RiskACUMEN podcast: Episode 2 transcript

​

Listen instead

​

Johnny Thomson  00:01

Okay, hello, and welcome to another RiskACUMEN podcast. We offer thoughtful insight around risk engineering and management. Now, as we know, 2020 has been all about one thing, the Covid-19 pandemic. And from a risk management perspective, the spotlight has very much been on continuity planning. In a major event such as this, continuity plans and how robust they are, can simply be the difference between an organisation surviving or failing. So, I want to explore this area today and to help me I've been joined on a call by Charlie McLean-Bristol. How are things Charlie?

 

Charlie Maclean-Bristol  00:39

Oh, I'm surviving. Yes, I'm here working away at home. So yes, good and all raring to go.

 

Johnny Thomson  00:45

Excellent, excellent, now Charlie is a highly experienced business continuity and crisis management author and consultant and is also the founder of two companies, Plan B Consulting, and Business Continuity Training. Two years ago, his peers at the Business Continuity Institute also voted him their European Personality of the Year. So well done with that one, Charlie. And now Covid-19, what a year we've had so far, yes?

 

Charlie Maclean-Bristol  01:12

Yes, I think we need to get the two buzzwords out of the way early. It's unprecedented and we're into a new normal. So,those are the two things you always have to say. So, it's an interesting year.

 

Johnny Thomson  01:28

Yes. And I mean, what I'd like to get down to today, if we can, is this to understand, you know what you see, as the key business continuity lessons that have emerged from this pandemic, Charlie?

 

Charlie Maclean-Bristol  01:42

Yeah, I think it's interesting that, I think, is first of all looking at the incident. Normally in an incident, we would plan for your company, my company, x company, we would plan for them having the incident and they having to manage out manage the reputation, manage the recovery, look after their customers look after their, their staff. And I think well, as we well know, what's different with this one, is we're all in the same boat together. So it puts a different dynamic on incidents, because, you know, your customers are not going to be outraged, because you can't supply to them. If you are a kind of theatre or something, you can't supply g customers, because you'd be told not to. So I think that is the first interesting dynamic is that thing, we're all in the same boat together.

 

Johnny Thomson  02:38

Okay, and you use the word dynamic, I guess the responses has had to be dynamic as well, because of that You almost see people having to, I don't want to use the phrase make it obviously go along, because I would expect to be more planning behind that,  but there's a feeling that that's what's necessary here, isn't it? Because it's something new.

 

Charlie Maclean-Bristol  03:00

I think there's a couple of things there. First of all, I think, you know, as part of incident management, we do two things. We put in place a robust incident management plan, which hopefully can deal with any type of incident. Because often, you know, the next incident is the one that we've never thought of. So hopefully, if you have a good robust incident management plan that allowed you when Covid struck to be able to use that mechanism and the teams and the plan, and the kind of the structure for managing the incident. So you were able to, you're able to manage it. I think there's also a bit about... I did a lot of contingency pandemic planning, when I worked for a big utility in Scotland, and they went really and not say overboard, but they did some really, really good contingency planning for the last pandemic, round about just at the back of year 2000. So I think it was 2004 or five when the H1N1 was was coming and they did and immense amount of work, but what was interesting was, none of the work we did for that pandemic was really relevant to this pandemic at all. And, you know, if you look at the key, and I looked at some of the exercising, so I wrote a piece on the big exercise England did, I can't remember the date it was it was about 2016, and they exercised it over three days and they had like 47 different, different organisations involved in that. So, immense amount of work, but the two things that they didn't do in that exercise was sort out the PPE, which we all remember was the big problem in the beginning and also putting people with Covid out of the hospitals because that was always their plan to take people out of hospitals and free up hospital beds, they never, nobody occurred to anybody will seem to not occur from the notes anyway, that that was a bad idea, because actually they put Covid straight in all of the care homes. So I think, you know, contingency planning I suspect has helped lots of organisations be prepared for the incident, but we always have to slightly, however much we plan, it's rare that you're kind of incident fits you're planning for the specific scenario. So I think it's worth planning for specific scenarios, but I think you've always got to say you can't plan to the nth degree, because the nuances will be different. 

