Getting Ahead of the Next Crisis: An ounce of prevention

Episode #167 Getting Ahead of the Next Crisis: An ounce of prevention

Ever since we started this podcast over three years ago, we’ve been bombarded with questions about resilience, and this of course has only increased since the onset of the COVID pandemic. People want to know how to cope better when things are tough.

We’ve produced a number of episodes that deal with the various facets of resilience. I don’t do this often, but I’m going to give you the episode details here, so that you can go through and cherry pick them to build your own mini masterclass on resilience.

There are 5 episodes in all:

• Ep. 43: People follow resilient leaders

• Ep 77: Can your team handle the pressure

• Ep. 82: Leading through crisis

• Ep. 107: Resilience, faith and optimism

• Ep. 131: The emotional toll of leadership

If you want to have a little focus session on resilience, write those episode numbers down, or put them in a Spotify playlist and immerse yourself in some tools and techniques. There’s about an hour and a half of listening, and I think you’ll be glad you took the time. While we’re still on the resilience theme, the focus of today’s episode is slightly different. Over the years, I’ve seen teams become addicted to crises. I know it sounds weird. I touched on this really briefly in episode 77, and there are some good reasons for this, which we’re about to explore. The fact is, really well run teams and businesses don’t wait for crisis to occur and then spring into action. Quite the opposite, they mitigate their risks proactively and tend to avoid the types of scenarios that many other companies, that perhaps aren’t as well managed, fall prey to.

• I’ll start by asking why some teams become addicted to crisis

• I’ll talk about what it means to get on the front foot

• I’ll finish with 5 tips for getting ahead of the next crisis

Why some teams become addicted to crisis

Well-run businesses can be boring. They don’t experience frequent crises and they don’t encounter surprises at every turn. Why? Because the leaders understand risk and they plan accordingly, avoiding the majority of disasters that other companies are routinely forced to face. As you may know, I started my career in IT. Well before this was a cool thing to do. Back then we weren’t coders, we were software developers. And originally I started there and then became a project manager. My first executive role was as Chief Information Officer in an ASX top 50 listed mining company. During those formative years of my career, I saw many of the crises that typically hit organisations through their IT systems. Cyber attacks, infrastructure failure, data corruption, and project delays. While all of these are eminently avoidable, they require long-term planning, smart investment, and a commitment to take preventative action, not waiting until something breaks before you even realize that there’s a risk exposure there.

When you’re trying to explain a risk to the business and the business is cash constrained, the first things that get cut from the annual Opex budget are the things that are uncertain. I remember one of the remote mine sites that we supported in Australia had a communications risk, where there was no redundancy built into the infrastructure. A single cable connected this mine site to the broader communications network. For three consecutive years, the telecommunications group which was part of my portfolio, had recommended installing a satellite link so that the mine could still operate if there was a problem with the primary comms link. And for three consecutive years, in three consecutive planning cycles, the business said that they didn’t want to incur the cost, which I believe was about $50,000. This was a paltry amount compared to the daily production from the site. Sure enough, one day, a farmer on a property, somewhere between that mine site and the nearest centre of civilization, was drilling for bore water and cut through the fibre optic cable buried below. All communication to that mine site was lost and it took several days to get the contingency plan in place. Now in the heat of that crisis, everyone moved swiftly to get plan B in order, but it was way more stressful and significantly more expensive than it should have been. I know it’s virtually impossible to preempt all of the permutations and combinations of potential failure, but it is achievable to identify and mitigate the most significant risks that your company faces. And this is where we need to focus our leadership energy. But we’re prone to overlook one very important fact; crises can be addictive.

Let’s unravel the DNA of a common crisis. Something goes wrong, requiring dedicated focus and attention to fix. People feel important and valued as they spring into action. They work intensively and they work tirelessly to resolve the issue and get things back to normal. At the end, everyone collapses, exhausted from the relatively short burst of effort, congratulating themselves on a job well done. And we haven’t even got to the good bit yet. That’s when the leadership swoops in and praises everyone for resolving the crisis. “We have such a great culture. We always get the job done. We go above and beyond”. That’s such bullshit. This feedback loop rewards all the wrong things. But people become addicted to the adrenaline rush, the kudos, and the challenge of a crisis. And it’s probably not too cynical to mention the overtime payments that accompany the additional effort in many companies.

Once this becomes the predominant culture, people become comfortable living in a break, fix cycle. In between the inevitable system failures, they catch their breath and relax, taking the opportunity to rest up until the next disaster strikes. There’s never any real focus on eliminating the root cause of the problem. And there’s no leadership drive to reduce the risk that something might fail in the first place. Although the crisis culture demands that people respond with urgency when necessary, there’s no real imperative to plan ahead. Your people end up only ever addressing the most obvious, visible and short-term symptoms of any issue. This is a bit like covering a melanoma with a band-aid. Although you might think you’ve treated the symptoms, it’s still likely to result in catastrophic long-term consequences. We often hear about the curse of short-termism in business, and this is one of the things that drives short-term thinking. Long-term thinkers do this differently. They anticipate what may occur. They weigh the risks, and then they take appropriate actions in advance of the inevitable crisis.

