"It's just a matter of your assumptions"

I grew up a dinosaur geek - you know the type, the annoying kid who loves showing off that they know the names of all the dinosaurs (you may have been one too...)

So it won't surprise you if I tell you that I love Jurassic Park. I've been recently watching the series again with my kids, even if it pains me that they prefer the new Jurassic World trilogy. For me, the absolute best is the original film.

But it was only over the Easter break that I read Michael Crichton's novel - and it is head and shoulders better than the film.

It also triggered my inner Op Res nerd, and I couldn't help joining dots with another great book I was loving listening too on Audible - Weick and Sutcliffe's "Managing the Unexpected."

(No, I'm not going to dive into the security lessons that Jurassic Park can teach us on the importance of Key Person Risk, monitoring for rogue insiders, and Privileged Access Management - although these are important too...)

In the novel, Dr. Ian Malcolm is a gifted mathematician who specialises in chaos theory - famously played by Jeff "Life, uh, finds a way" Goldblum in the film franchise.

Before it is even built, Malcolm has predicted that Jurassic Park will be a disaster because the InGen CEO, John Hammond, and his team have not taken the time or effort to fully understand what they are creating. Their hubris leads them to believe they are in control because they are blind to a host of unpredictable variables.

Hammond and his team are not receptive to Malcolm's concerns (*no bad news culture alert*,) and he is only on the island because he is invited by the corporate attorney representing investors, Donald Gennaro, to notice any problems with Hammond's dinosaur theme park. They already have evidence that dinosaurs have escaped the island.

Hammond brings Malcolm, Grant, Sattler, and Gennaro to the Control Room. Here, they meet John Arnold.

-----

'Malcolm seemed to be in his element, making little sniffing sounds, like a bloodhound on a trail.

"You want to know about control mechanisms?" John Arnold said, turning his chair in the control room. The head engineer was a thin, tense, chain-smoking man of forty-five. He squinted at the others in the room. "We have unbelievable control mechanisms," Arnold said, and lit another cigarette.'

-----

Arnold is able to use animal tracking to follow individual dinosaurs according to all their movements over the last 24 hours, and to call up the real-time position at the push of a button.

He hits another button to show the positions of the 238 animals as of that minute, accurate within five feet, with updates every thirty seconds. This is all done with motion sensors, and video monitors. And the computer monitors everything even when people aren't watching the monitors.

Arnold also demonstrates to his visitors that every 15 minutes the computer tallies all the animals, breaking them down by category or species, expected numbers vs. found.

-----

Showing his visitors the category table, Arnold remarks, '"What you see here is an entirely separate counting procedure. It isn't based on the tracking data. It's a fresh look. The whole idea is that the computer can't make a mistake, because it compares two different ways of gathering the data. If an animal were missing, we'd know it within five minutes."'

-----

Malcolm and Gennaro probe Arnold on this. Has the system been tested? What do the different columns of the table mean? Are the counts based on motion sensors? Are the motion sensors everywhere in the park? Can you see all the animals, if they want to? Can they get out of their enclosures? What would happen if they could? Can anyone tamper with the control system?

This reveals that: the sensors cover 92% of the land area; that fences are electrified; that the animals are genetically engineered to die within 24 hours of not getting a particular nutrient; they cannot reproduce because they are all female; and the system is hardened and the computer is independent in every way - it does not communicate with the outside and so cannot be influenced remotely.

Arnold is even able to measure each species of dinosaur as a group based on height distribution. This shows a normal Gaussian distribution or standard bell-curve.

-----

'"You'd expect that kind of graph," Malcolm said.

"Yes. Any healthy biological population shows this kind of distribution. Now, then," Arnold said, lighting another cigarette, "are there any other questions?"

"No," Malcolm said. "I've learned what I need to know."

As they were walking out, Gennaro said, "It looks like a pretty good system to me. I don't see how any animals could get off this island."

"Don't you?" Malcolm said. " I thought it was completely obvious."

"Wait a minute," Gennaro said. "You think animals have gotten out?"

"I know they have."

Gennaro said, "But how? You saw for yourself. They can count all the animals. They can look at all the animals. They know where all the animals are at all times. How can one possibly escape?"

"Malcolm smiled. "It's quite obvious," he said. "Its just a matter of your assumptions."'

-----

Malcolm then tries to explain why a distribution curve for a normal biological population is a really concerning to see in an animal park where everything is meant to be controlled. At this point, he loses Gennaro, leaving it to the tour of the island to make everything clear to him.

Its on this tour that Grant discovers an egg-shell. A dinosaur egg shell.

This is reported back to Hammond and his team in the Control Room.

-----

'"Absolutely absurd," Hammond said in the Control Room, listening to the report over the radio. "It must be a bird egg. That's all it can be"

The radio crackled. He heard Malcolm's voice. "Let's do a little test, shall we? Ask Mr. Arnold to run one of his computer tallies."

"Now?"

"Yes, right now. I understand you can transmit it to the screen in Dr. Harding's car. Do that, too, will you?"

"No problem," Arnold said. A moment later, the screen in the Control Room printed out [showing that all 238 animals were accounted for].

"I hope you're satisfied," Hammond said. "Are you receiving it down there on your screen?"

"We see it," Malcolm said.

"Everything accounted for, as always," He couldn't keep the satisfaction out of his voice.

"Now then," Malcolm said. "Can you have the computer search for a different number of animals?"

