A new British Standard has been issued called “BS 65000 – Guidance for Organisational Resilience”.
Most Business Continuity professionals felt that “organisational resilience” was one of the things that they already provided. So they wondered if another standard was overkill. After all there are already standards for Business Continuity, Crisis Management, Disaster Recovery, Emergency Management and other similar preparedness measures buried in related standards like ISO27001 and OHSAS 18001. I was lucky enough to be at the Business Continuity institute World Conference where Dr Robert MacFarlane was speaking. He is the Assistant Director at the Civil Contingencies Secretariat and was speaking in his role as chairman of SSM/1. This is the technical committee responsible for producing the Organisational Resilience standard. As well as being a most engaging speaker, he added some realism to this area.
Systems against risk-based approach
The existing standards drive a systems based approach. The organisational resilience standard, whilst drawing on the existing standards, speaks about the look and feel of an organisation that is resilient. “Resilient” includes the culture of the organisation. “Resilient” includes the organisation’s willingness to address issues that can be quite uncomfortable.
My own experience is that the biggest stumbling block for an organisation looking at preparedness is in understanding itself and the risks it faces. This is demonstrable on the micro as well as the macro level. Take the example of the roll-on roll-off ferry, The Herald of Free Enterprise. It capsized just outside Zeebrugge on 6 March 1987, killing 193 passengers and crew. Normally the assistant boatswain should have closed the sea doors, which are open in port to allow cars on and off the ferry. The assistant boatswain must close the doors before sailing. The first officer should have remained on deck. He should have assured the captain that the doors were closed before sailing.
The causes of the Zeebrugge disaster
On 6 March 1987 the assistant boatswain was asleep when the ship dropped her moorings. The first officer, hurrying to get to his station on the bridge, left the deck with the bow doors open. The Captain assumed closed doors. He could not see the doors due to the ship’s design. He had no indicator light to tell him that the doors were open. The risks that concentrated the minds of the operators before the incident was the fierce competition between ferry operators, the time pressures that this created and the costs in a highly competitive market with low margins. They felt that it was frivolous to spend money on equipment to indicate if employees had failed to do their job correctly – and so had not installed a light indicating that the sea doors were open.
In reality, humans are poor judges of risk. They concentrate on the immediate operational goal rather than on wider strategic issues. We are all guilty of this. Which of us has not heard a fire alarm sound and looked around to see what other people are doing… and then got annoyed on leaving the building to find that it was just a practice as we wanted to stay warm and continue doing whatever it was that we were doing? The truth is that we evaluate risk by our own limited experience. We dismiss the possibility of a real fire as “impossible”. We really mean “I’ve never experienced that before”.
Nicholas Taleb writes a book about this phenomenon called “The Black Swan: The Impact of the Highly Improbable”. He doesn’t mean “improbable” though, he means previously un-experienced (at least by me). He explains his central message at the very beginning of his book:
“Before the discovery of Australia, people in the Old World were convinced that all swans were white, an unassailable belief as it seemed completely confirmed by empirical evidence. The sighting of the first black swan might have been an interesting surprise for a few ornithologists (and others extremely concerned with the colouring of birds), but that is not where the significance of the story lies. It illustrates a severe limitation to our learning from observations or experience and the fragility of our knowledge. One single observation can invalidate a general statement derived from millennia of confirmatory sightings of millions of white swans. All you need is one single (and, I am told, quite ugly) black bird.”
Risk feeding into Organisational Resilience
I have experienced the effect of this in my professional life. I highlighted a specific risk to a group of senior managers, which they dismissed only to have that exact event occur some months later. Getting senior management to focus on risk is difficult and, like the ferry operators, when asked about risk they usually articulate their immediate operational concerns. Being able to develop the behaviour to think about risk strategically rather than operationally is absolutely key, and brings us back to organisational resilience, back to BS65000, and the look and feel of the organisation.
The criticality of Prepredness
Preparedness is a relatively new business discipline. The Government first passed UK legislation to deal with emergencies (as opposed to civil defence) in 2004. The government first paseed Health and Safety legislation, in comparison, in 1833. But this is an indication that government has become aware of the criticality of preparedness. To deliver preparedness on the ground the behavioural issues are critical. Key to this is organisational risk awareness – to deliver organisational resilience, business continuity, disaster recovery, crisis management or emergency preparedness; organisations must be open to understanding the strategic risks they face.
Or, like the ferry, they may find themselves overwhelmed by the problem and sunk.