How to get on the front foot

There’s one really important fact that we need to accept in order to change our thinking. The cost and the effort required to resolve an issue once it reaches crisis point is an order of magnitude greater than the effort required to avoid the crisis in the first place. But avoiding the crisis isn’t as much fun, and it requires a different type of work: perspective, risk management work. The culture of a team that understands and considers risk on a daily basis is completely different to the sometimes cavalier attitude that breeds in the troubleshooting culture. Let’s think for a moment about cybersecurity. This field is constantly evolving at an incredibly rapid pace, so it’s no wonder the risk exposures are quite high. What’s worse, it’s virtually a given that no solution will ever be a hundred percent foolproof.

So how would you go about defending your organisation against potential cybersecurity attacks? You could spend no money at all on cybersecurity, and maybe you get away with it. You could be lucky. Alternatively, you could spend several million dollars on shoring up your cybersecurity defences and still fall victim to an attack on one of your overlooked vulnerabilities. Making judgement calls like this, start with understanding the likelihood that a certain type of attack will take place and what that could mean for your company in terms of its consequences. If you work for an energy utility that provides public electricity infrastructure, the consequences of a bad actor hacking into your control systems could be catastrophic. However, given the nature of these control systems and where they sit in the technology stack, it’s fairly unlikely that this would happen. Analyzing the risk and determining how much you’re willing to invest to mitigate it, is a judgement call.

How long is a piece of string? But the one thing you know for sure is that the consequences of not having control of your critical plant, doesn’t bear thinking about. This might require multiple layers of security and protection to reduce this type of attack to an extremely low probability. How can you do this though, without exceeding the organization’s expectations for their cybersecurity investment? And isn’t it way more exciting to troubleshoot and fix a problem once the shit hits the fan? That way we can all be heroes, reinforce our value in the minds of those around us, and go home satisfied with a job well done.

Well-managed teams largely avoid crises by planning ahead and putting appropriate steps in place to reduce risk. Now there’s no world in which all risks can be neutralised. No one has the resources to reduce risk to zero. And even for you did, that would be fiscally irresponsible. But treating them on the basis of criticality, will enable you to ensure that the really big crises don’t land on your organization.

5 tips for avoiding a crisis proactively

Here’s my 5 tips for avoiding a crisis proactively, while still being able to handle it on the off chance that it does strike. I’ve put this in a downloadable for you, just download it above.

1. Understand and reduce key risks

We’ve spoken about this. Every leader in your team must be accountable for identifying and coming up with a plan for managing the key risks that are relevant to their portfolio.

How does this happen? Well, like everything else, a leader makes it happen, or she doesn’t. If you emphasize, track, and reward the upfront preparation and analysis task, it’s much more likely that your people will undertake the essential work of risk management, rather than just being reactive. But if you reward the reactivity, the treatment of symptoms, and the troubleshooting culture, that’s pretty much all you’ll get.

2. It’s not about the spreadsheet

Many organizations fill out elaborate and complex spreadsheets or databases to assist with risk management. But it’s not about the spreadsheet, which should simply be a means to an end. Sometimes, the simplest forms of risk capture are the best. Your goal is simply to understand a few key facts. What is the likelihood that this event might occur? If it does, what are the consequences for the company? What’s within our control to do, to mitigate this risk? And finally, how much is it worth investing to reduce any particular risk to a more acceptable level?

3. Create a culture of challenging, conventional wisdom

Ideally, everyone who works for you will harbor a risk management mindset. For example, in industrial businesses where safety is an issue, before doing anything, your people should ask themselves what could possibly go wrong with the task I’m about to perform? But even for less hazardous jobs, it’s important to create a culture of looking at the holes in the Swiss cheese, not just admiring the cheese itself. The mindset and culture you want to create is one where people ask good questions about their immediate environment and are encouraged to act on the answers to those questions. But just be aware, your people will always have an excuse for not doing the proactive work. The way you lead is critical in determining what work gets done.

4. Develop long-term focus

It’s really easy to fix problems by addressing the symptoms. The problem goes away immediately, and life can return to normal. But this is one of the pitfalls of a troubleshooting culture. Symptoms will repeat if the root cause isn’t addressed. And that’s why the team becomes excellent at dealing with that crisis because every time they encounter it, it’s not for the first time. As a leader, you’ve got to always be challenging your people with the simple question, “Are you addressing the root cause of this problem? And have you resolved it in a way that guarantees it won’t re-emerge?”

5. Expect the best, but plan for the worst

All well-run companies have business continuity plans. In the event of an unforeseen event, what would you need to do to ensure the ongoing operation of your business? What happens, for example, when you lose connectivity to your major IT systems? How long can the company survive simply on manual processes? Knowing this in advance, and testing any disaster recovery plans thoroughly, will prepare you for most eventualities. Some things, you will never predict. I can’t imagine any companies had a business continuity response for the type of mayhem inflicted when COVID struck. Who would have thought that some companies would be closed down by government decree? That we wouldn’t be able to get pretty much anywhere in the world within 24 hours? That we would have our commercial real estate assets lying idle because people abandoned city centres?

Let’s land this plane. A really well-run business is one where the leaders think ahead, plan for the future, and focus their people on long-term outcomes with everything they do. Many who claim to have great teams purely because they can fix problems quickly, may have missed the point and will never reach their ultimate performance potential.

If you want to get ahead of the next crisis, think about where your leadership attention is focused, today.