Operational Resilience, Risk Management and Crisis Decision-Making with Bruce McIndoe

Speaker A: M Ever wondered how trailblazing risk leaders navigate uncertainty with finesse and confidence, Uncover the surprising connections between their personal journey and professional prowess, and get ready to learn and elevate your risk management game with the Risk Masters podcast. Join host Julian Hay in collaboration with risk.net, ah as they delve into hidden gems of risk leadership through engaging conversations and thought provoking insights from board directors to chief risk officers and business leaders.

Speaker B: Today's guest is Bruce Makindo, founder of iJet and one of the most recognized voices in global crisis intelligence and operational resilience. Bruce has spent decades helping global organizations anticipate, uh, and respond to disruptions that most companies only notice when they are already unfolding. His work spans crisis management, travel, risk intelligence systems and enterprise resilience for Global 2000 organizations. Bruce now advises leaders on how organizations can move from reactive crisis management to truly predictive resilience. His perspective is unique. Having worked across hundreds of organizations, Bruce has seen exactly where the cracks tend to form. He's seen how uh, disruption actually takes shape, the common ways information gets trapped into silos, and the recurring blind spots that lead even the most seasoned executives to overestimate their readiness. In this episode we look at those common failure points and what they reveal about why organizations react under pressure. I'm Julien A. And this is Riskmasters.

Speaker C: Welcome back. Today it's my pleasure to welcome, um, Bruce Mackindo on the show.

Speaker B: Bruce, welcome.

Speaker D: Yes, I'm looking forward to it.

Speaker C: So Bruce, you've spent much of your career working across organizations. Fact, we were just talking about it just before recording. So rather than inside just one from that vantage point, what does it reveal about organization resilience that leaders inside their own organization often miss?

Speaker D: I think, uh, and what we talked about before is working across organizations, I see immediately that managers, especially senior managers, confuse risk reporting with resilience. And risk registers, heat maps, you know, they satisfy like the governance, you know, checkoff list, but they do not tell you or leadership whether the organization can still achieve its objectives when things change. Right. So the bigger issue is that what I call the protective discipline. So that's the whole range of cyber, physical, business continuity, environmental health, you know, hr, you know, uh, regulatory, audit, legal. All of those are there to protect the company. Right. So these protective disciplines usually operate in fragmented silos throughout the organization. And those silos create blind spots, gaps, um, and failures of imagination. We hear about that from a long time. So I say real resilience requires an all of organizational view around uncertainty and dependencies. You know, Coordinating that action. So I, I, when I talk to senior managers, I, you know, I, I say that boards need to quit asking the question what are our top risks? What are they going to do with that? Right. Um, what could prevent what they should be asking, like what can prevent us from achieving our value generating objectives and are we structured to detect those potential changes, uh, and decide and act on them to increase that certainty? So that's, I guess the whole realm of, I think we're going to talk a lot about today.

Speaker C: Yes. And I suspect the answer to your question is no, but let's go back to it.

Speaker D: Oh, you want a simple answer?

Speaker C: It's always a little bit less black and white than that, but anyway. And I think it's going to be a good segue to the uh, example you were giving me before we started the show on the impact of the Iran war. Right. When you look across sectors and industries, where does resilience, uh, more often fail? I would say slowly, quietly, somewhere in the background, rather than a big drama, dramatically a, uh, big failure.

Speaker D: Resilience, uh, usually fails quietly in the space between functions that are not connected, uh, and long before it fails publicly, like in an actual crisis. Right. So that's where I would say, and when I say between functions, there's a long list of things like weak handoffs and unclear ownership. Who's going to make those decisions? Um, outdated assumptions from three years ago or even three months ago in the case of Iran. Right. Uh, again, I keep referring to the cross functional coordination and those kinds of things. So you know, it's when, when a signal or an indicator is detected by one team and then not shared. Right. So it's those things. Uh, but, but it also when dependencies aren't understood well also, and this is where the kind of the business continuity teams can come in and really help, you know, clarify that. Um, and the other one is, and, and you know, I'm, I'm a, you know, involved in this all the time where you know, plans are helpful but they're not a solution. Right. Uh, they're, you need to build muscle memory, you need to build capabilities.

Speaker C: Right.

Speaker D: So I, you know, so most failures that I see start from information and coordination failures before they become operational or crisis failures. That would be my scope on that issue. And it's not a yes or a no.

