More risk related acronyms ... let's consider BANI

How do you deal with the unexpected?

Acronyms in risk can be useful … probably. A couple of months ago, I wrote an article of how considering the acronym VUCA (Volatile, Uncertain, Complex, and Ambiguous) might be useful in context of your approach to risk. It turns out, there are many other risk-related acronyms that provide a simple framework for areas to consider, whether that focuses on how people 'feel' in situations (BANI), more of a view on the situations themselves (PLUTO), or thinking about the internal (PESTLE) and external (MORTAR) influences and factors you should review and assess. As always, I write this in context to risk management technologies.

You can never have too many acronyms (!?) … so let's tackle BANI first …

BANI

While the VUCA model provides a useful framework for navigating organizational challenges, on its own it may not be sufficient. The pace and nature of disruption have accelerated to a point where the world isn't just complex, it is often perplexing and anxiety-inducing. Jamais Cascio created an additional framework called BANI (Brittle, Anxious, Nonlinear and Incomprehensible) describing the chaotic and fragile reality we see around us. This alternate angle on risk can provide a view for organizations to understand their vulnerabilities and adapt in a world of chaos. Let's take a deeper dive …

Brittle

When you look at an organisation, or a system, in reality how stable is it? Having a deep understanding into your risk profile is incredibly important to invest time and budget into … that picture needs to provide a clear picture that your organisation is not susceptible to sudden and catastrophic fragility. It is often the case that unseen or small events expose a lack of resilience and how brittle your system and policies actually are. So ensure that making that investment, to analyse, forecast and adapt is worth it.

Some considerations

• Invest in a risk knowledge bases and continuous analysis. Define your organisations risk profile in a manner that can be converted into mitigations that can be tested and measured

• Understand how to calculate and measure impact, whether that is on people, operations, supply chain, technologies, revenues or whatever. These measures help provide direction and weight to the controls you put in place.

• Feedback learnings into projects to improve policy. Look to the technology in place to provide analytics and trends to find gaps, inefficiencies and blockers.

Anxious

Your risk culture is not just about how you tackle risk, it is also about how your organisation collectively fells about risk. It is so easy to absorb all of the streams of information available, draw a negative picture of the world … and turn that into anxiety and inaction. Your culture needs to be built around foundations of vigilance, authenticity and action. Collective anxiety leads to a spiral of powerlessness and sense of insecurity. Turning anxiety into confidence is a key factor here.

Some considerations

• Use exercises/simulations to educate your workforce on how incidents are to be managed, how people should reach out for help, and being prepared to adapt when situations take an unexpected change.

• Encourage leadership to evangelise to what teams and systems are in place to protect the workforce and the business. Don't hide your programs and technologies away if you are expecting people to work with them in a crisis.

• Have clear lines of communication within the organisation to ensure there is a consistent understanding, collective confidence in the resilience of the organisation and channels for people to reach out.

Non-linear

As much as we would love to be able to perfectly model and predict everything that will or could happen to our organisation … that is not the way of things. Events can change direction quickly and catch you off guard. Ignoring or underestimating non-linear events is a key factor in creating further chaos. Having procedures in place to learn and adapt on the fly rather than reliance on inflexible processes, will define your success or failure.

Some considerations

• Ensure your technology can adapt when circumstances change. You should be able to implement your policy based on expected process and outcomes with the idea that anything can be changed if or when necessary.

• You can't see the unforeseen … but you can create an environment, and especially technology that is ready to learn and adapt based of existing process and pull in data from sources you would not normally observe.

• Investing in more expansive analysis on world events, their impact and cascading/inherent behaviours is of vital importance to resilience. Hope is not a strategy … waiting for the worst to happen is a recipe for disaster.

Incomprehensible

Sometimes there can be too much, overly complex or conflicting information … the truth or reality to a situation may not be clear or obvious. This can lead to confusion, poor judgement and anxiety. Working your way through this flood can be daunting, but technology may be available that can help provide a path or find the patterns that matter and impact your organisation.

Some considerations

• Have technology and partner solutions in place that not only acquire and analyse information from numerous sources, but identify patterns and truth … your response and decisions will depend on this.

• Be aware of how reliable your sources of information are … be cynical and ensure that your future analysis understands where the best and most accurate information comes from, this may help find reality much quicker in future. Review how curation can help this process, whether an internal process or through an external intelligence provider.

• Don’t panic … just because the picture is unclear, work through your process to find clarity and adapt activities if or when that picture changes. Look to technology to provide the situational awareness and impact.

In summary

Whilst BANI, like VUCA paints a picture of chaos and destruction, they provide some useful frameworks to consider how your organisation would react and tackle crazy and unexpected events. Identifying threats as early as possible is going to be key … even if it is in the moment. Your risk technology should be both willing and able to rapidly take these onboard, adapt where necessary and provide the tools to respond and recover as effectively as possible. If you rely too much on rigid procedures and technologies … these may be the greatest risks to your organisation.