Circumspex Disaster Planning Blog

The Costa-Concordia Tragedy: Failed Leadership and Flawed Operational Risk Management

The cruise ship Costa Concordia tragedy should never have happened.  The Masters and Captains commanding these magnificent passenger vessels are among the most trained, experienced and seasoned maritime professionals afloat.  They are hand- picked to represent the best of the sea going professions to sail the capital investments of the leading shipping lines of the world.   Likewise, the crews assigned to vessels such as the Costa Concordia receive the best training that is on the market.  The qualification processes in every phase of ship board operations, from navigation to engineering, is rigorous, demanding and unforgiving.  Moreover, the systems installed onboard to guide and operates the Costa-Concordia were at the cutting edge of navigational and engineering technologies.

 

Yet, the ship ran aground.  In well charted waters.  In waters that were known to be rife with navigational hazards and, at worst, with hazards potentially fatal to the ship itself.  The ship and Captain had navigated these waters on numerous occasions as part of a standard routing and navigation  plan.  The threats were known.  Yet on the night of January 13, 2012, the Costa Concordia committed the most egregious of maritime sins by steaming into shoal water with seemingly with little or no concern for the risks involved.

 

Certainly, this is not the first time a prominent commercial vessel has gone aground.  Sadly, it will not be the last.  This, then, begs the question:  Why?

 

The prudent mariner, prior to departure from a port or anchorage, will “lay down” a navigational track on charts of areas that it expects to transit on its journey.  Starting with “large scale charts” (small area with greater definition for hazards associated with inland/ near coastal navigation and to aid visual navigation), the ship’s navigation team deliberately “plots its course” out of harbor or anchorage areas.  Tides, depths, obstructions, navigational aids are all considered to ensure the ship’s safe navigation out of “restricted waters.”    Once clear of inland navigational hazards, the ship’s track then shifts to a “small scale” chart (large area) for its “lower risk” open water transit.

 

This navigational planning process is deliberate, focused and intended to mitigate risk to the integrity of the vessel while in its most vulnerable (and high risk) environment.  Add the variables of weather (wind, fog, visibility, sharpness and crispness of radar and visual navigational aids) and other maritime traffic in the vicinity and the risk factor to ship safety increases exponentially.   The navigational plan is then briefed, critiqued and “challenged” by all members of the bridge and navigational teams to insure that the plan has addressed all key factors as well as ensuring that each member of the “ship control team” understands where, when and how the ship will maneuver.  This last process is deliberate and perhaps the most critical phase.  Nothing is left to chance when it concerns the ship’s navigational safety.

 

Why then, after all of the preparation, all of the planning and all of the briefings, did the Costa Concordia “run aground” on Friday, 13 January, 2012 with the resultant tragic loss of life?  Some will say “human error.”  Some, particularly those closely vested with the ship’s safety, will cite “systems failure.”  Others will even go as far to lay blame on the navigational charts (given that mariners have plied these waters for the past 3000 years, it is somewhat doubtful at best).

 

The answer, I submit, lies deep within the human conditions of hubris, ego and arrogance.  Each of these elements, when taken individually, are fatal flaws unto themselves.  When combined in total in the singular being of the lead decision maker (Captain/Master of the vessel in this case), the results are, predictably, tragic.  The Captain’s decision to navigate extraordinarily close to the shore on the evening of the 13^th of January was prompted by nothing more than a “spur of the moment decision” to thrill the passengers with a close “fly by” of  Isola del Giglio.

 

Hubris, ego and arrogance, as embodied by the Captain, intervened so thoroughly and  completely that even the most experienced mariner (and qualified) onboard  utterly failed to consider the fundamental principle of considering operational risk management (ORM) into his decision to deviate from the established navigational track.  All of the navigational planning and preparations became subordinate to his own hubris.  Moreover, the Captain’s own persona created an environment whereby subordinate staff members either failed (out of negligence) or were so intimidated by his authoritarian style of leadership that nothing was said (out of fear for their own careers).  Had there been even a scintilla of consideration for the extraordinary risk that was being assumed by the Costa Concordia in this capricious, spur of the moment decision, this disaster most certainly would have been averted.  The fact that the Captain was not even posted on the bridge but cavorting with his passengers during this most risky of maneuvers is evidence enough to point to his embedded fatal flaws.  Sadly, it is only through the loss of life that these personal (and professional) shortcomings came to light. 

