Uploaded by Dave Douglas

After the Flood

A . H . H AY ,
Suite 300 - 990 Fort St
Victoria, BC, Canada,V8V 3K2
Copyright © 2016 by A. H. Hay, CEng PEng FICE FInstRE CRM
First Edition — 2016
All rights reserved.
No part of this publication may be reproduced in any form, or
by any means, electronic or mechanical, including photocopying,
recording, or any information browsing, storage, or retrieval
system, without permission in writing from FriesenPress.
978-1-4602-8029-4 (Hardcover)
978-1-4602-8030-0 (Paperback)
978-1-4602-8031-7 (eBook)
1.Technology & Engineering, Emergency Management
Distributed to the trade by The Ingram Book Company
Chapter 1: Homecoming, April 2
Chapter 2: The Resilient City, April 3
Chapter 3: Purpose and Strategy, April 4
Chapter 4: Complexity, April 5
Chapter 5: Taking Stock, April 6
Chapter 6: The New Job, April 7
Chapter 7: All-Hazards, April 8
Chapter 8: Outside Opinion, April 9
Chapter 9: Demand & Dependency, April 10
Chapter 10: Analysis, April 11
Chapter 11: Preparation, April 12-13
Chapter 12: Calgary, April 14-15
Chapter 13: Synthesis, April 16-18
Chapter 14: Pasen, April 19-21
Chapter 15: The Grand Reveal, April 22-23
Chapter 16: Integration, April 24-30
Chapter 17: Resilience Plan, May 1-2
Discussion Topics
Author’s Afternote
Chapter Notes
I vividly recall watching each of our three children learn to walk. The
process wasn’t always particularly sudden or dramatic – though those first
steps could be momentous! Overall, it was more of a gradual transition
between the crawling stage and the walking stage, where for a time a
child‘s walk could suddenly become a crawl, or at other times, with the
right prop for leverage, a crawl might again become a walk.
Of course, the approach all depended on the terrain, and on the motivation to move quickly, on the perceived consequences of falling, and even
the presence of an audience to cheer the toddler on. But slowly, walking
became more secure and stable, and not only were the falls less frequent,
they tended to be less severe and the downtime between dashes shorter.
Judgement and ability gradually converged and the result was an ease of
motion and a whole new set of goals for each child to reach. Quickly onto
races, and games, and track meets, and dances, and life!
This is a book about learning to pick up and get going after a fall, and then
moving on to what really matters. But it is obviously not about children
and it is not about walking. It is about running complex yet vulnerable
businesses and organizations. These too can experience upset and disruption, whether by flood, fire, power failure, earthquake, or anything else that
life can throw at us.
Like learning to walk, the trick is not just in learning to fall, it is learning
to get up again, and to do so safely, surely, and quickly. The trick to learn
– or more precisely, the design challenge to adopt – is to learn to become
more resilient. This resiliency matters, for there is much at stake. Becoming
v ii
functional again after an outage and reducing downtime can save both lives
and livelihoods. Imagine the difference between a hospital that functions
with an intact water and power supply to one that lacks these essentials.
What if the disruption lasts for days or weeks? What happens to someone
who is hurt or awaiting a life-saving operation?
This book asserts that achieved resiliency – whether of hospitals or businesses – can be more than serendipity, that is, of simply happening to be
well prepared or of living in the right neighbourhoods. Resiliency, like any
other performance measure, can be designed into businesses, institutions,
communities, cities, and even countries. To know that this can be done,
and that it can be embedded in real organizations with real people, you’ll
of course have to read the book itself.
But before doing so, perhaps a few more words might help. For one thing,
you need to understand that this is not the usual way of teaching!
What makes this study particularly interesting and important, and that you
should attend to closely as you read, is that a study of resiliency is at the
interface between people and technology. Of course, the best technologies always are – they never forget the people component. It is to people
that technologies are marketed, and it is people who adopt or reject them,
sometimes dispersing them and sometimes adopting them in key innovations. Resiliency is a shoreline where the ocean of possibilities meets the
land of concrete reality.
Interestingly, despite this reality, sometimes technical people get into the
trap of thinking that equations always trump values, that hard analysis is
somehow superior to softer judgement calls, that stories are somehow
less compelling than computer code. Surely, such beliefs don’t stand up
to scrutiny. I personally don’t think there is anything that I really value in
my life that I could put a number or a dollar value to. Could you evaluate
the quality of your work, your relationships, your family, with just a set
of numbers?
