Introduction

Imagine that your plan has been implemented as it was designed. You and your organization carried out the plan following every detail that was contained in the planning documents. Your plan has failed. That is all you know. Your plan failed. But, you think, “We exercised the plan!” Yes, indeed you did exercise your plan. And now you are being taken to task because the plan failed and this reflects on you and your planning team and on your customers – those who provided input and those who were supposed to execute the plan.

Now your challenge and that of your planning team is to explain why they think that the plan failed. You must determine how much contrary evidence (information) was explained away based on the theory that the plan you developed will succeed if you implement the steps required to respond to a disruption of your business operations. The goal of this type of exercise is to break the emotional attachment to the plan’s success. When we create a plan we become emotionally attached to its success. By showing the likely sources of breakdown that will impede and/or negate the plan (failure), we utilize a methodology that allows us to conduct a validation of the plan by determining the potential failure points that are not readily apparent in typical exercise processes.

Decision scenarios allow us to describe forces that are operating to enable the use of judgment. Based on the Failure Point Methodology, we can identify, define and assess the dependencies and assumptions that were made in developing the plan. This methodology facilitates a non-biased and critical analysis of the plan that allows planners and the Business Continuity Team (personnel assigned to carry out the plan) to better understand the limitations that they may face when implementing the plan in a response to an actual event.

We set reference points when we think of “all hazards.” These reference points are either conscious or unconscious; but the form a base from which we focus our planning efforts. There is a certain amount of bias associated with our reference points as each of us experience things differently. Therefore “all hazards” may mean something entirely different to a firefighter and to a business person. I just finished a citation for an encyclopedia for schools – the entry “All Hazards” planning for schools, was broad based and did not focus on a set of particular hazards. Just think about the complexity of “all hazards” and you start to get a feel for developing a broad based view. Specific types of events may require special planning considerations.

So, quotes aside, I would say that we need to answer the question directly not answer another question as if it was the question. There is a quote in there somewhere.

Planning for “worst case” is a fallacy as you cannot plan for a worst case – it is an unknowable. All you can do is plan for response with the assets at hand. This does not mean that you do not project potential worst case issues; however one has to recognize that the assets available are what you will have to work with and that is more important than identifying what perceptually we might think is the worst case. See my article on Unrealistic Scenarios – for example: Japan, earthquake, tsunami, nuclear event, food shortage, bad weather, etc. How do you plan for that worst case? You don’t as it is not conceivable until it happens. Plan for how you will employ your resources vs. “worst case.”

Frankly, these are two different things – mixing apples and oranges. Worst Case Scenario and Single Point of Failure are not the same.   I think that your point on exposure of weaknesses in resource deployment strategy is critical. Single point of failure is often overlooked in validating plans. There is an article that I just downloaded from HBR, entitled: Stop Making Plans; Start Making Decisions. There is some value in taking a look and assessing the timeline that is presented in the article.

We fail often to take into account the possibility effect – which causes highly unlikely outcomes to be weighted disproportionally more than they deserve. Qualitative change vs. quantitative change.

Are we missing the point of exercising our plans?

Do we create a placebo effect with regard to the effectiveness that we perceive after we complete an exercise?

Here are some random thoughts, points, etc. that resulted from the discussion and from my experience with developing and implementing exercises for a variety of private and public sector clients.

Exercises generally overlook business consequences.

Assessment and analysis often misses its focal point. We use RTO, RPO as measurement metrics when CTL is the true measure and will drive RTO and RPO.

Exercises often do not include elements with significant business decision making input (i.e. Marketing, R&D, Sales, etc.).

Most exercises focus on tactical response versus operation or strategic response and business decision making.

Many exercises contain activities that create false positives.

Mission Critical is not defined internally – exercises do not focus on mission critical.

Cascade effects are overlooked or understated or just not understood.

Exercise output is often buried in a cloud of confused recommendation due to data collection that misses the focus and focal point of what is important.

Complex human behavior – decision metrics often fail to capture key parameters; decision modeling for example.

Analysis often provides illusory information.

Exercises often times overlook the obvious – uncertainty reduction.

Exercises allow us to become systematically overconfident about capabilities and forecasts.

Exercises are inconsistent – consistently.

Misfocused scenarios, not unrealistic, just misfocused, inconsistent and misguided.

Diagnostic bias on the part of all participants is overlooked.

Errors, overlooked information, all have a compounding effect that exercises fail to capture.

Quantitative versus qualitative; we immerse ourselves in messages, data, numbers and information that has really little value or meaning.

Misfocused and misaligned measurement (metrics) creates false positives – this may be a repeat of an earlier statement.

Measurement of what? Ill defined/poorly defined concepts of what we want to measure causes us to miss the real problem areas.

We assume that data does not exist or is uncollectable.

Exercises do not reduce uncertainty nor do they validate capabilities very well.

We fail to ask: Why are we testing/validating (exercising) – measuring what? Decision models are not validated or assessed.

Models can be developed for current states of uncertainty, but we fail to analyze what those states are. Rather we exercise those areas where we essentially know the outcomes.