Speaker C: Yeah. And uh, uh, I think there's probably more to unpick on that. So let's drill a little bit more. Right. Many organizations still think about resilience primarily through their internal systems. And controls. And you were talking about top risk and risk reporting, for example, which I will include in there. Uh, from experience working with global crisis and intelligence networks, how often, uh, do disruptions actually originate outside the organization fields of vision? So it's actually an external event happening on the organization?

Speaker D: Um, well, first off, a lot. Um, I would say, I guess this is why when you mentioned focusing on internal controls, those are clean and, and easy to do and people are comfortable with it, but they're leading indicate lagging indicators. Right. So I would say, um, they miss. I guess they, they did. They do originate outside and they're missed. Not because there weren't any signals. And after action was, you know, they always say, oh, we should have seen that coming. Right. Uh, it's because they weren't looking, you know, out far enough, you know, horizon scanning. They weren't looking broadly across the domains or creatively enough. Right. That, that, uh, you know, kind of innovation and thinking about what's happening. So I would say, you know, most organizations are better at kind of managing internal controls and scanning for future external conditions. Uh, I mean, than they are looking at those externals so that, you know, they get surprised all the time because they're looking in the rearview mirror, not out the front windshield.

Speaker C: Yes. And, uh, I had, uh, Michel Wicker on this show talking about gray rhinos. I think it's a good example of the situation of things where people know and are ignoring. Like, yes, if you attack a certain country, you might disrupt the oil supply for part of the world. Um, when you watch how crises actually unfold right around the world, how different is that reality from how leadership teams typically imagine description will appear. So there is actually what you draw. There is. Okay, what's happening on the ground,

Speaker D: um, how about it is usually very different. Um, I think leadership teams, I guess, often imagine, uh, disruption as something that's more clear, more discrete, uh, and linear, that it's just going to go up an escalation ladder. Right. Not fall off and go up another one. Right. That's not in their kind of thinking. So, uh, you know, they, I think they expect, you know, horns to blow. You know, it's crisis time. Right. No, it doesn't happen. You know, it. Crisis and. Well, I'd say let's start with disruption. Right. Will often emerge just unevenly. It'll be popping up in different areas. Right. So, uh, and this is again why I, you know, constantly am out there in the market, you know, helping companies reimagine how they're doing this and bridging all these silos. And I use that term all the time. Right. So, you know, I guess, um, you know, in the real world, I guess, you know, the important piece of this is the earlier that you look at these signals when they're ambiguous and contested and don't have people just kind of sitting back, it's that leaning forward, really discussing those early is what ultimately is going to give you the outcome that you're looking for and get ahead of it. So I guess that's probably what I would say.

Speaker C: And that sounds very sensible and logical. Right. And yet many leaders assume that if something serious is developing, they will see it. Right. It's like it's going to be frontline, front of the.

Speaker D: Yeah, it's going to announce itself.

Speaker C: Yeah. Ah. From your experience, building on what you just said, what makes early warning, uh, what makes early warning signals so difficult for organizations to recognize or interpret? So you talked about silos, for example, but do you see anything else?

Speaker D: Um, yeah, unless I spent, you know, a lot of my time, first 14 years of my career in the intelligence community and I was actually spent a lot of time developing indication and warning systems. So warning intelligence is all about surfacing these weak signals. Right. That are weak. Right. Uh, ambiguous, contradictory. Right. So you have to kind of look at different, you know, scenarios and um, and they are distributed across, you know, you know, domains, what we call, you know, war fighting domains, but also war fighting capabilities, you know, air, airspace, ground. So it's the same in commercial world. Right. One team sees a, you know, geopolitical indicator, another supplier issue, um, a uh, cyber anomaly. You know, but no one is looking at those fragments, what we call intelligence fusion. Right. You know, they don't look and bring that and say, oh, wait a minute, that cyber is actually related to that actor which is causing, they're not picking that up. Right. So I guess, you know, the problem is not that the signal is invisible or weak, they are out there. It's that it didn't look decision worthy and nobody elevated it, uh, and to the people where it mattered and that they can take action on. So I guess that's what I see in the warning gaps in commercial companies.

