Black Swans & BCP/DR

When you plan for a storm, you consider the winds and the rain. But what happens when a Black Swan Event swoops in? Black Swan Events defy traditional Business Continuity Planning (BCP) and Disaster Recovery (DR) strategies. They are unforeseen, have monumental consequences, and often come with staggering recovery costs.
The concept of a “Black Swan” as an impossible or rare thing has had approximately 1800 years of use. Juvenal’s (a 2nd century Roman poet) is credited with the earliest use of a Black Swan as a rarity or impossibility, is when he said “rara avis in terris nigroque simillima cygno” (a rare bird in the world, very similar to the black swan) https://www.britannica.com/topic/black-swan-event. For the next 15 centuries, Juvenal was correct. It was only when some Dutch explorers (Willem de Vlamingh and his crew) sailed up a river in Perth, Western Australia did they discover that Black Swans actually exist, and they are quite plentiful (ego, the Swan River).

Phrase Resurgence

Its recent use and resurgence is credited to Economist Nassim Nicholas Taleb, who in 2001 discussed the concept and later popularised the three criteria (at least his three criteria) for what makes an event a Black Swan Event. In his words;

“First, it is an outlier, as it lies outside the realm of regular expectations, because nothing in the past can convincingly point to its possibility. Second, it carries an extreme ‘impact’. Third, in spite of its outlier status, human nature makes us concoct explanations for its occurrence after the fact, making it explainable and predictable” (https://www.nytimes.com/2007/04/22/books/chapters/0422-1st-tale.html)

Certain types of managers and leaders fixate on the provable and deductable. This is a valid strategy for many domains and has provided them with very successful mental models. For example, a Monte Carlo simulation/modeling creates a really convincing graph for developing up a nest egg for retirement. However, this cannot and does not include any unexpected events.

Within BCP/DR, Risk templates and rehearsing ‘most likely’ scenarios are good, but they don’t cover these outlier events. These Black Swan Events, albeit rare, can cause significant harm to your organisation. So, the million-dollar question is, how do you plan for the unpredictable?\n\nIt’s time for a paradigm shift. Instead of predicting and preparing for known challenges, it’s imperative to develop flexible, resilient systems that can adapt to unexpected crises. Your BCP/DR planning should focus more on building capacity to respond to and recover from shocks, rather than merely forecasting them.

Rationalising in Hindsight

Interestingly, Taleb’s point of utilising a process of “Rationalising in Hindsight” (https://www.masterclass.com/articles/black-swan-event) provides a BCP/DR mature leader the biggest clue. Look for weak signals and/or confirmation bias (Taleb’s “our blindness with respect to randomness“). Some examples which we encounter regularly within BCP/DR (with their underlying assumption/bias) are:

1. We are protected as all of our ICT loads are in the Cloud (someone else’s computer will not be affected by disaster at the same time as us)
2. We have two data centres (there is no event which can affect both data centres at the same time)
3. We have redundant SANs/equipment (if we lose one, there is the other – unless what affects one is dutifully copied to the other)
4. We have dropped all of our tapes as all of our backups are now immediately available and all are online (there is no event which might corrupt, damage, or invalidate backups which are online)
5. We do not need to print or keep our paper processes (ICT will always be available to us and our client/customers)
6. We have consolidated all of our X… to one provider or supplier (there is no situation in which supply chains fail or supplier fail)

In our meetings with ICT Architects, System Admins, and C suite leaders, they regularly speak with great confidence at how well their systems and businesses are protected. They commonly raise one or more of these six examples, reveal hidden vulnerabilities or blind spots by the speaker. By definition, Black Swan Events are outliers, infrequent, and unexpected (to those not paying attention to the signals) and thus in their efforts to mitigate, minimise, or remove one type of vulnerability (typically a likely event), they radically expose themselves to another.

Moreover, an excessive focus on cost reduction, digital transformation (improving business efficiency), and “speed to market” often relegates BCP/DR to an afterthought. While these strategies aren’t inherently negative, without the safeguard of BCP/DR, you and your organisation risk taking a leap of faith without a safety rope.

Learning to Dance

In the face of a Black Swan event, it’s not about predicting the storm, it’s about learning to dance in the rain. Being attuned to the rhythm and flow of the small indicators. Those indicators which your competitors are ignoring or not thinking about because of their biases.

At MaltIQ, we specialise in working with organisations to build their capacity and capability to adapt to an unexpected or disastrous events. Call us on 1300 MALTIQ (625 874) to discuss how you can improve your Leadership team’s response.