Risk Gone Wild

In late 2007, UK government workers lost two computer discs containing personal and banking data for approximately 25 million residents, information with an estimated black-market value of $2.5 billion. In early 2008, a failure at an outsourced data center in Denmark disrupted the operations of its clients—knocking out a major bank’s ATM network and halting milk delivery across the country. Then, last September, a network failure stopped trading on the London Stock Exchange on what would have been one of the busiest days of the year. These are all cases of what we call “technology-enabled extreme events”: improbable, hard-to-foresee disasters in which IT often plays a starring role. Until recently, the risk of these large-scale events seemed infinitesimal, and so businesses paid little attention to mitigating them. But such calamities have become increasingly common, and they’re all but ensured by the growing and pivotal role of IT in business. IT used to be isolated within silos in a single company. Modern systems, however, not only interconnect all aspects of a business but often have real-time links to suppliers’ and customers’ systems. This opening and blurring of boundaries, while creating efficiencies and enabling new business models, allows errors to cascade across businesses and geographies, growing in impact as they spread. It can also, often unintentionally, vest small groups of employees with the power to take actions that reach far beyond their purview. When that happens, minor mistakes may instantaneously turn into catastrophes. In one recent case, a brokerage employee’s honest typing error transformed a $4 million trade into a $4 billion trade, contributing to a 2.36% drop in the S&P 500 that day. Consider also Sony’s sale of 6 million music CDs incorporating antipiracy software that inadvertently exposed consumers to hackers, resulting in an onslaught of bad publicity and lawsuits. Standard risk-management strategies are too outmoded to help companies contain catastrophic IT-linked risks. These strategies tend to assume that the risks are well understood and that the possibility of extreme events is tiny. As a result, organizations typically concentrate on ensuring that they have good policies and procedures for managing known risks and are using high-quality processes for creating and operating IT. But this old-fashioned focus can prevent firms from seeing new risks. How do you identify events that, by definition, are hard to anticipate? Start by instilling from the top down an organizational culture that encourages employees to take ownership of risks and weigh their potential rewards and hazards. This means modeling risks and analyzing their business impact and, even more important, making the process integral both to corporate risk management systems and to every stage of IT system development. The culture must encourage employees to bring concerns about risk forward early, particularly when IT is being applied in new ways. That mind-set was missing at Société Générale in 2007, when trading irregularities were not reported to bank management by staffers who noticed them because, as a report by the bank’s own investigators noted, “This was not specifically a part of their job description.” The bank later reported a $7.3 billion loss, which was allegedly due to unauthorized trades by one employee, Jérôme Kerviel. It’s critical to make the consideration of extreme events part of the technology development process. This ensures that true risks are appropriately weighted in IT design and ROI calculations. The right culture can transform battles about risk between technology optimists and naysayers into a focused dialogue about the nature of risk and how to manage it. There are many ways to reduce and hedge IT-linked risks, and carefully developing a strategy to address those dangers at the outset can mitigate them without compromising the reward.

Risk Gone Wild

Summary.

Partner Center