My 600 km bike trail through the alps ... and what this tells about corporate resilience

Surprised by the events, I decided again to put down my notes about my summer-break bike tour and what this has to do with corporate risk and resilience, as they turned the challenge into an adventure.

A bit background: my wife and I have been planning since more than six years, to do the Ciclovia Alpe Adria, a bike trail through the alps heading towards the mediterrenian sea. Right before the pandemic all was set, which we had to cancel last minute. But its never too late and we finally did it in 2nd & 3rd week of September 24.

So far so good. Right after the first event I started to put down my notes and here you find 12 anecdotes. I feel they have a lot of parallels to managing corporate #resilience.

1 - THE ADVENTURE BEGINS!

Kilometer 5, one of the saddle bags segregated from the bike. In other words, the bracket is solid on the bike, but not at all on the bag. What to do, when you loose one third of your transport capacity? I tried to fix it with available resources (belts! cool idea, right?), but that did not look sustainable. I thought then of carrying the bag on my back, even knowing what this means for my back... But my wife immediately changed from incident into crisis mode, looking at the event from a different perspective and took over decicion making. She said: "This was not the purpose of the trip, we agreed not to have anything on both of our backs." Having said this, she activated external help (Google) and found a bike repair shop. Five minutes before closing (its Saturday afternoon) we arrived and lucky enough they found a second-hand saddle bag in the cellar.

NOTEWORTHY: The crisis mode helps to think from different perspectives and seeks for help, you would not imagine when you try to solve the incident only with the available tools.

2 - ROOTCAUSE ANALYSIS

While continuing with the journey, we had time to think about the root cause for this incident. I recall we had to fix this bag after our last trip, but the handyman did obviously only a simple patching. Another memory popped up: "Wasn't there another repair by him, what did not go as expected?" Funny enough, I checked before the trip, if another bag is fitting and solid enough (because it was new...), but did not consider a testing need of the 'repaired' one.

IMPORTANT: Manage third-party risk, understand what your suppliers are doing - and in case of other incidents or low performance, build the link to your critical services. AND: If a functionality is significant or critical (i.e. 30 % transport capacity), do testing in live environment.

3 - ENERGY OUTAGE

Second day, a bit longer route than yesterday and my smartphone (with the important GPS support of a touring app) turns already after 50 km into blackscreen. Yes, permanent live updates consume energy, but that much? Further analysis unveils the wolverine: Why do I have that many apps open and have Google Maps in parallel running? Interesting how a not sustainable approach to use limited resources can lead to a problem for resilience. But anyway, I carry a power bank with me, no problem. Where is it? After a felt eternity I found it at the bottom of one of my bags. Clear - heavy stuff at the bottom, well placed ... but not when I need it. And where is now the cable?

TO BE CONSIDERED: Backup solutions need to be available, well known and in operation within an acceptable time, also called Recovery Time Objective. If critical - testing is recommended.

4 - LOOKING FOR GREAT LUNCH

Like a marathon runner you need a set of targets. This helps to keep the motivation high, even if you fail to raise the bar, ... or achieve at least a satisfactory level. As I became more and more hungry, I had to learn this concept. While biking through Upper Bavaria, it was obvious, that I want to eat for lunch a classical pork roast and drink a beer, here you get the best of all - my target 'A'. Unfortunately our route did not cross an open bavarian inn. Good to have a 'B' target - a classical bavarian snack and buttermilk from a local farmer would be also OK. But even this failed. Finally I realized, that a 'C' target would also make me satisfied and avoid to get my enerfies down. An apple right from the tree ... it was probably not the greatest lunch, but it was ensuring that I get at least the absolute minimum of lunch-time food and finally made me happy.

GOOD TO KNOW: Have a set of ABC targets to ensure ambition if all around goes well and be clear about the utmost minimum, if surroundings are not as expected.

5 - CLOUD RISK

Next day. The weather turns from sunny into variable. Clouds are at the horizon. Not nice, but we realize that they are where we are heading for today. There is only one way through the valley, no other option possible to avoid it. Any route around that, would take us days. Still in the mood of a late summer trip, I feel like being forced into this single way with unclarity of weather conditions. Same like some corporates might feel with 'Cloud Providers' as monopolists. No clue what is there behind. But more interesting, how do we deal with unclarity: Eyes closed and through and see what will happen? Or, do we have mitigations like rain protection and warm stuff ready for immediate change of cloth. We decided for the second and it was good to be ready, as it was finally more hitting than we imagined.

TO HIGHLIGHT: Its better to manage cloud risk in advance, be assured of appropriate controls and have the back-up ordered in advance ... not once its too late.

6 - WHO NEEDS CONTROLS?

Controls are a burden, not only in a company, also at a bike trip. Useless add-on effort and worth nothing. I'm in charge of my stuff, I know what to do and I'm doing it right. Often heard in department meetings and also my inner voice is discussing this during hours of cycling. The lost power bank (obviously an important asset - see chapter 3) in my jacket with the open zipper; the forgotten belongings in the bath room or the unlocked bike in a crowded street are telling different stories. It turns out that the extra work is disregardable compared to the anyway running efforts or the potential loss, often only a small add-on of a routine or a second check by another person.

