It is five years since the publication of Nassim Nicholas Taleb’s book The Black Swan. In the book, Taleb introduces the concept of Black Swan events, which he characterizes as events that are 1) rare; 2) extremely impactful and 3) often endowed by people – after the fact – with elements of predictability. Taleb argued that uncertainty cannot be tamed, in his words, and that it is foolish to attempt to tame it.
Historically, there has been a perception that security leaders are less than comfortable with unpredictability. If that’s the case, it’s understandable. After all, for many of these individuals, part of the job is knowing the future – preparing for every contingency and knowing when and how each event is likely to happen. They’re also often penalized by management for not predicting or preparing for everything. But today, Taleb’s Black Swan concept is integrating itself into more organizations’ understanding of security, and it’s proving a sensible and beneficial way to view and manage risk.
“Are we prepared? Not always. Innovative capabilities are required even when you are planful,” said Francis D’Addario, former VP of Partner and Asset Protection at Starbucks Coffee, as he introduced the April session of the Security Executive Council’s Next Generation Security Leader development program. The session was focused on improving all-hazards preparedness and building public-private partnerships, so it’s interesting how often presenters encouraged participants to accept and embrace the fact that no organization can plan for every possibility. Yet as Taleb argues, this acceptance is surprisingly crucial to preparedness.
Brad Brekke, vice president of Assets Protection for Target Corporation, shared some of his organization’s methods for preparing for the unpredictable. “You can’t plan for everything. Instead, we plan for consequences. What happens if you lose communication, transportation, energy?” he said. Planning for consequences, as Brekke puts it, is one way of broadening the organization’s ability to respond to unlikely events.
Target has achieved resilience success from this planning model, and Brekke shared one example. On April 27, 2011, tornadoes in four Southern U.S. states claimed the lives of 344 people and resulted in billions of dollars of property damage. Alabama was declared a federal disaster area. “We had 20 team members who lost homes and one killed,” he said. “We lost power and the ability to run eight stores immediately, and we lost our distribution center in that area.”
The company’s first priority was accounting for the safety of all employees, and they activated plans to accomplish that through call centers, radio and newspaper ads, and local contacts. Meanwhile, generator power quickly got the local stores back online, but they couldn’t be supplied because the distribution center was off the state’s power grid. Target had planned carefully for the known risk of tornado damage, but, said Brekke, “we never anticipated having stores open and the distribution center closed at same moment.”
Yet, Target dealt with it quickly. The local teams were able to order five generators to be shipped overnight and the full distribution center ran off generator power only until local power was restored.
The fully stocked Target stores provided food and water to a community that desperately needed them as well as relief to public agencies. And, said Brekke, “Because our employees were safe and there was a plan, they were able to go into community to volunteer to help the recovery efforts.”
Another critical element of preparedness for unpredictability is partnership. Target’s resilience efforts hinged on a multitude of partnerships with public agencies in the local area that the organizations had built and fostered long before the crisis arose. As Rad Jones, instructor in the School of Criminal Justice at Michigan State University and leader of the MSU/Security Executive Council Business Continuity Alliance, commented, “When your facility is on fire, it’s not the time to figure out who should do what.” This is true both literally and figuratively.
If a Black Swan event occurs, both public agencies and private companies will be better able to handle consequences and continue operations if strong partnerships are already in place. The health of the community and the corporation are intertwined, and resilience improves when they know and can mutually leverage one another’s strengths and resources. Partnerships like this are built upon a foundation of communication and trust, said Jones. “It’s difficult to accomplish collaboration without discussion about the interests and concerns of all the stakeholders,” he continued. If that foundation is laid in advance, mitigation of incidents can occur without delay because, even if specific plans don’t account for the event, the communication channels are there and multiple teams can easily work together to determine the best course of action based on plans that have been practiced.
Even organizations that invest heavily in intelligence gathering and analysis cannot predict every event that may impact their business. Consider planning for consequences and building public-private partnerships to help reinforce your resiliency efforts when– not if– the unpredictable occurs.
