Using "Oh S#!t" moments to build engagement in risk and resilience | BCI

We've all had them.

They're that moment when something you've either theorized about, or worse, failed to theorize about, happens.

They can be big, with wide sweeping societal impacts (e.g. COVID, Colonial Pipeline, 9/11 attacks, Black Summer bushfires) or acute to your organization (supply chain failure, regulatory breach, corporate network breach).

Either way, when they happen, you know about it and you're in either one of two places:

1. Shocked, but prepared and moving through it
2. Shocked and scrambling

Obviously the latter is not where any organization, team or person wants to be.

While no good minded person ever wants a crisis to unfold, with every "Oh S#!t" moment comes a powerful realization that risks can and do materialize with impacts that often exceed our initial pre-conceptions. This realization naturally sparks intention to minimize the impact, subsequently driving the business case to invest more resources and time into strategies that protect people, operations and reputation. In short, it sends resilience up the priority list for that person.

 The question is, how do we have more "Oh S#!t" moments before a crisis materializes?

Tabletop exercises have always been a great way to illuminate a risk and all of its potential impacts. By having teams experience a critical event, they consider not only the necessary response activities, but also the preventive risk measures that may reduce the likelihood of the event occurring, or the impact when it does occur.

Unfortunately though, tabletop exercises have a few limitations:

1. They're not scalable or highly repeatable. The amount of time and planning that goes into a tabletop exercise means that the very few stakeholders who are lucky enough to be involved, will only experience one or two in any given year. This means that the cohort involved, gets exposure to "Oh S#!t" moments, for two different risk exposures in any one year. This intrinsically means less support for risk management and resilience.
2. They miss an opportunity to engage at an operational level. Embedding a risk aware and crisis-ready culture organization-wide is not a simple exercise. While tabletops can drive awareness and engagement at the executive level (and sometimes into senior management), the rest of the organization is left to its own devices to truly engage in and understand why they need to proactively manage risks and prepare for incident response. We know where this leads to - a state of shocked and scrambling. 

At this point, it’s important to note that we do advocate for Tabletop exercises. If you're doing them, keep doing them! They do assist with top down support and drive awareness of key risk exposures. But, there is an opportunity to create more engagement in risk and resilience organization-wide using "Oh S#!t" moments.

Our approach to driving a more active and continuous approach to engagement is through iluminr's microsimulations.

Microsimulations are quick yet memorable bite-sized scenario exercises that require participants respond to an aspect of a simulated incident or critical event. Taking anywhere between 5 and 15 minutes, microsimulations provide the perfect medium for Risk and Resilience practitioners to engage the organization at all levels.

Importantly, microsimulations leverage experiential learning, provide each participant with a little "Oh S#!t" moments relevant to their world. This brings risk awareness and critical event management down to every level of the organization, creating purpose and buy-in at scale.

By engaging a broader cohort more regularly, this approach empowers the organization to:

1. Create awareness of risks and impacts
2. Build individual and team capability in risk and incident response
3. Meet governance and compliance requirements on training and testing
4. Build familiarity with toolsets such as BCP's, playbooks and procedures
5. Build awareness of the organizations resilience program and structures

As microsimulations are smaller than tabletop exercises, risk and resilience managers can deploy pre-developed scenarios across the organization on a regular basis. This means that the insights which may have traditionally been attained on an annual or bi-annual basis from the executive level, multiplies into insights generated by Executive + Senior Management + Regional Management + Workers, on a monthly basis.

That’s a lot of insight and whole lot of awareness on a variety of risk exposures. Riots, Ransomware, Hurricanes, Floods, Power Outages, Telecommunication Outages, Heatwaves, Supply Chain Failure, Gas Leaks, Wildfires, Solar Storms, Earthquake, Port blockage, Ash Clouds… just to name a few.

It's also a lot of action orientated lightbulbs switching on across the organization as to:

• "How can I escalate that I have a suspiciously locked computer, when my computer is suspiciously locked?”
• "Where else should we store our data privacy register, so we can access it when our corporate network is compromised and unavailable?”
• "Which applications are now deemed critical to maintain operations during a supply chain cyber disruption?"
• “How many of my staff are unable to perform critical duties during a sustained power outage in suburbia?”

This approach not only creates risk awareness and engagement at an operational level, but it also drives participants to use the response tools they're required to use during response, throughout the year. Ultimately, this works towards closing the disconnect that often exists between executive and operational workers on key risk exposures, and creates stronger communication channels of communication for escalation purposes.

With time, this ultimately raises the capability of teams who haven’t had the luxury of a tabletop exercise, to move from a state of shocked and scrambling, to shocked but prepared and moving through it.

To learn more about deploying iluminr’s pre-developed microsimulations to build engagement in resilience across your organization, register your details here.

You can also download our complimentary playbook Microsimulations: Strengthening resilience in a brave new world.

Authored by:  Marcus Vaughan

Co-Founder & Chief Growth Officer

Catalyst Technologies