Yet collectively we make choices that have profound implications not only
to ourselves but to others.These choices need to be weighed and evaluated,
v iii
even as they are embedded into the fabric of our lives and of society. So,
how is one to reconcile human choices to quantitative data? How is one to
make sense of uncertainty, and not be either paralyzed or oblivious about
what might happen?
This book hints at many answers to such questions. A successful approach is
one that takes people seriously and is sensitive to place, but knows how to
engage in quantitative analysis as a way to trump, not humans or values, but
certainly wishful thinking. The best approaches take into account issues of
culture and place, not forgetting technology or the consequences of failure.
It knows the terrain and evaluates the risks, and yet can take pleasure in the
small things that makes life worth living – a great meal, time with friends,
or a renewed relationship with a family member or colleague.
Remarkably, the story of getting better at walking – of getting up after
falling – is first of all just that: a story. Like all stories, it has characters
and actions, with a setting of variegated textures, with drama and fear,
sometimes with human insecurities and bad sleeps, and sometimes with
confidence and elation. It has impatience and animosity, and sometimes
the profound satisfaction of a job well done.
Join Marianne as she explores the world of modern technology within the
context of a job with real threats, exciting opportunities, and throbbing
headaches. I think you will enjoy the ride. I certainly did.
Prof Bryan Karney
Associate Dean, Cross-Disciplinary Programs
Faculty of Applied Science and Engineering, University of Toronto
Homecoming, April 2
In which we meet Marianne as she returns to her
family in Toronto to take up new employment and
her curiosity is piqued by The Resilient City.
The seat belt sign came on and Marianne closed her eyes. She had blanked
out the seemingly endless announcements in English and French and was
now thinking about what awaited her. She was coming home, but to a new
job with far greater responsibility than she had before. She opened her eyes
and watched the rain streaks across the window. Life had been comfortable
in Alex. She was the mistress of her portfolio, but was somehow unfulfilled.
When an old colleague invited her to join his firm of architects and planners in Toronto, she had been excited by the idea of going home. When he
said that she would be running a new transit planning team in their urban
design section, she didn’t hesitate to accept. The terms and pay were about
the same as she was getting, but this was a chance to build something new.
She could go home without compromising her career development. As she
looked out the window, the knot in her stomach tightened a little and she
shivered. Everything changes.
The flight had arrived ten minutes early. The booths for the immigration
officials and the never-ending snake of humanity was reduced to half of
the once familiar hall. There were few officials in booths, but a small army
of yellow-jacketed ushers were herding Canadian residents to self-service
kiosks and on to the exit.They were so appropriately dressed – everywhere
at once and annoying. Why am I so irritated? Is it just nerves? She drifted
through immigration to the baggage hall. During her six years in the US,
she had kept up her Air Canada rewards membership and had accrued an
impressive number of points and Elite status. One of the few perks that she
really valued was the priority label that was attached to the baggage tag.
Sure enough, her bags were among the first onto the carrousel. It suddenly
occurred to her that her parents must have felt like this when they landed
in Canada to start a new life. She wasn’t giving up a professional life to start
anew, as they had done, but the sense of trepidation must have been similar.
Harry was totally absorbed in his mobile phone. He had never quite mastered everyday technology, despite being an expert at artificial intelligence
and robotics. Marianne smiled as she spotted her brother. True to form,
he hadn’t registered that she had even landed, let alone whisked through
arrivals in a mere fifteen minutes. He was also spilling his coffee as he
struggled with his phone.
“Hello, Harry,” said Marianne, less than a metre from his face. He almost
jumped out of his skin with surprise, which quickly turned to joy as he
saw his sister.
“Marianne!” He gave her a huge hug, spilling the rest of his coffee across
her bag. The embrace felt good and they lingered for a few moments. They
had missed each other more than either was willing to admit.
Twins, they had shared a room until high school and were each other’s
closest confidantes. They also fought like cat and dog, but no one dared
intervene because the twins would instantly forget their differences and
round on the well-intentioned soul. Through university they had shared a
condo. Harry had moved straight into post-graduate studies and stayed on
to become a researcher. Marianne moved in with a couple of girlfriends as
they launched themselves on the job market.Within a year, she moved back
in with her brother, ostensibly because she ran out of money, but in reality
she just felt more comfortable. They had both followed their father into
civil engineering, though within a year Harry had changed to mechanical
engineering and steadily moved into robotics and bio-mechanics. The last
time they had talked about it, he was working on making artificial limbs
that are controlled by the user’s nerves through a sensor sock.