Speaker C: Uh, and I think just listening to you, the challenge is the fragmented signals as you describe them on their own are probably not particularly meaningful. It's only when people connect the dots as you just outlined that it start giving a different storyline or picture. So how do you think people should address that? Because it's, I mean in very large organization you're being bombarded with signals all over the place.

Speaker D: Um, I guess, I mean, part of this, and I know in your list of things, you know, you talked about culture and those kinds of things and it's um, it starts with like, how are you organized and, and how do you look at the problem and who's involved with the problem? Right. Um, in fact, when I, when I start with uh, companies, I always talk, tell them everything that I'm telling you today that I think you should be doing. You already did and it was hugely successful. And then they look at me and like what? And you had an existential threat Covid, What'd you do? You put it together, a team, multidisciplinary team. You gave them all access to the same cross functional data and you said save the business. And then you let them execute and you shorten that OODA loop, right? The decision cycle. They work together, they came up with solutions, they deployed them. If they work, they scaled them, if not, they came back and you just work that through and save the business. The mistake you made is you didn't institutionalize that. And that's my thread here today, that if companies would step back and look at the environment and build these teams around the key capabilities that they need for their business, multidisciplinary teams, they're going to be way ahead in the resilience and risk game.

Speaker C: And building on that, organizations also tend to believe that their crisis plans will guide them, uh, will guide behavior when pressure hits, uh, going beyond the fact that they should institutionalize some of this behavior on an ongoing basis. When will descriptions occur? What tend to diverge most from what leaders expected the organization to do? So they thought it will respond and it somehow doesn't.

Speaker D: Right. I think that's an easy one. What usually diverges most is behavior. The documentation's there, right? But it's the behavior. Leaders expect that these crisis plans and business continuity plans are going to create clarity under pressure because it's all documented. But you know, real disruption exposes where clarity, you know, never existed. So um, you know, I guess the important point is that, you know, under stress, organizations do not rise to the quality or the lack of quality of their documentation. Right. They fall back to the quality of coordination, um, relationships, decision making habits. You know, this is where the focus should be. And in fact, when I go into an organization, one of the first things I do when I'm talking to the various departments is I find out what's the connective tissue to the other departments. If they have a low connection coefficient, they're not going to be a resilient company. If they have a high, then they're probably on the right track. Simple metric.

Speaker C: Um, and I suppose that leads us to AI Right. We can't really have, uh, a discussion nowadays. Uh, so, uh, you've been working with AI in neural network since the early days at uh, another department, uh, or the former Department of Defense. Today, many organizations are adopting AI primarily for efficiency and to an extent for risk management. But from a resilience standpoint, do you see a risk that automation might remove some of the human judgment that traditionally catches those things early? Right. Because it's ambiguous, it's not rule based and human can deal with this ambiguity.

Speaker D: So absolutely. Um, if organizations, uh, use AI uh to drive efficiency, which is great, but unintentionally remove or automate judgment away from humans, fail. So again, you know, these early warning signals that are what really matter now, especially in a complex world, you know, are weak, ambiguous, you know, they're context dependent and they, they're not a clear pattern for A.I. you know, whether it's, whether it's a, um, you know, m. Machine learning, which is more, you know, deterministic or whether it's, you know, LLMs, where you're building, you know, models, it's, it's just not there. Right. So, you know, an AI, ah, you know, it can help in, you know, scanning data and identifying anomalies and all that stuff. But at the end of the day, and we've proven this in the intelligence realm, government intelligence, when you bring all that to a human brain and make that judgment and have accountability, those are mandatory. And you can't just automate that away with AI agents.

Speaker C: Well, at least not, not yet.

Speaker D: No, we can't, we cannot. I'll tell you this, we can never, uh, we should never automate away accountability. There should always be a final human. When it matters. If it's kinetic life safety, there needs to be human accountability. And before that should be human judgment. That, that and I think if we fail in there, we'll fail as a society.

Speaker C: Yeah, and I completely agree with that, by the way. Um, so from the outside looking in and when you look at, when you go to your client. Right. What control signals tell you whether an organization is truly resilient or simply appears to be organized?

