Here’s an excerpt:

A San Francisco cable car holds 60 people. This blog was viewed about 3,200 times in 2011. If it were a cable car, it would take about 53 trips to carry that many people.

Click here to see the complete report.

European Railways companies are “state owned” enterprises, thus their Boards generally have CxO who either are administration veterans or politicians. Men of great experience, but traditionally poorly inclined to follow the rapid changes imposed by our fast evolving world.

The subject of the seminar was, of course, Risk Management. We were surprised that our client would be ready to part from the traditional all-hazard management, the obsolete approach inherited from the “royal rail-roads” era.

Railway, road, communication, and water supply disrupted by a land slide (natural hazard)

However, we learned that the “old boys” of that particular administration had either retired or were promoted to higher functions, and the new CEO, was very eager to promote “new ways”, including Risk Management, in the company. We were very honoured to have him sit in the seminar.

What Happened?

We started sharing our ideas about our numerous experiences with US and Canadian Rail-roads Risk Management, Wharves and ship loaders risk assessments, large-scale logistic risks, and country-wide approaches. Our intention was to then expand on other horizons, ending our prologue to the seminar with a panorama of strategic and tactical/operational risks before entering into rational prioritization and Risk Based Decision Making .

The CEO, however, quickly erupted with a statement that sounded roughly like: “well, I appreciate that you come from the technical side (a disdain grin appeared on his face..) and like to talk about these “technical/natural risks” (disdain again…), but we are here to hear about business risks, strategic risks, high-level understanding (happy grin, now…)…”. Believe me, if he did not use the “Black-Swan”  stereotype, it was just because no one had invented it yet! Without losing emphasis he ended-up saying that at corporate level they would like to use modern approaches (he even mentioned an off-the shelf methodology based on cards…). They were certainly not interested in knowing about “technical details” such as probabilities and consequence functions, tolerability, etc.

Our reaction was simple.

We said: “Sir, as far as we understand your company’s business is running trains; freight and passenger trains.

We understand our mission is to support your business’ objectives by bringing in good risk management and decision-making tools.

Only a rational and unbiased approach will tell which ones are the “major risks” your company is facing. Intuition is not enough, and actually, it proves generally wrong.

Risks are defined by their probabilities of occurrence and their consequences, and should be compared to your company’s tolerability for rational prioritization, and that’s way too difficult for intuition.

Without trying to expect the conclusion of the study you need to perform a ranking of your risks, we can say that the “high-level risks” you mention depend on political decisions (shall we call them political hazards?). Political decisions are slow (some might even never happen) by definition, especially when they would hit a state owned corporation. Instead, natural hazards are blind, they do not need to be re-elected, and climate is evolving faster than we might think. That’s why we believe it is not rational to exclude natural phenomena from the analyses”.

After that exchange, the CEO left, and we finished the seminar.

What Happened Next?

We knew we would never work again for that company/board/CEO.

We assumed they went shopping for a deck of cards (hopefully they were not Taro cards…) and started discussing high-level strategic risks.

Not more than six months later a landslide (a natural culprit of the “technical kind”) took away one of the major double track lines in the country, and the company was ashamed by the media as they had to shuttle people on buses around the natural phenomenon. It took roughly another year for a similar phenomenon to occur elsewhere on the network, triggered, this time, by “anomalous rainfalls”. Remember, Black Swans were not invented yet!

No need to say, no one ever called us back, but, a few weeks ago, we learned by a RfP from that country that:

a) the Ministry of Transportation had “taken away” from the rail road company their Risk Management function (a loss of freedom, like being put under monitoring by a higher authority).

b) The Ministry of Transportation had put together a Risk Management approach that goes down to the single switch, single signal, single rockfall detail at country-wide scale (so much for looking into strategic, high level risks only…NOT!). Pretty much what we had done for many other clients, but was thrown away by the CEO.

c) The Ministry of Transportation had developed a pilot study and is now in RfP phase for a custom tailored computer application at country scale.

Conclusions

So, you might ask, what are the conclusions of this story? Well, here they are, under the form of simple questions based on the verb “to lose”:

1. Why lose ten years of precious time?

2. Why go deep into crises, ending up losing your freedom?

3. Why lose loads of money?

4. Why lose your sight, blinded by irrational approaches?

When you see it written like this it sounds so simple, so easy, yet, when it comes to actually doing things, few companies, few boards of directors, few individuals actually give themselves the means to embrace rational and scientific approaches to Risk and Crisis Management using clearly defined tolerability criteria, the only way to be a winner rather than a loser…We will not discuss banks and governments, but you can see from the media, the story is perfectly mirrored in those fields as well.