Assume an outcome and you will measure/validate against the assumed outcome.

Value of the information collected is low. For example, we all know that one of the common failings of exercises is “communication.” There is a vast amount of historical evidence reflecting this. Yet, we highlight this as one of the findings in almost – if not all exercises.

Foundational Changes: Business landscape changing due to emergence and spread of digital technology.

Digital Infrastructure Driver: Greater access to knowledge, capital and talent due to the emergence and spread of digital technology leading to performance improvements.

Consequences: Performance degradation as transition takes place lasting until firms configure to take positive steps to improve performance.

Unintended Consequences:

A positive, unexpected benefit (usually referred to as serendipity or a windfall): greater knowledge; ability to access untapped sources of capital and talent.

A negative, unexpected detriment occurring in addition to the desired effect: increased competition, shorter product/service lifecycles, value based on intangibles vs. physical assets (i.e., Facebook phenomenon).

A perverse effect contrary to what was originally intended (when an intended solution makes a problem worse): increased demand on infrastructure to support digital driver (i.e., electric grids) with little incentive to upgrade and/or expand existing infrastructure has a perverse incentive that causes actions opposite to what was intended.

We tend to fail to include some really important aspects in exercises:

• Actions of competitors
• Indirect labor considerations
• Customer assumptions
• Direct labor
• Compliance
• Corporate Goals and Objectives
• Purchases
• Business Assumptions (assumed growth, assumed inflation)
• Pro Forma Estimates (product sales, production costs)
• Availability of In-Kind replacement
• Promotion (marketing)
• Depreciation of assets
• Market research
• Total expenses
• Profit
• Research and Development
• Distribution and supply chain
• Advertising
• Commissions

Not factoring these in or excluding groups, such as marketing, etc. leads to a false sense of capability – an optimism bias. The tendency for planners is to underweight or ignore information and effectively create false positives. Planners should make every effort to frame exercises so as to utilize all the distributional information that is available.

Your enterprise is like a lawn; it has lots of seeds that need to be nourished and tended to so that the weeds don’t encroach and destroy the seedlings. In order to grow a lawn and keep weeds at bay; you must Think, Plan, Act and React. If you think about tending a lawn, growing and maintaining your enterprise is not all that different. In order to start the lawn you must plant the seeds (strategy, goals and objectives) in your yard (marketplace). Do you have the right resources? Do they have the skill sets and capabilities necessary to execute your strategy? When growing a lawn, you have different fertilizers that need to be applied in order to keep the lawn weed free. Just like a lawn, your enterprise has to take care of all of its operations as you execute your strategy. Once planted (strategy developed) a lawn needs to be tended (execution plans) in order that it can grow. The point is to beat weeds proactively not reactively. Your market is not stagnant; therefore you cannot operate with a pre-set time frame. You never know when weeds will emerge. Our strategic goals and objectives provide us with a view of what we want our lawn to look like. Our responses to competitive forces will eventually determine how well our strategic goals and objectives are met.

Validating Strategy using scenario based simulation has proved fruitful for many organizations; and it has helped them shape flexible, strategic options that let them respond to the dynamic forces of the markets that they engage in. In an ever-changing marketplace, your enterprise is faced with complex business risks and the urgent need for an efficient risk management system.

Participants will engage in an interactive simulation that provides a working framework for structuring strategic plan validation.

Public and private sector need to address some grave differences in approach and technique. I see that there are three levels of exercising – tactical, operational, strategic. Matrix these to Tabletops, Drills, Exercises and Full Scale Exercises and you will find significant gaps in what is being done – especially at the strategic level. We do well with tactical level activities, which often translates into good performance. We do relatively poorly in the operational and strategic levels as the common excuse is: “I am too busy to devote any time to that activity;” or “It can’t happen to us.”

The Scenario, Worksheets, Discussion Guides

Developing the exercise scenario for the Failure Point Methodology is predicated on coherence, completeness, plausibility and consistency. It is recognized at the beginning of the scenario that the plan has failed. It is therefore not really necessary to create an elaborate scenario describing catastrophic events in great detail. The participants can identify trigger points that could create a reason for the plan to fail. This allows for maximizing the creativity of the Business Continuity Team in listing why the plan has failed and how to overcome the failure points that have been identified. This also is a good secondary method for ensuring that the Business Continuity Team is trained on the plan and that they have read and digested the information contained in the plan. As it is often the case that the plan developers are not the primary and/or secondary implementers of the plan; and that the implementers of the plan often have limited input during the creation of the plan (time limited interviews, response to questionnaires, etc.) this type of exercise immerses the participants in creative thought generation as to why the plan failed. It also provides emphasis for ownership and greater participation in developing the plan.