Speaker D: Well, we talked a little bit about, you know, relationships. Uh, Right. Um, I guess, you know, I would say because I work with a lot of large companies, when I go in there, they look organized on paper, there's no question, you know, um, but it's whether people feel empowered to bubble things up. Right. Uh, you know, especially if it's bad news or things that they aren't really certain about. You know, they don't want to create, you know, uh, you know, noise or get, you know, get people spun up over nothing, quote, unquote, right. When I see those kind of behaviors, then I. Then I know it's a problem that needs to be focused on. So, you know, kind of a truly resilient organization. When I come in and talk, and I always start at the functions and talk with them and then work my way up because I have a better insight when I talk to senior management, you know, when I see a truly resilient one, it's. It's when it's safe, right. For people to raise those concerns before all the facts are in. Right. And, and be able to have cross functional challenges between legal or regulatory and what's happening operationally. Right. So, uh, when, you know, when you find out whether the culture actually supports. And why we keep talking about culture, uh, if it actually supports resilience rather than neat documents and dashboards, you know, that's what I focus on and, and really get to the heart of it.

Speaker C: And one aspect to that, right, Is, uh, where do you see escalation pathways more often distort or dilute critical information before it reaches senior leadership? Because that happens a lot as well, right?

Speaker D: Oh, absolutely. Uh, in my mind, uh, there's no question that information is most distorted in those middle layers, you know, where people feel a tie, right. They want to protect leadership from noise and ambiguity, but they also want to protect themselves in dealing with the teams that are saying, well, I think this is really important. Right. And so it's that middle layer that struggles with transforming weak signals and ambiguity up to leadership. I would say uniformly.

Speaker C: Yeah, I see that as well a lot in, in my work. Um, but I would say not necessarily. It's not bad intention, by the way. No, it's. It's probably the most difficult job.

Speaker D: Human judgment.

Speaker C: Yeah, it's probably the most difficult job in the world, right. To be in that, uh, that middle trench of the sandwich. And across crisis you've observed, what patterns, um, do you see around silence, fear, overconfidence that leaders rarely acknowledge?

Speaker D: Um, I guess, yeah. And kind of building on the other conversation here was, is, you know, I would say the pattern that I see repeatedly is that silence and overconfidence coexist. And just when you turn it into a leadership hierarchy, leaders are overconfident. And the People that are down there with actually seeing the signals and censoring, you know, they're like, that's silent. Yeah. So, uh, so, you know, that combination is incredibly dangerous. And something that actually has. You have to build, uh, trust. You have to build, uh, well, truth leads to trust, and then build capabilities to make sure that uncertainty, you know, you know, doesn't get suppressed on its way up. And that there's a path for bringing that to leadership that's acknowledged and valued, uh, I think is really the key thing.

Speaker C: And, and I think you've touched on that already. Right. But after major failures, we can hear organization often saying that, you know, the warning signs were there. Right. If those signals are so visible in hindsight, why is it so difficult culturally to give someone the authority to act on them in real time?

Speaker D: Because, you know, and having sat through many after action reviews, right, um, hindsight creates this false impression of clarity, right? The people always say, oh, 2020 vision in hindsight. Right? And, uh, and so they're, you know, they're all like, well, yeah, we saw that. And you know, you know, and it led to this. So they don't actually do the hard work of saying, well, when did we see that? Right? And what did we do from between when we saw it and when we actually took action? Right. So that whole, uh, piece of it is what really, you know, I try to get them focused on. So, um, you know, acting early involves, um, you know, work. Uh, you know, you're not going to have consensus. I guess that's probably the key thing, right? You know, you're, you're, you have, you know, trying to keep everything comfortable. You're holding it down. But, you know, if I really think about it, you know, if, if people can be, um, actually what I guess said, I put a note here that I wanted to say authority in companies is often granted for managing known situations, not for interpreting ambiguity. Right. I would say. And the reason I'm saying that statement is it's so true, right? If somebody sees, it's like a, uh, Covid. It's like, okay, that's a known situation. Let's put a team together, give them authority. Right? But if somebody says, oh, you know, there's this weak signal of something that happened in China and some people are dying in this, you know, bio, you know, uh, lab. And, you know, and it's like, well, they don't say, well, then let's get on this. And here you have authority to put the hasting together and see if it, you know, matters, you know, that's, that's the, that's the difference. So you know, as a result, you know, people wait and uh, not because no one saw anything, it's just that they, the culture didn't make it safe for them to legitimately bring those to uh, to the forefront. And I think I mentioned to you this earlier in the strategy world, Peter Drucker had the state, you know, saying uh, culture eats strategy for breakfast. Right. And I say in the resilience business, culture eats resilience for breakfast, lunch and dinner. Right? Culture is like critical to that. This open and free environment to be able to bring these weak signals forward is what really can make a huge difference. Absolutely.