LEARNING: Protective and responsive measures are only as good as they are effective in place. Thanks to my wife (or should I say my 'Second Line of Defense'?), I have been reminded of their value.

7 - WINTER IS COMING!

Day Five. Starting the twelve days-trip in T-shirt and short trousers, at sunny 27 degree Celsius and with a weather forecast along the route of only two days of light rain, we would have never imagined, that we might face any snowflake. We were more concerned about having enough sun-cream with us, especially in the high mountains and you know, cows return from their alpine pasture by end of September... While doing our day trip, we saw it with our own eys, that snow is falling in the neighbour valley. Time to start our threat monitoring. We are equipped for rainy weather. But snow in the face, freecing fingers and tyres on ice are a different number. Even a short distance would be a challenge, let's be prepared.

TAKE-AWAY: Its important to have a permanent threat monitoring in place, and also to define early warning indicators, based on your risk appetite. Looking back, it turned out, that we are one day in advance of the snow wave. From the route behind us, we heard about traffic jams and train cancellations due to sudden snowfall.

8 - COMBINED SCENARIOS

Day six: Imagine you are at your highest point in the alps; the next stage is a sharp downhill of 500 meters; weather forecast talks about a sudden drop of the snowfall limit to 1000 meters and alerts on heavy rain, potentially ice rain and on top of that a? street sign is warning you of a damaged road surface. Some might call this a challenge, some might be happy about free of charge acupuncture needles in the face ... I call it a combined threat scenario, moreover, as the long-term weather forecast did not alert at all on such an extreme development. What to do now? Intuitively we mitigated as many threats as possible, ensured we are wearing complete rain protection, took on a second layer of warm cloth and even more changed wet cloth (caused by the uphill ride before). With these measures we reduced the impact of some of the threats and were fully concentrated on the remaining ones.

LEARNING: You can't fight all threats in a combined scenario and even anticipate all combinations, but you can reduce the impact by implementing available mitigations and focus the emergency response.

9 - NOT RAINPROOF!

Sometimes the buzzword 'integrated risk assessment' is difficult to understand. Here is a simplified explanation. Very often risks are looked into from a mitigation perspective. As an example, I purchased on occasion a new rainproof jacket and overgarments for my shoes. The result of this approach landed on the heating - my trousers soaked up with the full load of permanent rain (see chapter 8), as they were only rain-repellent. Integrated risk assessment applies a different systematic, starting with all possible threats, assessing the probability and impact and finally looking comprehensively into all necessary mitigations for the critical assets and checking its effectiveness via controls. Applying that logic would have helped me to name rain amongst others as a possible threat, with high probability of heavy rain in the alps and the only protection with a full set of rainproof cloth - rain-repellent not as sufficient. BTW: Same logic would have helped for the third-party risk, see chapter 2.

LEARNING: Rain-repellent is not rainproof. Integrated risk assessment makes sense!

10 - BREAKING NEWS

Day eight: Forget everything I was telling so far. We usually don't switch on TV when we are on vacation. Don't know why we did it, but while we were zapping around, we realized the breaking news, tonight and tomorrow heavy rain (up to 200 l/sq m, happens only once-In-hundredfifty-years), above an altitude of 600 m also snow and wind up to 100 km/h are expected and our route is in the affected zone. Potentially we are on the edge of the weather front, but you never know. We made our plans for tomorrow, in case this weather would hit us ... train, ... taxi, or ... break up.

LEARNING: While we used for our weather (thread) monitoring usually only one app, it turned out, that events can evolve much faster and more extreme than you thought, therefore activate multiple threat monitoring channels and ensure to gather all information just in time.

11 - EXPERIENCE

I'm proud of my experience doing hiking and biking in the alps. And experience means a lot of know how, what you can't have enough, when you run such an endeavor or any enterprise. But what helps experience, if you can't adopt to a new environment and changed conditions? Like the sticker in my bag (telling about a previous big tour in the mountains) disappeared after two days. I had to accept that I forgot some previous learnings and had to adopt to extreme and fast changing weather events. We started at nearly 30 degree Celcius and were one day close to freezing level. Truly new circumstances.

CONFESSION: Experience is helping to a large extent to manage challenges, but it is not sufficient to rely only on past 'memories', we also need to have the capability to adopt to new and fast changing surroundings.

12 - CELEBRATING SUCCESS

Day twelve: It's done. With 600+ km and 4.200+ m height behind us, we are enriched with experience about beautiful landscapes, interesting people, exceptional food, our own capabilities (even beyond expectations) and extreme and fast changing weather conditions. Yeah, we made it and are proud of it! Its now time to celebrate success, our learnings and our partnership - dealing with all the challenges is together much easier!

SUMMARY: Operational resilience is managed in advance. Potential risks need to be identified in time and not once they happen. Protection has to be available before the event is hitting you. And cost for mitigations turned out as true investment into resilience, as they helped us even on the worst days to perform better than on other days and like other biker on the road.