Marianne had stayed the course and was taken with transportation planning. She did several courses in addition to her undergraduate degree, but
never could quite commit to doing a master’s. She found a job in transportation design, but within two years wanted more and applied for a few
MBA programs. When she was accepted by a US school with a full fees
scholarship, she didn’t hesitate and enrolled. The cost of living in the US
had come as a shock. In truth, it was no different from living in Toronto,
but she hadn’t had to pay market rent in Toronto. By the time she graduated, she was in debt. She took a job in New York, working for the Transit
Authority, which did nothing to improve her finances. The city had an
energy and vibrancy that was at once electric and exhausting. At long last,
she understood Peter Ustinov’s quip that Toronto was New York managed
by the Swiss. As a Toronto girl, it had always bridled her, but she could now
see why. Credit exhausted, she accepted a job with an international infrastructure engineering and planning company with offices in Alexandria,
VA. This suited her. Her father had always said that Alexandria was one of
his favourite US cities and she concurred. Comfortable in her surroundings, she excelled and didn’t look back. Until now.
Marianne didn’t notice the walk through the concourse to the parking
garage or the drive home. Not usually the most expressive of people, Harry
was talking excitedly about his work, his plans, and his latest adventures in
between probing her for news and information. Marianne wasn’t quite
tuned into the conversation and couldn’t shake the mental image of her
parents arriving in Canada for the first time. Both professionally qualified
engineers, they effectively had to start again from scratch. At the time, the
professions in Ontario were more protectionist than they are today and
their past qualifications weren’t recognised. They literally started afresh. That’s
tough, she thought to herself. At least I’m not starting from scratch, but it still
feels like I have to prove myself again. By the time they had inched through
the traffic and around the perpetual roadwork (the 2015 Pan Am Games
was the latest excuse), both were a little hoarse from talking and paused in
front of the familiar townhouse. She pressed the doorbell and heard the
footsteps on the stairs before her mother opened the door. “Marianne!”
Tears filled her mother’s eyes as they hugged. The house smelled of fresh
bread and cooking. It’s good to be home, she thought.
As Harry cleared away the meal, the conversation moved onto the future.
“Do you know what you will be doing in Toronto?” asked
Marianne’s mother.
“I am to set up MTWs[1] transit planning team. Of course, I’m not yet
experienced enough to lead such a thing myself, but there is a principal
who has the right background and experience, so I’ll be working for him.”
“What kind of things will you be doing?” asked Harry, as he returned with
a pie dish and a big grin. “Apple and Blueberry,” he explained, as if she
needed to be told. Familiar smells and sounds were floating her back. Was
it really six years ago that I left?
“The core work will be transit option studies and designing transit corridors for municipalities.”
“There’s a fellow talking about that at a professional meeting tomorrow.
You should come.”
Marianne couldn’t think of anything worse than going to a professional
association meeting her first day back, but she smiled indulgently. “Okay.
Sounds good.”
“It’s the third of three meetings of the Sandford Fleming Forum on the
Resilient City.[2] It’s at the university. The last two have been really good
and they tend to have decent speakers. There’s also no recording or reporting, so the discussion tends to be better and people say what they think.”
During her MBA, there had been some passing comments about resilient
businesses, and in the last couple of years, the Rockefeller Foundation had
begun talking about 100 Resilient Cities. The word ‘resilient’ was clearly
fashionable. Marianne felt that she instinctively knew what it meant, but
couldn’t think what it was. “What’s a resilient city?” she asked.
“That’s what these meetings are about. Resilience is about the ability to
absorb the effects of disasters and bounce back to normal as quickly as possible. It can only be applied, in an engineering and planning sense, to sentient
organisms, like people, communities, organizations, and even operations. But
you can’t have resilient bridges or buildings, because they can’t repair themselves or self-recover functionality. Or at least, not yet. For an organization to
recover, the essential functions that define its survival must continue. It’s
quite involved and I’m not sure that I really understand it, but it’s provided
some really interesting discussion about future city design.”
