CIOZone.com - Professional Network for CIOs and IT Professionals

Reprinted from Keep the Joint Running.

Imagine you're no longer responsible for keeping your company's computers up and running. Instead, you're an epidemiologist. Rather than a new and very aggressive malware threat you read about a new and highly contagious virus ... the statistics indicate 30% of those exposed become infected and roughly 1.25% of those infected die.

The U.S. has a population of 300 million. You do the arithmetic: Straight-line extrapolation predicts 90 million infections and more than a million deaths.

Welcome to the world of the adults who are responsible for responding to the "Novel H1N1" flu virus.

They take it as seriously as you take malware. For their trouble they are regularly attacked by the ignorati, who love to bandy about phrases like "Alarm Industry." Maybe the ignorati think taunting is clever, or will win points for their team, whatever that might be.

Possibly they're sincere, having formed the sort of strongly held, simplistic opinion that so often accompanies shallow knowledge, avoidance of the unpleasant and difficult, and an intense desire for the world to be quickly and easily understandable.

Their desire will remain unrequited: Many of the individual dimensions of this multidimensional planet are each so dreadfully complex that the relevant branch of mathematics is called Chaos Theory.

Personally, I'm grateful that adults are in charge of this situation, and that thus far they've been unimpeded by the Noise Industry.

Here's what's sad: If they do contain the situation, the Noise Industry will trumpet their success as "proof" they inflated the threat.

Because you're responsible for keeping the joint running, you sometimes have their job. At times, the proper response to a threat lies beyond your level of authority. (Here's one: dealing with the ramifications of staffing shortages resulting from an H1N1 outbreak - does your company's business continuity plan address pandemics?)

It's time to "manage north" - to effectively engage those above you in the organizational chart. In most organizations that means delivering bad news to people who don't want to hear it.

The ineffectual will burst into their managers' offices, red-faced and out of breath, to say, "Boss! We have a problem!" showing they've confused their actual role in the company - person-who-deals-with-difficult-situations - with "cub reporter." In response many managers will say, "Don't bring me problems, bring me solutions," distracted from the impending threat by their need to coach.

You perceive a threat. If a suitable contingency plan already exists, find it, familiarize yourself with it, and make sure your team familiarizes themselves with it too. If not, bring your team together to prepare a plan.

Either way, the plan will provide the engineering and procedural solution. It will probably be technically or logistically challenging, but it will be straightforward.

What isn't straightforward is the political plan. Its preparation is your job, which you can't delegate. It consists of:

• Threat assessment: Provide a brief, non-technical description of the threat, and as accurate an estimate as you can of the likelihood the threat will turn into an occurrence, along with the reason for that estimate and your confidence in it.

• Alternatives: Provide alternatives whether or not you have an approved contingency plan. You need to present them even if only one makes sense, to demonstrate you've thought things through. Otherwise your manager might take the time to think things through, and might then reach a different conclusion. If not, his manager might do so.

• Impact analysis: Your plan will disrupt normal business operations. So while it need not be formal and numerical in nature, you do need to anticipate who it will disrupt and how much. You'll need your manager's help to gain the cooperation you'll need to execute your plan.

• Communication plan: Who needs to know about the threat, what they need to know about it, and how you'll inform them and keep them up to date.

• What success will look like: This is the tough one. You need to develop some positive indicator that proves, or at least provides strong evidence that actual prevention took place. Or, if the threat doesn't turn into an occurrence, a convincing account of why it didn't.

 

Yes, it would be lovely if you could simply deal with the threat without all of this other rigmarole. In the relatively uncommon organizations that enjoy a culture of honest inquiry, you wouldn't have to. But everywhere else, risk management is politically risky.

 

Like any other risk, you need to manage it.

 

---

 

Robert Lewis is president of IT Catalysts, Inc., a consultancy focused on improving IT organizational effectiveness and integration with the enterprise. Contact him at This e-mail address is being protected from spam bots, you need JavaScript enabled to view it .

 

---

Copyright 2009, IS Survivor Publishing, all rights reserved.

Comment on this article

Only registered users can write comments.
Please login or register.