How small is the sky
To the frog at the bottom of the well
-Old Chinese Proverb
With all of the news recently about earthquakes, hurricanes and tsunamis, it’s becoming easier to be pessimistic. A born optimist, I’ve never found it easy to deal with the reality that bad things can and do happen, but our profession requires working at the intersection of Technology and Other People’s Money. GonzoBankers, bad things can and do happen when those two elements come together! It doesn’t take a rocket scientist to figure out that if an event with a small likelihood of occurring is tested a very large number of times, we will see that event transpire. Conversely, when an event has a high likelihood of occurring, it doesn’t need to be tested very often to also produce that outcome.
I was once the senior operations officer of a bank with a very large cash vault. We had several layers of procedural “protection” to ensure that the vault was locked every night before the staff went home. I came in early one morning to find the morning vault tellers waiting ashen-faced in my office: our vault, with about $15 million in cash inside, had been left unlocked all night long. Seems the door was swung shut but the two individuals responsible for actually spinning the wheel on the vault door had been discussing something very interesting as they left and had forgotten to secure it properly.
Not a penny was missing, although a couple of people were soon missing—gone in search of a new career better suited to their interests. Why was nothing missing? The wire cages inside the vault would have been easy pickings for a thief, and the hallway area outside the vault was secured with a flimsy hollow wooden door with a bathroom-style door lock. No one would have been deterred by those insubstantial measures, but they kept routine traffic away from the area and no one had noticed the unlocked vault. Perhaps most importantly, since the vault door was always locked, no one even considered the possibility that it would be unlocked that night. The lack of attention on the part our tellers was offset by the failure of imagination of potential thieves. We soon had a motion detector inside the vault that would set off a burglar alarm if the vault door was opened, and we assigned a third individual who worked in a different area the responsibility for setting the motion detector each evening.
The moral of this story is not that a couple of tellers made a big-time mistake, but that as managers we had not done a good job of anticipating what could go wrong. We were more caught up in “If it’s not broken, don’t try to fix it” than in “Fix it before it breaks.” While we got lucky in this case, we were derelict in not considering all the possibilities. We were unimaginative—we assumed that something with a low probability had a zero probability.
There will always be errors and anomalies. Managers must learn to develop an eye for the possibility of unusual events occurring and take actions accordingly; we must become proficient at developing risk-mitigation techniques. How about your latest operational or technological project? Have you systematically contemplated the risks—the possibility of an unexpected negative outcome? Before the unlocked vault incident, we had been loath to spend the money on interior motion detectors for our vault. After the incident, it didn’t take much in the way of higher math skills to determine that a few thousand dollars might be a reasonable expenditure to provide additional protection for $10 or $15 million in cold hard cash!
There is a framework for analysis that can be of assistance in learning to contemplate the Good, the Bad and the Ugly. First, recognize that there may be disagreement on the possibility of a negative outcome or unusual future event as well as on the urgency of preparing for it. We’ve heard a great deal about the hurricanes in the Gulf of Mexico, and you know what? They have them down there every year! While it is safe to say that most financial institutions were adversely affected by the unexpected severity of these storms, the majority also anticipated the need for a business resumption plan; they had a strategy, they’re now executing their plan, and they will survive. As the CEO of a former client in Beaumont, Texas, told me several years ago, “It’s not like we don’t get hurricanes every year, and we get about a week’s advance notice when they’re coming! There’s no excuse for not being prepared!”
What follows are a few GonzoBanker tactics to help ensure your institution is prepared for those inevitable, unexpected events.
1. A well-chosen, cross-functional study group, balanced with both optimists and pessimists on the team, is a good mechanism for anticipating risks and establishing some sort of estimated probability of adverse events happening.
2. Preparedness requires continually scanning a wide range of scenarios and establishing “triggers” that will indisputably indicate that adversity is imminent (or has already occurred) and remediation plans must be launched. Again, a team representing all areas that has been balanced with people who “see the glass half full” and with those who see the glass “half empty and leaking” is the best way to collectively consider all the possibilities.
3. There must be agreement about priorities. Operating in the face of imminent adversity is no time for turf or policy battles—those must be worked out ahead of time. It might be easy to decide between preparing asset-liability management reports or making pay-or-return decisions on NSF checks during a crisis, but it may be more difficult to decide about accepting a large item drawn on a distant bank for deposit in order to fund a large change order that will keep a business running. Do you take some risks and support your customers in their hour of need, or do you protect the bank’s assets? And if you take on some unusual risk, how much risk do you assume?
4. Work out a plan in advance. This is vital. When the unforeseen happens, there is seldom time or resources to begin developing a plan for dealing with the adversity. Anyone who has ever developed a disaster recovery or business resumption plan is aware that literally hours and hours of somewhat tedious planning and record-keeping are required. One of the bigger issues facing many of the organizations dealing with hurricanes Katrina and Rita was simply finding people—items such as having a list of cell phone and relatives’ numbers prepared in advance, or having a centralized number with a voicemail message where displaced personnel can call in for instructions and status reports. There are a lot of other planning details necessary, of course, but you get the picture—things that are easy to do in advance (but which require discipline and careful forethought) may become difficult or impossible in the face of imminent danger.
5. In unusual times, flexibility becomes paramount. A talented, agile work force has to be developed in advance. No matter how thorough the planning, “You don’t know what you don’t know.” Agility and adaptability provide a foundation for innovative responses to the unforeseen and the unexpected.
6. Never forget that preparedness starts at the top, not the bottom. If preparedness doesn’t reach much deeper into an organization than just the senior managers, it will naturally fail. But the role of leadership is to plan for the unexpected, provide clear direction about the priorities, and ensure that investments are made and coordination is prepared in advance.
Our friends at the regulatory agencies have also issued regulations regarding risk assessment and the requirement for bankers to consider “What can go wrong?” as part of managing virtually every activity. (See this FFIEC Operations Booklet for a good example.) These requirements particularly apply to large technological and operational projects, which can be every bit as dangerous as bad weather! But with all due respect to this regulatory initiative, risk management is something that should become intuitive and ever-present in bank managers’ minds, not because regulators ask it but because our clients deserve it. After all, the essence of our job is to manage Other People’s Money in a way that justifies their trust and will cause them to reward us with more opportunities to help them with their finances in the future.
In the end, it’s all about perspective. If the leadership of an organization doesn’t see the big picture and prepare for all the possible eventualities, who will?
-bm