example, how was the infrastructure failure and local community supply interruptions affecting business continuity? Careful, remember back that a plan that involves going it alone or with a castle mentality is doomed to fail. If no outside help can be expected then the 3CFortress concept takes this into consideration. Don’t set yourself up for failure.
Before we get too deep into risk analysis I ask you to keep in mind that risks or threats can be opportunities. An economic crisis centered on the food supply could create an opportunity for a Farmer’s Market of local Food CO-OP that may not have been considered before. Creating ways to shorten to shorten the living triangle and length of the supply chain creates more local businesses and jobs.
3. Figuring the assets at risk and vulnerabilities is not going to be an easy task. In order for this to be analyzed it will require a large amount of data gathering. Use the power of the Internet to gather historical data for your area. I am thinking of Galveston, TX and the hurricane that hit there in the year 1900. It was deadly and devastating to say the least. Are the conditions the same today? No, so your work is cut out for you to apply what an Saffir-Simpson Category 4 would do today. What if it is Category 3? How would the loss of oil production and oil refineries affect the state of Texas? The region? This is a prime example of Low Probability with High Impact. The high impact forces you to budget money for this in order to mitigate or reduce the impact.
4. Once you determine the impacts, the total picture of each risk comes into view. As mentioned in the Galveston example, if the impact is very high then you have no choice but to include it on your “to do” list. Impacts can go beyond financial costs. Look over your risk list and you will see that natural hazards can lead to casualties that can overwhelm the local system. Does your plan rely on the local medical facilities or do you have your medical facility on site? Pandemics create casualties from an initial event but linger on for weeks. More on this later but you can see that addressing this risk involves what to do with sick workers and secession plans. While expensive, moving to another location may have to be part of your plan. Last, the Boston Marathon bombing showed that terrorism should be on everyone’s list.
Any business that wants to make it past the impact has a long list to address: Financial loss, Business interruption, Loss of customers (from Supplier failure), Environmental contamination (think BP in Gulf of Mexico Deepwater Horizon), Fines and penalties and Lawsuits (Reference: ready.gov). Have you started to wonder if some of these events are survivable? They are but you have to develop a plan and put it into action.
5. Coming up with a plan to mitigate or reduce the risks is not going to be an easy task. The risk management plan will have to be approved and money budgeted. It is doubtful if any of the risks can be mitigated over night. Any 3C needs to sign on to this plan for the long haul. Part of the plan has to address what to do if the risk happens before your plan is complete? Are there any “trigger events” warning you of a risk about to happen? What actions can you take before the risk event that will reduce the impacts?
Besides the business management team there is another group that needs to be included in this risk management process. Talking about the “Stakeholder” group. Some examples of key stakeholders are creditors, directors, employees, government (and its agencies), owners (shareholders), suppliers, unions, and the community from which the business draws its resources. Read more: http://www.businessdictionary.com/definition/stakeholder.html#ixzz36byZqzFn
As several people have said, “We’re all in this together”. Looking over the stakeholder examples from businessdictionary.com shows the 3C’s (corporate, community, city) are, in fact, all in this together. No individual plan for a community or corporation is going to work. Everyone is a stakeholder, which the 3CFortress concept takes into consideration.
Check It Out. IKEA announces commitment to using renewable energy at their stores, when feasible. While this is just one piece of the 3CFortress concept it is a huge step in the right direction. It is clear that IKEA takes the local environment into consideration as some involve solar and others wind turbines. The size of the system at each store mentioned is amazing. Obviously, this scale of investment doesn’t come cheap but they see the savings over the long haul. Little doubt that as the technology improves IKEA will take advantage of that as future stores are built. One can only hope this commitment is seen positively by the local community enough that they want to shop at IKEA even more. http://www.ikea.com/us/en/about_ikea/newsitem/President_Obama_renewable_energy
Quick Tip – Credited www.ready.gov several times today and it is a good place to start. One note of caution is some web developer or government worker may have added too much information and ended up overwhelming the reader. What I would like to see more of is what “Wisdom” we can gather from this site. Using the DIKW (Data-Information-Knowledge-Wisdom) information flow I have to wonder if the information is too much and figuring out what is useful for future use (wisdom) is very tough to pull out. Visit the site and see if you agree or not.
Look Who’s Talking. Growyourowngroceries.org had a post about a disruption in trucking transportation affecting the delivery of food supplies to the local community. Responded that I couldn’t agree more. The only point to make was I don’t think you can grow enough of your food to get past the impact of this risk. Scaling the solution to a 3CFortress is the only way to do that.
What Do You Think? Are you with me so far?