 

Johnny Thomson  05:48

Yes, I mean that's something that's always fascinated me about continuity planning is just the sheer scope of it all. And what I mean by that is, you know, how do you plan for almost anything? Yeah, you know, okay, you can anticipate a fire or an IT failure or something like that. But, you know, a global pandemic is a little bit different, as you've said, and where does it all end? You know, should we have asteroid strikes and alien invasions and things like that, as part of the plan? So to talk me through the process Charlie, I really need to understand how do you kind of plan for the, for the for the unthinkable, if you like?

 

Charlie Maclean-Bristol  06:22

Well, I think it is, as the audience here is very much risk managers, that's what their profession is all about. But for me, there is a couple of things there. First of all, in business continuity, we plan very much for the consequence of the action. So we, if we say, actually, you got a big headquarters building and it's full of call centres, or it's full of specialist equipment, or is full of things that you can easily replicate elsewhere, then, then we don't really care if the building's burned down, you know, a helicopter falls on top of it, it's flooded, it has a power cut, it's all about the consequences. So, I think you can start looking in terms of risk management saying, what is key to our organisation? What if we lost would actually have a big impact? And then you can start planning that through. So now, where we used to do a lot of planning for loss of buildings, I think now, because most people can now work from home the whole loss of building is less of an important risk. Yes, it's still a risk, but it means we've got some good mitigation. If we come on to some of the ones like pandemic, it's very interesting that that in terms of likelihood, and impact, so all our risk managers will know that, your top right hand, your red zone of your risk matrix, then in turn pandemic was exactly there, the Government stated that was the most likely thing that was going to happen, and was going to have the biggest impact. So none of us, and I can put my hands too, have got a real excuse to say we didn't know it as a risk. It's just I think a lot of us kind of, I think the problem is a little bit with pandemic is everyone focused on staff being off and being sick, which and this thing the actual illness apart from, you know, the ones with underlying health problems, for the majority of the healthy population the sickness of being off is not been the problem. The problem has been the economic close down, the close down of whole sections of industry, that has been the issue with this with this pandemic, not staff availability, because on the whole staff have been available to work.

 

Johnny Thomson  08:49

Yeah, yeah, we could have seen a similar impact from an entirely different event, I guess. So that's the point, is to plan for the consequences, as you say, rather than focussing on the new nuances of the individual event itself. 

 

Charlie Maclean-Bristol  09:04

And if we come on to some of your, you know, the alien invasions and, you know, the solar flares and some of those things, you know, I think a little bit is we have to plan for things we could control  You know, if some of the things like a solar flare can take out massive power grids, and we've all got no power, it is a little bit like this pandemic in that we're all in it together and we're kind of slightly on business survival mode. So, I think, you know, what is worth planning for I think is a little bit is the things you could you could have, where mitigation measures work. There are certain incidents, you know when when I look at planning and I look at say, you know, your organisation is 1000 people all in one building, we don't normally plan for a jumbo jet like 911, a jumbo jet drives into the building and you know, the majority people die, because there is a level of planning, which is not, you know, do we have a plan for the one person who's out to lunch? Or turns up late? They're the ones that survive, and they can open the manual and say, right, how do I reform this business and start recruiting people? You know, there is a level of planning, which you kind of decide upon - it is no worth planning for, because in terms of likelihood or in terms of impact, you know it's worth doing.

 

Johnny Thomson  10:31

Yeah. There's only so far you can take everything. 

 

Charlie Maclean-Bristol  10:35

Yeah, yeah.

 

Johnny Thomson  10:35

In terms of the pandemic, now, I mean, here we are, we're in September 2020, at this point, and as we know, it's far from over. But I wonder is there a danger of complacency setting in now? And what are the issues now? And what should organisations actually be doing at this stage of the crisis? And what stage are we at Charlie? A lot of questions I know.