Speaker C: And if we build on that, why there's a connection to governance as a result and how an organization makes decision, whether it's in normal time, which usually is, I would say non problematic versus in stress time, where it's usually where things start getting wrong. So many organizations build governance structures designed to manage disruption. Right? And we have playbooks, crisis management, recovery plan, etc. Where do these structures appear robust on paper but really struggle on the real pressure under real crisis?

Speaker D: Yeah, well, you know, they tend to look robust and strong uh, in areas when you have uh, you know, a charter and you have committees and you have roles and escalation paths and, and even decision authorities, you know, are all in, you know, clearly documented. And that's what gives leadership kind of that false confidence. It's like, well, we got this right, we went through all this, we even ran an exercise, right? And uh, and so the problem is that you know, these structures are designed for orderly oversight and uh, not fast moving ambiguity. Uh, to some degree. What we've been dealing with in the last, you know, five or six weeks now, you know, the lead up to, and then the actual uh, kinetic engagement, right. And uh, you know, it's not that it wasn't there, there was just ambiguity around and some of it through, you know, ops, you uh, know, OPSEC and psyops creating ambiguity in the lead up. But everyone kind of knew that this was on heading in that direction. But even then I saw major companies that did not take those early actions, like, didn't even do like a people accounting of like who, who do we have in country right now, right? They could have done that weeks ahead of time and then they're scrambling in the, in the fog of war. So you know, it's like what, you know, what often doesn't break down is the governance, but it's the operating speed, its ability to integrate across the functional and data silos. So, you know, structure, as I said, may look robust because, you know, every function has a role, every, you know, the, the decision authorities, all of that. But what I see is that the, the mechanisms for bubbling up before you kick all of that off, it doesn't exist. And, and, um, it's. And it's culture, it's fragmentation of functions, its fragmentation of data just all sits out there with gaps and seams where all of this stuff happens and forms. Right.

Speaker C: And to that effect, when you think about oversight, are there forms of oversight that unintentionally, uh, really are slowing down adaptation or suppress early warning signals and the ability to respond?

Speaker D: Sure. And that's what I'm saying is that oversight becomes counterproductive when it prioritizes control, certainty, you know, presentation quality, uh, over learning and adaptation and timely escalation and cultural space. Right. And, and, and, and trust. So, you know, if, if people feel like they have to have a fully supportable, validated story before they take something forward, by definition, you've just delayed all of that that they built that with. Right. What you want to do is you want to get into that decision cycle in a, in a fused environment, a bridged environment, so everyone can kind of look at it to become aware earlier. Right. So, um, and I see this even at board meetings, the teams come in there and they report what's tidy and mature and defensible and largely what people already know, uh, that are sitting there in the board or a senior executive team. They don't want to walk in there with messy ambiguity, possibilities, contested. Uh, they don't want to bring that into the room. And that's what I feel like is the biggest change that we need to see in risk and resilience, driven by culture and accepting that that's what the world is. It's not clean.

Speaker C: And if I were to give you the opportunity to sit on the board, right. If you were sitting on the board today, what questions would you ask the Chief Risk officer to cut through that filtering and uncover the real vulnerabilities?

Speaker D: Um, yeah, I'm asked this a lot of times, right. And I can tell you there is no one question. Right. Um, what, what I, what I did do one time is I said, well, I can string together one long sentence. Um, so, yeah, to me, when I do this, it's like, I guess the number one that they should be asking is like, what are the most critical business or organizational objectives we could fail to achieve in the next one to two years, right? Yeah, one to two years. Um, what assumptions are we making about them? What residual risk treatment are we accepting that you're concerned about? Um, uh, what needs greater attention in your mind, uh, especially where you see weak cross functional coordination or lack of data. Right? So if I can sit down and talk with the risk leader and the resilience leader and have walk them through, tell me about those things, because then I can understand what's the. Am I comfortable with the certainty that we're going to achieve that objective? Because you are and you're qualifying that then yes. You know, that's, that's a great, uh, you know, great question to ask. Um, the other one, I guess, um, is the, is the one that's missing, right? Because that's like, okay, you know, instead of just what are the top risks, blah, blah, blah, you know, and what I just talked about, all of those pieces, I guess the one that I see back to the warning is what are we most likely to be seeing too late because the signals are dispersed, ambiguous, or stuck inside silos. Right. If they could ask that question. So all of that stuff is like, what's known now? Ask the question what's not known. What are you thinking about? What's out there that has you, you know, just a little concern. Give us a tidbit, you know, tantalize us with what might be happening, right, and get both sides that then you're going to have the culture that's going to bring that up, uh, the ladder to the senior management and they're open to and interested in the answer.