 

The loss of life and the suffering of the survivors is tragedy enough.  The tragedy will be compounded, however, if simple lessons learned are not taken from this incident and applied across the board and amongst all manner of disciplines that require planning and preparation to mitigate risk in dynamic operational environments.  First and foremost amongst these lessons is that any decision contains its own inherent risk.  This risk must be recognized, considered and assessed in the context of ongoing operations and within the risk framework established by organizational leadership.  Secondly, operational risk management must be conducted by leadership in light of previous planning considerations and risk mitigation efforts.  This alone should act as a brake mechanism that stops the “sequence of bad decision making” or, at the very least, serves as an impetus to challenge any contemplated deviation from an established plan.  Thirdly, and most important, is the recognition of the human condition (ego, arrogance and hubris) when inserted into organizational decision making processes.  Specifically, the examining of any change in a plan in order to flesh out the root cause for the change.   Is the decision to affect a change operationally imperative or is leadership decision making compromised by the dominance of hubris, arrogance or ego.   If it is the latter, the organizational climate must be such that it permits, without prejudice, the leader to be professionally challenged by those who see the decision for what it is or isn’t.

Written by John Kunert CBRM CBRA

Senior Planner

Circumspex LLC

 

Business Continuity Plan Testing: “Knowledge is Power “

Business Continuity Plan Testing is technically noted as the 5^th stage (nestled between plan development and plan maintenance) of the Business Continuity Planning Process.  Its objective is to serve as the litmus test to determine the plan’s “adequacy, reliability and effectiveness”.[1] In so doing, it ensures that the analytical efforts engaged in the planning process forms a sound premise for the plan construct and, moreover, is consistent with the organization’s assessment of its needs to sustain itself through possible business interruptions.

 

 A tall order indeed and perhaps the Decisive Point on the path to achieving organizational resiliency.

 

At the core of the “adequacy, reliability and effectiveness” testing triangle (equal lateral:  all sides in equal “tension”) is the actual event that serves as the driver for the testing process.  For purposes of the discussion, it matters not the type or nature of the event.  What is of primary importance is that the testing event involves the business continuity team that will be implementing the plan at the moment of calling.  Herein lies the “Center of Gravity” for organizational resiliency in responding to threats to business continuity.

 

The actual link between the testing event and the business continuity may be identified as Organizational Level of Knowledge on the actual business continuity plan (BCP). I would even go as far as saying that this knowledge, in order to embody the concept of resiliency, must encompass the plan in total and NOT the stove piped columns of knowledge that individual business continuity plan response teams generally are empowered with in order to execute their individual finite pieces (of the plan). 

 

The link of Organizational Level of Knowledge is supported by several knowledge sub-components that support and foster resiliency.

 

The first, and most critical, is the premise that Knowledge, specifically of the business continuity plan in total AND the premise(s) on which it is founded, constructs an innate sense of resiliency within each response team member.  It enables them not only understand/execute their respective part better, but, of greater significance, to seize initiatives when they appear and to make the right decisions and take the right actions as a dynamic situation dictates.  This is de-facto empowerment.

 

Secondly, mastery of the Knowledge contained in the BCP mitigates the paralyzing affects of the “shock and awe” syndrome when initially confronted with a disaster or serious interruption to business continuity.  Individuals will respond as the BCP dictates due to the fact that the knowledge imparted by effective training of the BCP overwhelms “uncertainty and mental gridlock,” both of which are known human phenomena to circumstances that stress normal thought processing patterns.

 

Third, and perhaps more subtle than the previous two points, is the fact that a thorough knowledge of the BCP by key participants will maximize training opportunities when scheduled.  The maximization occurs not only in the organizational resiliency sense but also from a fiscal stand point as well.  Training demands planning (time, staff resource allocation) and productive participation (time saved by addressing new material/issues and not constantly re-plowing old ground).  All of this affects the bottom line and is a significant enough consideration that cannot be overlooked.

 

John Kunert CBRM, CBRA

Senior Planner

CIRCUMSPEX

 

---

[1]Sentryx , Advanced Business Continuity and IT Disaster Recovery Planning: Course Notes, 2008, Section 9, page2, 2008.

Business Continuity: Practical Solutions Pre-event!

Business Continuity:  Practical Solutions Pre-event!

After 30 years working with customers and clients as they deal with either a personal or business crisis, it is rewarding to have the opportunity to work with them in pre-loss conditions hoping they will never have to implement the response plan you are helping to create.   However, odds are not in their favor nothing will ever happen!  Small incidents like a frozen pipe, a faulty sprinkler head, while not a major event, can be quite costly!  Knowing how you would or should “react” is critical to saving dollars and reducing the risks.   I like to say it is a matter of being pro-active versus reactive!

