IOD SPECIAL TALKS - How to Survive a Crisis

Thank you for that introduction and the opportunity to be with you all this morning.

In my latest book How to Survive a Crisis, I analyse the nature of modern crises, including those arising from the digital world. I suggest ways of anticipating possible trouble, so that we can consider whether to take precautionary measures just in case. I believe we all need to invest more in national, corporate and personal resilience to be able to survive the kinds of trouble I expect we will have to face over the next decades. Especially given that society is becoming much more vulnerable to major disruption than in the past given the increasing pace of technological change bringing greater complexity, and fragility, of supply chains.

In the book have used my own experience as a British public servant, supporting UK governments in good times and bad, together with analytic case studies to derive the practical advice with which I conclude each chapter.

I spent 7 years as a member of Britain’s Joint Intelligence Committee. We can help governments by providing estimates of how current international conflicts and troubles may turn out, on different assumptions. But there is much we cannot know. All we can do is provide a range of estimates based on different assumptions about these unknowable events. However good our intelligence, and British intelligence is good, there are questions about the future no-one can answer, mysteries rather than secrets (as we describe them in the world of secret intelligence), such as:

(1) Will Trump win the nomination and be elected President next year, and if so what would be the consequences for US international relations – and Ukraine?
(2) Will China attempt to re-integrate Taiwan by force by the anniversary in 2049, and would that mean a major war between the US and China?
(3) Will the EU survive the tensions within it between populist nationalism of the Victor Orban/Robert Fico type and collective European solidarity over mass immigration and over relations with Russia?
(4) Will there be a second US ‘civil war’, as some States try to establish their own constitutional and legal codes in defiance of the Constitution and Federal government?

These are unknowables today.

But there are some trends about which we can be confident. We can be sure that new technology – AI, quantum, bio-engineering - will overturn much of our lives. When OpenAI launched GPT-1, in 2018, it had 117 million parameters. GPT-4, is thought to have over a trillion. “Brain scale” models with more than 100 trillion parameters—roughly the number of synapses in the human brain—will be with us over the next 25 years. There will be surprises and unexpected consequences.

We also know that with climate change will come worse heatwaves, droughts, wildfires, desertification, sea-level rise, famines, conflicts and mass migrations. There will also be surprises and unexpected consequences.

We also have to recognise too that society is more vulnerable to disruption as it becomes more complex, connected and reliant on digital data, as in supply chains and national infrastructure. We rely on data, yet information resilience is weak and is an area of study still in its infancy.

A cynic might say, you do not manage a crisis; it manages you. The case studies in my book illustrate a more nuanced position distinguishing between emergencies, crises and disasters. Emergencies happen all the time in the corporate world and in government. They are managed by adapting plans and deploying emergency capabilities. Emergencies may be painful. They may cause casualties and damage. But the management of events is under at least a minimum of control.

Crises are different. In crisis, challenging events pile on faster than your responses can cope with. The ‘rubber levers test’ applies. Every lever that is pulled to try and stabilize the situation seems to be disconnected from the reality on the ground. New problems keep arising. And we may face concurrent crises. Crisis situation threaten to spiral out of control.

Think therefore of a crisis as poised between an emergency and disaster. If we have spotted the potential for trouble and invested upstream in sensible preparations and flexible plans, and have exercised them, then we can mobilise resources, communicate effectively with investors, customers and suppliers and turn the crisis into emergency situations we can manage. It will still be tough. But we will have reasserted control. But if we have not anticipated the possibility (or, as so often happens, we have for too long ignored the warning signs of a looming problem) then we will not have built the necessary resilience into our systems.

Think of a crisis as poised between an emergency and disaster

I have seen for myself in close-up how perceptions of the ability of leaders to lead in crisis are crucial to political and business survival. At the first signs of crisis leaders must show they have mobilised and are ruthlessly focussed. Unlike Boris Johnson over Covid, Prime Ministers should not duck the early crisis meetings because they think there are more important things happening elsewhere. The same early mobilisation lesson applies to any organisation facing crisis.

In most case we will not have tactical warning of a sudden crisis. But if we have strategic notice of the major types of risk we can work upstream. We can build resilience at a personal, organisational and national level to be able to absorb the shocks, learn the lessons and bounce back stronger.

The worst crises to manage are those that I term the slow-burn crises. The problem may have been building up unrecognised or ignored for years. Often those in charge have a nagging feeling that something should be done but the time and circumstances and budget are never quite right – until it is too late and the crisis has arrived, by which time the problem may be near insoluble. But for the leader to acknowledge earlier the existence of a slow burn crisis would be to admit that the recent policies and strategy, for which the leader was responsible, is failing to deliver the desired results.

We can build resilience at a personal, organisational and national level to be able to absorb the shocks, learn the lessons and bounce back stronger.

To increase the chances that warnings do travel upwards to the most senior levels in organisations without filtering or distortion we need deliberate action to foster a culture of trust between the boss and the advisers.

One way of encouraging this that I have used during my career, goes as follows. Arrange to have a private risk discussion at the board or senior executive committee in three parts.

First, get colleagues to discuss the major exogenous risks, those that are outside their control. Such as a terrorist attack on the building next door, a supplier going bust or a hack leading to the loss of sensitive personal information. Pose tough questions about the state of insurance, hedging and contingency plans. Insist on knowing when emergency procedures were last exercised for real.

In the second part of the discussion, get colleagues to consider the risks inherent in the kind of activity of the business or department. In banks there will be attempts at fraud. In prisons inmates will try to escape. In the security world staff will leave laptops on trains. So, question the internal compliance, audit and assurance systems that would give warning of a problem building up or complacency setting in.

But in the third part of the agenda, you have to get colleagues to recognise the self-imposed risks. These are the big initiatives that management imposed on the organisation such as investing in tooling-up for entering a new line of business or opening a new market overseas, a change of finance director, or a new information management information system or corporate restructuring. The board needs to ask, has the very best team been put on the case, is the resourcing adequate, is the regular reporting of progress really open and honest about the inevitable problems that arise with change initiatives (there are always implementation problems? – the key is to recognise them early and get senior management to help sort them rather than hiding in the hope they can be overcome before the C-suite finds out!) Even longwinded and unimaginative risk registers can thus be brought to life.

Finally, let me repeat the overall resilience message of my book. Not every unexpected disruption in our lives need become a crisis, provided that we have anticipated the possibility. And not every crisis need tip into failure and disaster, provided that we have previously invested sufficiently in personal, corporate and national resilience.

That is up to us.

*Excerpts from the ‘Keynote Address' delivered by Prof. Sir David Omand GCB, Visiting Professor on security strategy and counter-terrorism, former Permanent Secretary of the Home Office, UK at the ‘Plenary Session IX’ of IOD's London Global Convention held on October 18, 2023 in London.