In order to facilitate discussion of how the plan could have failed a discussion matrix (figure 1) can be used. The discussion matrix should be designed to trigger a dialogue and allow for a free ranging discussion of ways that the plan could have failed (“how did we get to this point?”).   Generally, I have found the following topic points to be excellent generators of identification and subsequent discussion regarding failure points; these are:

Plan Failure Point Topic Areas
Management	Touchpoints
Planning	Communications
Operations	Response Capabilities
Infrastructure	Management Capabilities
Logistics	Recovery Capabilities
Finance	Restoration Capabilities
Administration	Value Chain Impacts

 

Failure Point Identification Form			Page 1 of 2
Plan Failure Point	What in this area of the plan failed and why do you think it failed?
Management (Leadership, Decision Making, Issues Identification)	(Projected or Addressed in Plan?)
Planning (Tactical, Operational, Strategic)	(Projected or Addressed in Plan?)
Operations (Affected, Non-Affected, Value Chain)	(Projected or Addressed in Plan?)
Infrastructure (Internal, External)	(Projected or Addressed in Plan?)
Logistics (Immediate Requirements, Long Term Requirements)	(Projected or Addressed in Plan?)
Finance (Cost Tracking, Sources of Funding)	(Human Capital Projected in Plan, Realized – Actual)
Administration (Resource Management)	(Projected or Addressed in Plan?)
Touchpoints (Internal, External, Non-aligned)	(Projected or Addressed in Plan?)
Failure Point Identification Form		Page 2 of 2
Plan Failure Point	What in this area of the plan failed and why do you think it failed?
Communications (Internal, External, Non-aligned)	(Projected or Addressed in Plan?)
Response Capabilities	(Projected or Addressed in Plan?)
Management Capabilities	(Projected or Addressed in Plan?)
Recovery Capabilities	(Projected or Addressed in Plan?)
Restoration Capabilities	(Projected or Addressed in Plan?)
Value Chain Impacts	(Projected or Addressed in Plan?)

Results: the Scenario, Worksheets and Discussion Guides

One result we find is that there is a consensus about the traditional rational planning methodology used to create a typical Business Continuity Plan (BIA – Plan Development – Maintenance). Admittedly the traditional planning process provides a relatively good, albeit it narrow, basis for the Business Continuity Plan. And, there is value in attempting to envision goals more clearly in the preparation and planning process. Nevertheless, participants overwhelmingly agree that there are limitations to this traditional process, in that one cannot make plans for complex emergent situations (such as an unpredictable disruptive event).   By developing plans that provide sufficient flexibility, we can prepare to improvise as we redefine goals midway through a disruptive event.

A second result is that creativity, while appreciated and encouraged, needs to be managed carefully. Over the years a range of creative methods have been in the spotlight – brainstorming, permutations of planning elements, etc.

A third outcome is that participants recognize that plans can differ with regard to their focus, the functions that they serve and the depth of detail that they provide.   We learned that planning is not a simple, unified activity that can be relegated to computer driven planning programs (the result of which is to produce an inventory list instead of a plan that provides guidance and flexibility for decision makers). Generally, participants who have participated in Failure Point Exercises have categorized exercise outputs relating to planning functions and the function of plans to include the following

• Directing and coordinating the actions of Business Continuity Team members
• Basis for shared situation awareness
• Generating expectancies
• Supporting improvisation
• Detecting inconsistencies
• Establishing time horizons
• Shaping the thinking of planners
• Identifying a common terminology and classification methodology

We have found that plans differ along some key dimensions:

• How precisely the plan was made
• Whether the plan was modular (relatively independent components that could be implemented as necessary)
• The level of integration of the plan with co-existing plans (security plan, evacuation plan, etc.)
• How well coordination of all elements can be accomplished
• Level of complexity of the plan contents
• Degree of precision (i.e., how many steps you are locked into performing)

Conclusion

Participants generally agree that the benefit of the Failure Point Exercise Methodology is to recast the planning process as a type of problem solving that requires the identification of the nonlinear aspects of problem identification and solution development (Critical Thinking) versus the traditional problem solving performed during drills and exercises that are designed to validate the success of the plan and often explain away any discrepancies that arise. The Failure Point Methodology creates a learning environment that allows planners and plan implementers to break their emotional attachments to the plan’s success and recognize that plans do not necessarily reflect reality, but are our best effort to anticipate disruptive events.

Bio:

Geary W. Sikich is the author of “It Can’t Happen Here: All Hazards Crisis Management Planning” (Tulsa, Oklahoma: PennWell Books, 1993). His second book, “Emergency Management Planning Handbook” (New York: McGraw-Hill, 1995) is available in English and Spanish-language versions. His third book, “Integrated Business Continuity: Maintaining Resilience in Uncertain Times,” (PennWell 2003) is available on www.Amazon.com. His latest book, “Protecting You Business in a Pandemic,” (Greenwood Publishing) is available on www.Amazon.com. Mr. Sikich is the founder and a principal with Logical Management Systems, Corp. (www.logicalmanagement.com), based near Chicago, IL. He has extensive experience in management consulting in a variety of fields. Sikich consults on a regular basis with companies worldwide on business-continuity and crisis management issues. He has a Bachelor of Science degree in criminology from Indiana State University and Master of Education in counseling and guidance from the University of Texas, El Paso.