"Like what?" Arnold said.

"Try two hundred thirty-nine."

"Just a minute," Arnold said, frowning. A moment later the screen printed [showing 239 animals found against 238 expected].

Hammond sat forward. "What the hell is that?"

"We picked up another compy."

"From where?"

"I don't know!"

The radio crackled. "Now, then: can you ask the computer to search for, let us say, three hundred animals?"

"What is he talking about?" Hammond said, his voice rising. "Three hundred animals? What's he talking about?"

"Just a minute," Arnold said. "That'll take a few minutes." He punched buttons on the screen. The first line of totals appeared.

"I don't understand what he's driving at," Hammond said.

"I'm afraid I do," Arnold said. He watched the screen. The numbers on the first line were clicking.

"Two hundred forty-four?" Hammond said. "What's going on?"

"The computer is counting all the animals in the park," Wu said. "All the animals."

"I thought that's what it always did." He spun. "Nedry! Have you screwed up again?"

"No," Nedry said, looking up from his console. "Computer allows the operator to enter an expected number of animals, in order to make the counting process faster. But it's a convenience, not a flaw."

"He's right," Arnold said. "We just always used the base count of two hundred thirty-eight because we assumed there couldn't be more."'

-----

The computer continues its count. It finally finds 292 dinosaurs against an expected 238.

-----

'The radio crackled. "Now you see the flaw in your procedures," Malcolm said. "You only tracked the expected number of dinosaurs. You were worried about losing animals, and your procedures were designed to advise you instantly if you had less than the expected number. But that wasn't the problem. The problem was that you had more than the expected number."'

-----

This is a key turning point in the novel, where Hammond and his team are exposed to evidence that their assumptions were wrong - a harbinger of impending disaster.

Throughout the rest of the novel, they fight against these revelations. The new information did not fit with their assumptions. It was not plausible to them. As a result, they were unable to manage the unfolding disaster.

This is a key problem with the regulatory framework for Operational Resilience. Plausibility is too easily reduced to a subjective exercise where extreme scenarios are written off.

Half-way through the period for fully implementing the new requirements, this is a serious problem for firms and FMIs. The Bank and PRA have noted that many firms have further work to do setting impact tolerances for financial stability.

Given the scale of the harm that can be done, it can be expected that the impact tolerances for financial stability would be some of the shortest for firms.

Systemically important firms and FMIs that have not managed to identify, assess, and set credible impact tolerances for financial stability will be working to establish their resilience against a false horizon.

This requires urgent review if institutions are to course-correct in time for March 2025.

So, what do these systemically important institutions need to do?

First, you need to have a clear definition of financial stability if you are to understand how a disruption to an important business service will impact it.

Second, you need to identify the risk channels that will transmit the disruption to have that impact at a systemic level.

Third, you need to push your understanding of disruption beyond BAU or normality to consider who you can impact and at what level during volatility.

This last aspect is essential - and its where plausibility comes back into play. I am willing to bet that if you are ruling out severe or extreme scenarios with certainty, you are doing it wrong. This is especially true because our assumptions are naturally biased towards what we consider to be normality.

Certainty is a dead give-away because uncertainty is king in Operational Resilience. It rules because dynamic complexity is at the heart of everything we do.

This brings me back to Weick and Sutcliffe. As part of their wider emphasis on the importance of sensemaking, they state that doubt is crucial in managing the unexpected. In doing so, they draw upon the work on Eric-Hans Kramer and his analysis on "Organising Doubt."

-----

'Two themes tie together Kramer's analysis. First, "If the environment is dynamically complex it is impossible to know and understand everything in advance, therefore you need to be able to doubt your existing insights."

"Second, "If the ability to doubt is of crucial importance for organisations dealing with dynamic complexity, organisations need to organise their ability to doubt... (A) spirit of contradiction should be organised."

A "spirit of contradiction" is established when people are confronted with different points of view, argumentation and criticism are encouraged, controversy is sought and discussed, and all of this increases the variety that can be mobilised to deal with the unexpected. This contrasts with a "spirit of accord" where sensitive topics are avoided, people use tactics of polite conversation, and "arguers are motivated to present a favourable image of themselves." A current worldview may assist adaptation to the categorised world it envisions, but unless that worldview is both believed and doubted, adaptability to change is lost.'

-----

I'll quickly highlight the importance of Diversity and Inclusion to supporting a spirit of contradiction - we are all individually limited to what we know and it takes an organisation to make sense of Operational Resilience. This can only happen where we have requisite variety and cultures that encourage everyone to speak up and contribute.

Its also important to consider the importance of adaptability to change to meet the new Operational Resilience requirements in addition to developing a mindful, resilient organisation.

If Operational Resilience in all its forms has been introduced in a "spirit of accord," it is unlikely that the the organisation will have adapted sufficiently to effectively embed it.

Following the principle of proportionality, the financial stability related impact tolerances for systemically important firms and FMIs will experience the most severe supervisory testing.

Their credibility will be a reflection on how effective the organisation itself has been able to adapt and challenge their existing assumptions in order to meet the new requirements and make sense of the disruptions that complexity can throw at them.

At this half-way point to full compliance, we are not short of challenges to our existing assumptions. This is something that is affecting everyone involved in the process. With that in mind, I'll come back in the next instalment with my reflections on where my own assumptions have been thoroughly put to the test, and share some of my latest thinking.

And yes, I'll bring along some more dinosaurs.