Speaker C: Well, that's a fantastic question to, to put at the forefront for boards and anyone working in resilience more broadly. I'd love to see the reaction of the CRO, by the way, to that question. That must be very interesting. Um, and what we've seen, right, in a lot of crises there is asymmetry, right, where sometimes a very small event can turn into a massive impact, uh, for a number of organization. And one example I always love to quote here is for example, what happened with uh, Merckx in 2017, uh, although the impact for the primary organization was huge because, uh, when the Russians attacked the Ukrainian tax authority, uh, that had massive impact for them. The Merck was collateral damage in there, right? And through a, ah, very small, what appeared to be a very small dropping into their environment, they lost everything. And that's uh, for me it's a perfect example of a small thing that turned into a disproportionate multi hundred millions impact on the other Side and never mind the description from a global supply perspective. So from your experience, right, which early signals of small failures tend to create really a disproportionately large consequence later.

Speaker D: Mhm. Um.

Speaker B: Yeah.

Speaker D: The biggest consequences and I think you know in both literature and practical uh cases, you know, are often small breakdowns, what I call it critical junctions or low visibility friction points. Right. And uh, you know the typical ones are delayed escalation that we've talked about. Weak handoffs between units, um, outdated assumptions and single dependency was. Is all you know, especially in like the space. When I worked at NASA and did space systems and reliability software for space, you know that failure f. Uh failure mode effects analysis to understand like where are the dependencies and how can we shore them up and blah blah, blah. Right. So, so that's where the, the failures emanate from. And then you know a, a slow gauge wire or a chip that isn't rad hard on a spaceship. One little thing nullifies the whole system, right? Because it goes down so that, so again in those gaps in those spaces is when things you know, would break up. So they need to pay real attention to these, you know what I call low visibility friction points and, and uh, capture them there so that they're not going to turn into systemic failures, you know.

Speaker C: Ah. And it seems to me, right just listening to you, that one aspect here is amplification. When you think about that, um, what do you think are those uh, amplification factors or uh, triggers that will really make a very small event much, much, much bigger as well. So interconnection clearly is one. Right, but that's not the only one.

Speaker D: Oh yeah, there's a. I mean in, in our business, um, like one group seeing data that that's different from another group. Right. And so they're making decisions over here that may be counter to what there should be doing over here. And then the whole system collapses. Right. Um, you have where um, people are um, uh dealing with an issue over here. Right. And, and that issue is throwing off other follow on, you know called cascading issues. But they're not communicating that to the functions that need to know that those issues are being cascaded right into their lap. Right. So that, that's, it's. It's those kinds of things that cause systems to then oscillate and fat and you know, fragment and fall apart. And then um, depending on what falls apart can impact the entire organization and take it down or have some severe impact on ability to deliver on objectives or sustain economic viability just little things like that.

Speaker C: Yeah. So cascading effects is effectively.

Speaker D: It's yeah. In that, in the gaps in those, in those seams between functions. Right. Is where they metastasize and then if they're not managed, it's just like cancer if you don't get at it early takes over. Right.

Speaker C: Looking across organization. So we talked about problem, uh, and framing why we hear. So now let's talk about a bit solution. Which resilience investments are most often uh, delayed and shouldn't uh, be are underfunded because their value is hardest to justify in good times.