Evolution

Because all of this sounds more like the result of cognitive biases, and other psychological effects  impacting the board of directors, seen as deeply interacting constellation of individuals, we have decided to team up with a specialist of systemic behavioural facilitation and we will soon offer in-house or public integrated sessions.

During these sessions Risk and Crisis Management, Risk Based Decision Making will be discussed while fostering deep understanding of the group biases and behaviour when the group is involved into decision making processes and uncertainties. The goal?

Your success, your survival, your modernization, your openness, and at the end, of course “your happiness and well-being”.

Contact Riskope to discuss the details, book a session at your HQ, or organize a public engagement. We are active world-wide and have deep understanding of cross-cultural environments.

En caso que te interese, tenemos un seminario web (webcast) muy completo y listo para emitir en castellano, sólo háganoslo saber que está interesado y si tenemos registros suficientes lo organizaremos.

Utilice el cuadro de comentarios para pre-registrarse para un posible seminario web.

Balangero Asbestos Mine Environmental Rehabilitation: a Case for CDA-ESM

In the past (2009) we have reported in this blog about an interesting environmental restoration project that was entirely designed using RBDM.

As the project includes a large reforestation program, we have been updating our reports, and just published and presented a paper on it at Tailings and Mine Waste 2011 Conference,Vancouver, Canada.

 We shall not enter again in the details of CDA-ESM that we have already presented many times in this blog, but we invite you to look at the presentation, as it displays how nicely the project is blending into the natural landscape.

Also, as we were presenting the paper, the site got hit with two extreme rainy events, which have caused billions of damage in Northern Italy and Southern France, Balangero being right in the middle of the situation: one was Storm Quinn, the other was “Medicane” (that stands for Mediterranean Hurricane) Rolf.

 Balangero slopes came out unscathed, no trees were lost to erosion. These two storms were not the first ones to hit the area, but with their 400mm to 650mm (locally) of rain they successfully passed the severe summer storms the slopes had already endured in 2010 and 2011.

See text fro downloading URL

In two weeks we will be in Bogotà, Colombia and give a course at the Mining Management Summit.

You can download the add for this event here.

We will be delighted to see you at the conference and discuss with you how your company can profit from Riskope’s

(riskope web site) methodologies and skills.

Reportedly the hacker group Anonymous has now threatened to take down the New York Stock Exchange‘s computers in what we at Riskope would see as a “logical” development of the Men against Machines War we described in a recent posting in this blog.

A new report from the Georgia Tech Information Security Center warns that the trend will accelerate, and based on our own experience, they are not the only ones to believe so.
Several related studies we are performing are indeed pinpointing risks linked to search poisoning, Mobile Web-based attacks, more conventional hijacked computers (botnets) etc.
Although many believe common sense is the best defence, we are of the opinion that private, institutional and corporate clients should take things way more seriously. Thus, we happy yo see that some of our clairvoyant clients have asked us to perform holistic and full scope risk assessments on their informational systems, as they were feeling the pressure raising in this area.

Today we have decided to publish a short post on a specific aspect of our work, namely third-party review jobs on proposed (Information Security, Information Risk Management, etc. Guidelines).
But before going there, we’d like to point out that Information Security Guidelines and methodologies are the subject of numerous web-based resources, such as for example ANSSI (French), which leads to a qualitative, colour based obsolete risk assessment, or the US-CERT (American) “software”, which apparently only works on Windows based systems (sorry for all the other ones like Apple, Linux, Android) and guides its users to what we consider excessively “light, unfocused and very superficial” reporting.

Well, going back to our Third Party Review Report , which has of course been censored to protect client confidentiality and is based on our client’s new proposed Information Security Guidelines,
we raised the following general four major points:

• It is essential that all employees clearly understand the value of the Company’s Information and their individual and collective responsibility to protect it. Awareness constitutes the first line of defence

• Riskope encourages our clients to “break-up the information silos” as Information Security should cover all activities and tasks, including selection, hiring, etc. of personnel, subcontractors and suppliers.