 

Charlie Maclean-Bristol  10:58

I think one of the first things,  and we were just having a discussion in our management team meeting just before I came on this call, was that I think there is a little bit of incident fatigue at the moment There is one thing we brought back, you know staff coming back from furlough, it's like, you go for a little walk every day and then you'll come off furlough, and you're going back into running a marathon, and you haven't really practised for it And if you were off sick for four months, you wouldn't, you wouldn't, you know, you'd be a phased returned to work, you wouldn't just actually go and say, you know, come back sick and then you're into it, you know, seven and a half days a week, five days a week. So I think some of the people who are coming back off furlough are going to a little bit struggle to just get up to pace again. And then with the mental health of the burnout, and all the kind of issues that and other productivity issues round about that. So I think people need to watch that. I think the second thing of those that have been working, you may have been working at home, you may have been working extra hours, you may have had all the stress of your small business. So you know, or even a big business. Have I got a job? You know, how is the business going? What can we do to get in sales, you know, worrying about the economic situation. If you're a salesperson and nobody's buying, nobody's answering your calls, then that's very stressful. Even for those who have been on full salary and working away. And I think, you know, people have been at it for about four or five months and I think we need to be also careful of those people for burnout as well as do they just get just they just get tired. And, you know, maybe the thing is they you know, people unwind, and they're two weeks in Spain, or they're, and they've got a week in Scotland with the midgies, you know, they've just stayed at home. And that's not what they're sort of body's used to and winding, regenerating. So I think we need to look at our people in this one. 

 

Johnny Thomson  13:07

Yes. 

 

Charlie Maclean-Bristol  13:07

I think the next thing is we need to look at is, you know, if our business is starting, you know, you can see a little bit the economy started to pick up, people are going back to hopefully go back to well, people going back to work, maybe this week, schools are back. So that's going to create a sort of business momentum, the furlough schemes coming to coming to an end, not too far distant future. So you've got that kind of issue of people, you know, they're either going to be paid off, or they're going to go back to work. So, you know, businesses, projects, things will hopefully pick up. I think people need to be aware of or to be flexible. This is where I think their indicent management is helpful. What happens if you suddenly have another lockdown in your area? How does that affect your business model? You know, how does that affect your supply chain? And you know, we've seen flare ups in in, you know, a lot of Europe's having a flare up. We've lucky sort of touchwood here, haven't had too much of a flare up in the UK. I wasn't going to say yet. But there's the opportunity for that. So there's opportunity of further local lockdowns. So how is your business? You know, how could you react to that and those lock downs are happening pretty quickly. So, you know, if you got operations in that area, and or, I think we need to think about our supply chain, in terms of, you know, even critical components of your windows or your, your widget, whatever you're building comes from Italy, and actually, suddenly, you know, that you're working on the spares or the bits that were given to you pre-lockdown and the spares have started, the other parts are starting to come through and then you know, your factory, or your your supplier in Italy is suddenly locked down again. Then you know how are you going to react, what are you going to do about that? How's that going to impact? So I think people have to be, you know, on the ball, hyper aware, horizon-scanning, where are the problems? Where are the issues that we can, let's do our risk management, let's think about, you know, what are the risks, what are our vulnerabilities? And then if we can't do anything, sometimes you can't do anything about it, but at least you can monitor it, you can have an eyes up and say, look, we're starting,our spares are starting to not come through, our orders are being fulfilled at 50%, we need to think about this or do this or do something early.

 

Johnny Thomson  15:38

Yeah and that goes back to what we talked about earlier about dynamic risk assessment, doesn't it? It's not just a case of having a plan in that day and now we're good to go. You've got to constantly look at that. You mentioned supply chain as well, I was just thinking, there's almost a perfect storm brewing here, isn't there? Because we've got the end of the Brexit transition period coming up at the end of the year as well. So that combined with any kind of lockdown issues here and so on, as we saw with the old toilet roll fiasco that there is a lot on the horizon here isn't there, there's a lot of possibilities.