In light of all the bad news that floods the media, people still remain complacent…“it will never happen to me!”  Historically, an increased sense of urgency to plan for disasters is top of mind immediately after a regional or national weather event, but that sense urgency fades with each passing day or week as the event passes.  True business continuity is a process that never ends.  It is driven internally within a company by an individual or group of individuals that have the unenviable task of making it part of a company’s culture.  Unfortunately, most of those that have written those 3 -4 inch binders are placed on the shelf as a completed project versus a tool that must be constantly updated and tested.   For years, Business Continuity and Business Recovery Plans have been a priority within IT Departments.   Facility personnel and property managers are not quite as focused on the “what if” testing that goes on in the IT world.  They have day to day issues that usually cloud the inevitability of a real issue with serious financial impact threatening the viability of a company.  If we recover the data but cannot produce what we are selling because of a fire, flood or environmental event, where are we?   How patient will your customers be if you are a supply chain vendor and you are holding up production of the finished product? 

What can go wrong?  In the past 30 – 90 days, we have had forest fires out west, Hurricane Irene impacting the Atlantic and Northeast, Tropical Storm Lee impacting rivers and flooding whole communities and businesses and now intense Santa Ana winds impacting the Western US…and these are just the natural disasters.   What about the fire that starts up in production line machine igniting the hydraulic fluids that surrounded it, the sprinkler head that was sheered by a carless fork lift operator etc…?  Are you ready?  What can be done?  Who is in charge when an event occurs?  What are the critical functions that must be brought up first?  Pre-planning can help to prepare a company to withstand an event should one hit.  Part of the planning process should be to test the plan.  Will it work as designed?  I remember doing a table top exercise for a Fortune 500 company 6 years ago.  With those sitting around the table, it was clear that at least 3 people thought they were in charge if a fire impacted the corporate headquarters…a interesting problem to have that must get worked out pre-event.   I just found out through one of our response vendors that they were doing a fire in the corporate facility…good thing they had a plan!   

Working with CIRCUMSPEX, a facility centric web-based planning tool, we focus on building contingencies.   Developed by a team of restoration, homeland security software developers, certified property managers with extensive restoration experience, the program benefited from “real life” scenarios in the developmental process.     Un-like most disaster planning solutions on the market, it is inexpensive and user friendly.  It is also more robust than other solutions on the market.   While the program identifies several tabs where critical information is stored, like Risk assessment, Business Continuity, Critical Processes, Life Safety and a robust section that are focused on Building Specifications and Critical Equipment. 

Written by:  Jim Wills

Resiliency and the Business Continuity Plan: Are They Related?

Or are they mutually exclusive? Is the concept of “resiliency” the framework within which an effective business continuity plan is constructed? If not, it should be. If not, the Business Continuity Plan (BCP) isn’t worth the electrons that store it within the system.

RESILIENCE is defined by Merriman-Webster as follows:
“The capability of a strained body to recover its size and shape after deformation caused especially by compressive stress,”and “an ability to recover from or adjust EASILY to misfortune or change.”

Both definitions address the ability of the main body to adjust and adapt to external forces that are exerted in a non-complementary fashion. In other words, unannounced disruptions to the status quo. Moreover, the emphasis is on the ease by with that adaptation is realized.

Much has been said regarding “Organizational Resiliency” and the need for the Business Continuity Plan to achieve that end. One can almost hear the mantra chorused by senior management when the notion of “organizational resiliency” is challenged by vested stakeholders: “….of course we are resilient….We have a Plan!”

But are they? Upon further review…

It may be interpreted that true “resiliency”, in the context of responses to external stresses, has two distinct components:

1. The BCP
2. The Organization

The glue that hold these two key resiliency elements in the proper tension is the ability, capability and will of the people within the organization to seamlessly respond to external organizational stimuli that results in unanticipated “misfortune or change” to key processes, infrastructure or capabilities.

It is certainly one thing to “brace for shock” when a threat is anticipated and known. People prepare. Management focuses more tightly on risk mitigation. Redundancy, perhaps rarely (or never) relied upon, is “given the warning” to step into action on moment’s notice. The probability of an effective response with the associated positive outcome is certainly “Good.” With a little training in between those odds may go to “Excellent.” Great.

It is all together different when the “misfortune or change” is more akin to the “bolt from the blue.” In this scenario, it is a “come as you are party” and, hopefully, the party preparations included a heavy dosage of organizational socialization, training, and testing of the BCP. In the average organization, what are the odds of the perfect nexus of these elements? Add the “surprise” element and we have the recipe for, at best, a “failed response.” Not Good.

In both scenarios, both organizations could have made the rhetorical claim (or claims if extraordinarily confident) before the event that they were, in fact, “resilient.” In fact, neither would meet the true litmus test or resiliency: “ An ability to recover from or adjust EASILY to misfortune or change.” The “ramp up” in the “brace for shock” scenario comes at a cost both in terms of time and the illusion of preparation. In this case, any deviation from the set plan serves as the prologue to failure. In the “bolt from the blue scenario, the notion of “adjusting easily to misfortune or change” was doomed to failure at first contact.