Speaker D: Yeah, I, I, you know I always talk about organizations and like you know they typically will underfund the ones that they need the most and that's adaptability and building capabilities in a cross functional environment. Right. And they don't provide visible return, which is the challenge. Right. And, and they're not even a quantifiable return. Right. It's like I could spend all of this effort building capabilities and adaptability and shared data and if everything is BAU business as usual, then it's like wow, maybe we can cut costs back from that and we don't need to do it. That's probably the biggest one. Um, what are those investments we've talked about? Cross functional exercise, building muscle memory and getting people to be able to work together. Horizon scanning. Um, we don't talk about intelligence fusion in the commercial space and it's so critical in state, local, federal to have intelligence fusion where the various functions are sharing information and people are looking at that total picture and trying to understand how somebody taking pictures on a railroad track, you know, and, and that's reported in, you know, could be that they, they're planning a IED or so. So you know, these are often seen as overhead. Um, and you know the, I would say in time deteriorate. Right. So the, and the other one we talked about uh too is, is the, what I call the human side of resilience. Right. So you know, helping people make decisions under pressure and uncertainty and that habit of escalation and being able to be accepted, um, this uh, knowing that sharing that context between the silos matters. Right. And ultimately the mental acuity. Acuity and being able to handle like horrific issues. Right. That come up. So uh, all of that is I would say where investments fail. And I would argue that probably all of those things are the most important than plans and checkboxes and compliance. That important. But if those foundational things aren't there, then they may be largely for not

Speaker C: and if we move to the broader environment, Right. And we talked a bit about geopolitical aspects earlier on the show. Uh, how should large organizations treat this geopolitical friction that we're seeing now more and more as predictable operational constraints rather than unexpected disruptions?

Speaker D: Um, organizations, if they haven't learned already, uh, need to that all of this friction with everything out there, right. Immigration and travel, things that are happening and um, freedom of movement, these are not, you know, I would say, occasional disruptions or unique. This is the environment that we will be living through for the foreseeable future. Right. As spheres of influence form and they make their own rules. And now you're trying to do business with Asia versus Europe versus North America. You know, companies, this is the operating environment. And if you don't understand that, you need to sit back and understand it and adapt your business models and how you operate and how you build resilience. The companies that I work with, the large companies, are building redundant, uh, autonomous capability in the key regions in which they operate. So if they are lose one, just like the Internet, they can still share and do supply and demand between the other two, including leadership. Right. So instead of just everything centrally out of London or out of Oslo or out of, uh, you know, uh, Austin, Texas, uh, it's distributed so that those teams can continue to operate if anything is lost. And that's where, that's the environment that we are now in. And we need to adapt

Speaker C: and building on that. Because you talked about, uh, uh, like people and free movement. Right. Uh, in the world of remote work and distributed teams and learnings, where is the gap between a company's duty of care policy and the operational reality of protecting its workforce? Where you don't really have control over what the workforce does and where it sits.

Speaker D: Yeah, now you're hit. Now you're hitting a, you know, a, uh, hot button on my. You, uh, know, obviously, when I came into this market out of with intelligence world in 1999 and, and really coined the term travel risk management. Right. Um, and uh, it's hard to believe it's 25 years since we deployed, uh, that system. Uh, I always have to tell people that's the biggest mistake in my career. Had I had foresight, I should have come out and talked about people risk management. Because what I see today, and it breaks my heart, I go into these companies and they're, they have travel risk management programs and they show me all the stuff and it's really cool and they're doing a great job. If you book a Commercial itinerary. What about the most important asset to the business, your people? What about the rest of them? What about the ones that are hopping on a train, driving a car around? Right. You know, so duty of care. And in fact, when you look at ISO 31030, it talks about the movement of people, right? The movement of assets. So whether I'm an expat or whether I'm a, uh, local salesperson running around, you know, the neighborhood or whatever, so we've missed that and we've got it. We've got to, you know, bring it back and say there's two sides to the people asset. The risk to the person, duty of care. But there's also the risk that that person accrues to the organization. A lot of times we talk about that as like insider risk, but it's also, um, you know, regulatory risk. It's, it's ah, uh, you know, I guess, you know, different kinds of risks that I can have, you know, reputational risk. Right. Look at what happens when a CEO, you know, has a very public bad action. Right. So, so people risk is, is in my mind what we should be focused on. And the thing that I'll say on my stump here is when I look at organizations, the person, the people asset is the only asset in an organization that does not have a clear risk owner. You know, cfo, financial, you know, the operations thoughts, you know, supply chain and all that stuff. People who, um, it's spread over all, you know, all sorts of functions, right? Hr, just, you know, and, and physical security, cybersecurity, it's all over. And uh, and, and I guess, you know, and I, and I speak at uh, like the Society for Human Resources Management. And I said, you know, a lot of your members are the chief people officer. Seems like you should have responsibility for people risk management and coordinate all of that across all the functions. And they're like, yeah, I don't think so. Anyway, so that, that's a, that's a gap in pretty much every company right now.