 

Charlie Maclean-Bristol  16:11

Yeah, and I think the Brexi, I think everyone's slightly that Brexit's done and it's not. And I think, you know, I suspect a lot of people are crossing their fingers and hoping it's, you know, a bit EU style, it's all going to be sorted last minute, as the EU is a little bit inclined to do. But, you know, there are some really big issues around about the supply chain, and also of people's economic models as well. It relies on just in time, it relies on, you know, thin margins, and suddenly someone sticks a 10% tariff on it that can throw your complete product, and then you know, will your customers bear that extra 10%. Or actually, then you become uncompetitive, and, you know, that impacts further your business model. So, Brexit,  yeah, is another hurdle on this road to hopefully some economic get back together again. 

 

Johnny Thomson  17:11

Okay. And any other thoughts Charlie, any other points you'd like to get across?

 

Charlie Maclean-Bristol  17:16

Yes, I think, I think the other thing is, you know, this is maybe a little bit selling my professional, a bit of doom mongering, is the, you know, the normal stuff hasn't gone away. So we've seen recently I do a reasonable amount of stuff on on cyber and, um, you know, there seems to be a spate at the moment as a lot of cyber ransoms going on. So ransomware and then people extorting money for you to get you know, your business up on the up going again We're coming into winter, so there's all the floods and all that kind of stuff that goes winter, the snow, beasts from the east! So there's all that, don't forget that all those things, all those things, you know, just because it's Covid doesn't mean they're going to be any less. So I think we need to remember to just kind of, to take into account though those things as well. My last bit is a suppose is to learn the lessons, you know, do we remember really what happened roundabout was it the 18th, I don't even know what the date was, the 15th of March or whenever we went into the first lockdowns, everything started closing down. What were the lessons learned from that? What were the lessons learned for your organisation? So you know, I barely remember what happened last week, for far less, you know, what happened on the 18th of March! And I think organisations should be debriefing their people. Don't wait to the end of Covid, because actually end of Covid, we don't know when that could be sometime next year, you know, so don't wait till the end, debrief it, learn the lessons, what went well, what went badly. Of course, again, there's no point trying to do a plan., because the plan if you kind of write another Covid plan, the next Covid even the next Covid comes along might not be the same sort of Covid that comes along or whether it's you know, it's not even the same sort of virus.  So don't you know, don't fight the last battle, but take the lessons learnt - what went well, what went badly, what could we do to our plans. If we don't have plans, let's get some plans in place because people have learned a lot about incident management, a lot about how to manage incidents, you know, a lot. You know I've been doing some debriefings there, staff communications, some people have done really really good jobs, staff communications, their staff being on the whole happy. They've been you know, government, multinational organisations who've had to cope with different government rules, different lockdown rules, is it one metre, is it two metres what can you do what you can't do? And they've just been brilliant at assimilating that information, getting information out to staff in such a way that they could use it, interpret it for their own organisation. So there's lots and lots of really good learning out there. So don't let it go to waste. Don't go and say, oh well, you know, we'll wait until it's over or because it's gonna be a year, two years. And you won't even have a clue what you did. So learn the lessons now. Don't wait, do your debriefing.

 

Johnny Thomson  20:30

Yeah. Great summary, Charlie. Excellent. And yeah, I don't mind you selling some of your services? You know, I know you have a terrific and regular blog that you do. Where can people get that? Charlie? 

 

Charlie Maclean-Bristol  20:46

So if you, the company's Business Continuity Training Limited? So you put Business Continuity Training into Google and if you go in is called the bulletin if you put on bulletin there. Or if you send send me an email, send Johnny an email, you can pass it on. And I'll I'll put you on the list for the blog there, but always happy to have new readers.

 

Johnny Thomson  21:08

Yeah and it's been great to having you Charlie. Some fantastic insight, so many, many thanks for that.

 

Charlie Maclean-Bristol  21:15

Great. Well, nice to speak to you.

 

Johnny Thomson  21:17

Thanks, Charlie. Thanks for your time. You've been listening to the RiskACUMEN podcast. If you have any questions or comments around the topic we've covered today, please go to our LinkedIn page. You can find a link on www.riskacumen.co.uk and please join in the discussion. And yeah, thanks again, Charlie. It's been great talking to you and until the next time, good bye for now.

  

  

​

​