• Riskope encourages the compilation of several versions of Information Security/Risk Management Guidelines tailored towards the needs of various layers of users.

• Guidelines should include formal and well structured reference to assessment and resulting protection from physical man-made or natural hazards, business continuity plans, resumption plans, backup capabilities etc.

In the third party review report you will find many more points, bearing on specific Information Security themes.

As you can hopefully “feel” from the reading, unbalanced or weak guidelines can give a wrong sense of security to their users, and actually totally miss their goal.

With our group of experts in Cyber Defence (CYD), Cybersecurity, Riskope can perform audits and penetration tests on your company’s systems, write well-balanced Security Guidelines, review and support your efforts.

As we presented this case at an the WLF2 conference in Rome, we have decided to publish it on our blog. It constitutes a complete and fully developed case study which included the following phases:

• probabilistic behaviour forecast,

• behaviour monitoring (which luckily allowed to actually “see happen” what we had predicted a few years earlier),

• Risk Based Decision Making (RBDM), and finally

• implementation of mitigative and crisis management plan.

Interestingly, in a curious turn of events, while doing some reconnaissance work on the landslide, two of us almost lost our lives in a helicopter crash. Risk managers are unfortunately not immune to risks…and somehow it was a good lesson for us to be in the “victim role” that day.

During WLF2 many people were discussing the L’Aquila quake (and related phenomena), and, of course, the trial  where seven public officers are currently tried over their alleged failure to properly communicate risk. They belong to the Italian National Institute of Geophysics and Volcanology (INGV) and one is a member of the Civil Protection Agency.

The defendants were members of a so-called “high risk committee”, a panel that had met just six days before the quake after numerous minor tremors had shaken the city.

Foreign press and media have erroneously reported that “Scientists went on trial Tuesday for failing to predict the earthquake that killed more than 300 people in 2009 in Central Italy” (an example of “lost in translation”?). The defendants are indeed accused of giving overly reassuring information to residents who could have taken adequate protective measures if they had been properly informed.

According to the indictment, the seven men are suspected “of having provided an approximative, generic and ineffective assessment of seismic activity risks as well as incomplete, imprecise and contradictory information.” People close to the victims hope this trial will change mindsets and will lead to greater attention given to communication of risks, focusing attention on a problem that we, at Riskope, have seen happening all over the world, from Japan to South America, and Europe…(we were defence expert-witnesses in trials against public officers in similar cases).

We would of course also wonder why higher governmental levels are not indicted for not enforcing strict anti-seismic building upgrades, but that’s an entirely different ball-game.

Reportedly. Prof. Domenico Giardini, the current president of the INGV told the media that the process was not about science but about the way it had been submitted to the public and the trial will cover the numerous “failures” in the chain of communication. ”We all have to work on new protocols and clearer about sharing information,” he said.

Apparently, contrary to what several groups have stated (for example the American Association for the Advancement of Science (AAAS) or The American Geophysical Union (AGU), no one is doubting the quality of the scientists , or trying to say that they should have foreseen “day and hour of the quake”, a prediction that, despite the efforts developed all over the world, still eludes scientific models.

Some companies are seeing the market capitalization play yo-yo several times a week, if not daily.

For example:

• Dendreon Corp.’s shares fell 69% in less than two minutes in April 2009 followed by an after hour rally.

• Diebold Inc., June 2^nd , share price plummeted more than 30% in six seconds, before shooting back up

Dendreon & Diebold shares most likely have been “victims” of computer programs that search out financial information, analyze it and “high-speed trade” it without any human involvement. Similar wider scale events occurred on May 6^th when a massive sell-off erased 862US$ billion market capitalization in less than 20 minutes.

Algorithmic trading is the use of computer programmes for entering trading orders, with the algorithm deciding the timing, location, price and/or quantity of the order.

Algorithms are at war for profits against each other, Riskope’s Crisis prediction 2008

and Humans are just a casualty of war, small useless bystanders.

Of course one can still believe that markets’ sways occur because of manual trading, consumer confidence etc., but the truth is that we are no match to machines in an industry that executes transactions by the millisecond. At Riskope we have stopped using stop losses for our own investments: they are way too hazardous when executed at “investor’s speed”. By the time our stop-loss might be activated the stock may be down to the center of the Earth! We have come to the conclusion that we can tolerate the volatility, when we believe in the long term good sense of a stock position. We will not be enslaved by machines.