Speaker C: Yeah, Uh, I tend to push that back to the people or HR department in terms of overall coordination, not in terms of execution, because I don't think it sits with them.

Speaker D: But no, but again, it's that bridging the side.

Speaker C: Correct.

Speaker D: Who has that? And you know, it should because they're the one bringing them in to the. So they're vetting them, you know, coming in, but they're not vetting them. They're working with physical and cyber and uh, you know, whatever bring that together. So that it works and you're focusing on that holistically, it would make an amazing difference in every company.

Speaker C: Uh, on that note, uh, I'd like to bring our discussion to a close and perhaps an addition, a couple of questions. Um, uh, after decades observing how organizations respond to disruption, and you've already shared quite a few examples on the discussion we just had. What is the hardest truth about resilience that leaders are least willing to hear?

Speaker D: Uh, yeah, I often say, you know, resilience cannot uh, be delegated and it cannot be faked. And uh, that's when I say, you know, it doesn't live in a dashboard, it doesn't live in a, you know, in a risk list and heat map or, or continuity plan or function. So it shows up, you know, whether uh, the organization can actually make good decisions and coordinate across functions when the conditions change and that requires those investment trade offs. So um, you know, I would say that's what they don't want to hear because again, back to what we discussed about making those investments. But you know, the operating choices that they do make and I do see as they reward efficiency, short term optimization and ongoing investment in those things and not building strength in information, intelligence, right decision advantage and capabilities for these teams to work together, uh, they're not making those investments, so they don't, they don't want to hear that.

Speaker C: And so if you were to give them uh, just one advice, one thing that they should address to address those recurring themes, what change do you think will make the biggest difference for them?

Speaker D: One, hopefully if anyone has made it to this point in the conversation, they know what my answer is going to be. You know, if they could make one fix, it would be to fix fragmentation across their organization, across the functions and data. And in the age of AI, uh, we have the amazing opportunity today to not bring all the data into a data lake or a huge, but now throw a what we call unified knowledge fabric over the enterprise and lace all those data repositories where I can ask the question, here's a threat, who cares about it? What is it going to impact? How is it going to impact our objectives and get that answer in minutes or seconds that exists today. And that will be pretty amazing as companies deploy that and have those teams come together around what we call shared consciousness. So that's my risk and resilience nirvana.

Speaker C: Well, fingers crossed it happens because I agree with you, the technology is there, so let's build on it with that. Bruce, thank you so much for your time and insights and wisdom today. It was a fascinating discussion. I'm sure people took a lot and will take a lot of it. So best of luck with all of your endeavor and looking forward to have you again on this show.

Speaker B: That was my conversation with Bruce McKendo. What really struck me today is how differently disruption unfolds compared to how most organizations expect it to. Many leadership teams assume that if a serious threat is developing, it will eventually become obvious that there will be a moment where the organization clearly recognizes what is happening. But as Bruce has seen over decades observing global events, it rarely works like that. Disruptions rarely arrive in a neat and recognizable form. They emerge through fragments of information as scattered signals that initially seem unrelated or distant. The real challenge is not responding once a crisis is visible. It is recognizing that something important is unfolding before the, uh, first picture exists. That gap between expectation and reality is where resilience is won or lost. If you enjoyed this episode, please follow and share Riskmasters. You can find show notes and additional resources@ivtop.com and remember, resilience is not defined by the plant's organization right. It is defined by what they notice early enough to act upon. I am Julien A and this has been Riskmasters.

Speaker A: Thank you for joining us on Riskmasters today. If you're ready to master risk and unleash your full potential, here's how you can take the next steps. First, head over to julianhay.com to discover even more valuable insights from our Risk Masters. We've got a treasure trove of knowledge waiting for you. Second, don't miss out on future episodes. Hit that subscribe button on your favorite podcasting platform, M. Stay stay tuned for fascinating discussions on risk management. And third, if you found today's episode valuable, please share it on social media. Help others discover the world of Riskmasters and embark on their journey. Um, of risk mastery. Remember, success favors the bold. See you on the next episode of Riskmasters.