Preparing for high impact, low likelhood events.

In my last blog I asked whether assessing likelihood is a mug’s game. I reckoned that there’s no meaningful way of predicting the likelihood of an event based on the frequency of it happening in the past. And to all those who took me to task following the blog, I should restate my case. I do believe that you can assess the likelihood of an incident happening based on a whole load of factors - location of your office, media profile, whether your building is made of straw or concrete. But I just think that too much credence is given to past events in deciding whether something is going to happen tomorrow.

Allow me to present the flip side of my argument. The fact that something hasn’t happened before doesn’t mean that it won’t happen in the foreseeable future. Take the COVID pandemic as an example. It was seen as a high impact / low likelihood event for many years, and as a result many organisations (and governments) were unprepared for it. Cyber attack is an obvious risk, but why don’t we push our imagination and look at high impact / low probability events? Could our organisation survive a solar storm or an electromagnetic attack from a rogue nation? For some people that is just too outrageous to contemplate - rather like a pandemic was in 2019. But ‘Severe Space Storm’ is on the UK National Risk Register (with an assessment of between 5 and 25 percent possibility - well done whoever worked that one out!). And if it does happen then the UK Government assessment is that the impacts could include (and I quote) “major disruption to electricity supply to greater than 300 thousand consumers for longer than 18 hours”.

Business continuity, risk management and crisis professionals should be working with Executive teams to understand ‘what threats could really bring our organisation to its knees?’. And they shouldn’t be afraid to stretch the imagination. Surely it’s with questions like this where we can really add value?