Reportedly the SEC recently proposed a $4 billion system to track unusual market events and suspicious trades in real time….please read …in milliseconds…..

As the matter of fact, the use of software to analyze and trade within milliseconds on news from press releases, headlines and news stories has taken off only recently. Software are reportedly based on algorithms processing historical data, events or keywords that have pushed stock prices up or down in the past. Temporary price fluctuations have led some firms to install software that looks to profit by buying at the low point of a swing, which explains the sharp turbulences of intra-day pricing.

SEC reportedly plans to implement countermeasures such as halting trading when a stock rises or falls more than 10% in less than 5 minutes. Do you now how many milliseconds there are in five minutes? Just imagine what a machine can do in five minutes, and you will see why we, Humans, have to find different strategies for survival in our war against machines.

The London Stock Exchange has recently said its new Linux-based system is delivering world record networking speed, with 126 microsecond (that’s roughly 1/10^th of millisecond) trading times. The LSE had indeed long been criticised on low speed and poor reliability, grappling with trading speeds of several hundred microseconds (gee, that slow, hey?).

The 126 microsecond speed is “twice as fast” as its main international competitors, BATS Europe and Chi-X, two dedicated electronic rivals to the LSE, which are reported to have an average latency of 250 and 175 microseconds respectively. But many of the LSE’s older and more traditional rivals offer speeds of around 300 to 400 microseconds.

Beware, Humans, the new LSE Linux system will go online, on November 1^st . Is that the day the “Collective” (remember Terminator’s Collective?) will launch its offensive?

This all looks quite like a science fiction movie, but it is not.

After predicting that the crisis would be long-lasting and deep, consequences would hit public services, public officers, generate high jobless rates, and finally lead to riots, we are now seeing “indignados” on the Brooklyn Bridge, Zuccotti Park, protesting at Wall Street (October 1^st) and other financial districts even in the Almighty USA.

Jobless people against light-speed machines making decisions for a few “human owners”, or for themselves? Well these machines do not shoot flames and bullets like the ones in Terminator, but they will kill people for sure: depression, hunger, hopeless lives….and the machines and their masters (meanwhile there are some) will get richer and more powerful.

As you can see in the picture above, our 2008 crisis depth and duration prediction showed:

• the most probable scenario was a crisis lasting until now and 20% chances (1 in 5) it would go on for quite another bit.
• 55% chances the crisis would lead to “critical evolution of disservice” described in our 2008 paper to be exactly what we see now in the media…

If we were to scientifically update our predictions now, based on factual data and new evidence, we would most likely find out a significant increase of the probability the crisis will last even longer.

The subtitle of today’s post could actually be spelled out as follows: we will show how your “standard” risk approach (risk assessments, risk register, ERM) that your peers and superiors already understand and “own” can be turned into a cutting edge competitive advantage, freeing capitals for business and production development, leading to more easily defensible, justifiable decisions. In other words, the mantra is: stop wasting moneys and efforts in security measures that do not pay off, over-investing in some mitigations and may be under invest in others, with, in both cases, potentially devastating unjustified consequences.Our metric is consistent, unambiguous, and provides context for better understanding risks fo your organization.

The “total” risk for each scenario can be calculated, and when applicable, it is possible to evaluate which portion of that risk lies above the tolerability

Instead of splitting this post in sections, as we have done in several occasions for longer posts in the past, we have decided to publish it as a self standing paper or in PDF, as we would like our readers to get a feeling for the logical continuity, getting to the conclusions in one breath and easily download the paper for reference.

The paper isn’t a thrilling Afghan terror or spy fiction story involving Bin Laden, but when you will get to the end and will appreciate how you and your company could profit from these concepts, we hope you will be breathless and excited, as much as we are in our day to day consulting practice!

As you will see, we have used a real life case study, with names etc. changed to respect client’s confidentiality.

Here you have a summary of the benefits yielded by the approach :

• The prevalent critical risks were brought forward in a clear, rational and defensible way

• The number of critical issues was shown to be smaller than originally evaluated at Status Quo

• The insurance portfolio was shown to be poorly balanced and adjustments were proposed

• The new priority list let Management make better decisions in mitigative investments’ allotment and freed moneys that could be better allocated elsewhere

• The methodology allow rational updating of the probabilities when new data are gathered.