As stated earlier, the factors that empower an organization’s true resiliency are the ability, capability and will of the people within the organization. The challenge for senior leadership (note the term “leadership” used vice “management”. “Will” cannot be managed in the clinical sense however leadership inspires individuals from within, hence “will” is re-enforced) is to allow the growth of ability, development of capability and engendering the sense of empowerment amongst all echelons of the organizational structure to ACT as leadership expects them to act in the absence of direct supervision. The early stages of an event that “causes misfortune or change” are the most critical. The right actions taken at the right time by the people who have the opportunity to do so can only happen if they are trained (ability and capability) and empowered. This, in the final analysis, is Resiliency.

A page from history exemplifies this last point quite clearly. During the Second Battle of Guadalcanal in 1942, the light cruiser USS San Francisco (CA 38) suffered over 32 major caliber hits during an intense night action with significantly superior Japanese forces. With senior leadership killed, a severely compromised propulsion plant, “next to nothing” for electrical generation and on the verge of sinking, the ship continued to put “rounds down range” to the enemy. They continued to “fight another day.” Under these extraordinary circumstances, the crew of that ship demonstrated extraordinary “Resiliency.” Inspired leadership instilled the will to perform and training, on the part of every crewmember, to the tenets of their “contingency plan”, empowered them to prevail. They were, in every sense of the definition, RESILIENT.

By:  John Kunert, Senior Planner @ Circumspex LLC

Honest Communication with Tenants Key to Successful Multi-family Restoration

Having come through another hurricane season it is worth reconsidering the importance of open and honest communications between the property management staff and the tenants.  On a recent project we witnessed the owner and manager paralyzed by indecision concerning emergency mitigation services.  As such the rain soaked interiors baked in the sun leading to interesting environmental conditions.

The owner at first did not want to address the conditions almost trying to "wish" the problems away.  This behavior only brought about very unhappy tenants and a stream of folks leaving the development. Soaking interior finishes and wall cavities also seriously impacted the very young and those with certain chronic breathing problems. Suddenly when reporters and news crews started to appear in the neighborhood the owner and manager were "moved" to action.

Over several decades of managing mitigation and large scale multi-family repairs  we know that true, honest, accurate information sharing with the tenants is vital. When a disaster or calamitous event arises that impacts an entire complex the owner or manager need to be proactive.  Bring the tenants together in a single event lay out the facts as you know them and answeer questions honestly to the best of your ability.  Certain managers quake in their shoes at the thought of bringing all the tenants together.  They are often afriad that they will be put upon by the throng.  They have a misconceived notion that only speaking to individual inquiries is more prudent than providing uniform information.  Is there a delusion that the tenants will not speak to each other? Have they not experienced the social phenomenon that rumors grow to fill the voids created by intentionally limiting communication.

More to come....

Critical Processes In Business Continuity Planning

This is very good primer on the components of critical process investigation. Analyzing the business organization and its entire operational footprint is instrumental to developing a proper continuity strategy.

This begins with identifying mission‐critical functions throughout the organizational landscape, including agency functions (interdependent services performed by agency processes and sub‐processes), enterprise functions (services dependent upon agency‐level functions) and processes (series of actions or operations that implement functions).Identifying mission‐critical functions can be a tedious task, and no two organizations will follow the sameprocess or end up with the same list.

When identifying mission‐critical functions, the following should be considered:

• Functions that support the organization’s primary mission statement

• Functions that support other agencies’ mission critical functions

• Functions that must be recovered immediately and quickly

• Functions that have a high‐dollar value

• Functions that have high client/customer impact

• Functions with political implications or ramifications

• Functions with legal requirements or liabilitiesAn executive Business Impact Analysis (BIA) tool can facilitate this process, helping planners and organizersunderstand the effects and impacts of interruption on the viability and vitality of operations and criticalbusiness functions, especially financial activities, including maintaining collections, processing payments,operating a supply chain, handling payroll and so forth.

BIA is the backbone of the BCM planning process but cannot stand alone without full approval, backing and support from the highest level managers.Risk analysis and Risk assessment are additional processes which support the BCM planning process. Risk analysis involves identifying probable threats and associated threat value to an organization and its assets and analyzing related vulnerability. Risk assessment evaluates existing environmental and physical controls and security, followed‐up by assessing their adequacy relative to potential threat.

 

Read more in paper written by Tittel & Koreic    Understanding the need for Business  Continuity Management and Disaster  Recovery Planning