This was a perspective that she hadn’t come across before and her interest
was up. She wondered how it related to existing and familiar concepts, like
Complete Streets,[3] Abundant Access,[4] or the World Health Organisation’s
Healthy Communities.[5] Jane Jacobs had, from her first reading of Death
and Life,[6] been a close companion in her work and informed much of
her thinking. But then, wasn’t the idea of continued functionality what
Business Continuity Planning[7] and Operational Continuity[8] were all
about? Since she was the urban designer, or at least with respect to transit,
she felt that she should really know more about this stuff, particularly
hearing her brother talk about it when he rarely shows much interest
outside his robotics lab. It would be worth a little investigation tomorrow
morning. For now, nodding and smiling knowingly seemed the best course.
“Is this stuff new to you as well, then?” Harry asked, sensing immediately
what his twin was thinking.
There are times she really objected to having a sibling who could so clearly
read her mind. To make matters worse, her mother was sitting watching
the exchange with a Cheshire Cat smile. I’m really going to have to find out
what this is about, she thought. As if reading her mind again, Harry nodded.
He fumbled with his mobile and soon passed it to her.
“Here are the event details. The registration on Eventbrite is closed, but I
can drop by the CRCI office tomorrow and get you in.”
She scanned the event description. The Centre for Resilience of Critical
Infrastructure at the University of Toronto. Third of three meetings on The
Resilient City. This one is themed Planning Resilient Communities with Jim
Rosenbluth, Nick Martyn, and Antonio Gómez-Palacio speaking. The first
two weren’t familiar to her, but Gómez-Palacio rang a couple of bells. She was
pretty sure that he had spoken at the CityAge conference in Philadelphia[9] in
November last year. She would look up CityAge as well tomorrow.
Inevitably, her mother moved the conversation on to the weather, as they
demolished the apple and blueberry pie. Marianne wondered casually what
had taken her so long. “We had terrible flooding last year and even the GO
Train was under water.[10] And there was the ice storm this Christmas[11]
and we lost power for two weeks. My neighbour kindly helped with his
generator and that kept the deep freeze okay. Thankfully, we’re on gas.At
least the weather is back to normal now.” There is a certain irony to having to
keep a deep freeze powered in a winter power cut, thought Marianne.
In fact, 2013 had been quite the year for extreme weather, with Calgary[12]
flooding and High River[13] living up to its name.There had recently been a
tornado in Vaughan,[14] to the north of Toronto. Marianne didn’t recall this
sort of weather from her childhood, though the North East Blackout[15]
occurred the summer after her second year exams and simply provided an
excuse for lakeside parties with forbidden beach bonfires. Having inherited her father’s disbelief in coincidence, she was sure that the weather
cycles were changing. There were more extreme weather events, but her
mother clearly felt that 2013 was merely a blip. The UN was providing
plenty of compelling information on climate change[16] and she had found
the evidence and arguments morbidly addictive. Still, it was somehow a
topic that she didn’t feel that she could talk about at the office or anywhere else in the US. Climate change was yet another issue in the eternal
bipartisan debate in US politics. It was something that she really couldn’t
understand about the US. Hurricane Sandy[17] hit New Jersey and New
York in October 2012, demonstrating an awesome power of nature over
humanity, and yet just months later the loudest voices were advocating for
even higher protection. No one seemed to be considering what happens
when the next hurricane or super storm hits New York with a higher
storm surge that again knocks out the power and subway. How will they
feed the city after the next flood?
Her first big job when she started working in Alex was to analyze the
effects of Sandy on the New York transit networks. So much hinged on
the storm surge protection, based upon Hurricane Donna,[18] which had
resulted in the highest surge on record at ten feet. The electricity substation storm surge protection was 12.5 feet, and yet Sandy came in at 13.8
feet.[19] Doesn’t nature realize that she’s messing with the most powerful nation on
Earth? The arguments remain centred on how to prevent nature’s effects
rather than how to manage them. Curiously, the fundamental concept of
civil engineering[20] was all about harnessing the forces of nature in the
service of humankind, not preventing them. Unfortunately, so many of
the climate change speakers were just a little too zealous and many of
the conferences had more than an air of preaching to the converted, with
the majority of attendees habitual followers of climate change conferences
seeking reaffirmation of their beliefs. What was needed was an objective
evaluation of the climate data as it applied locally. Instead of 100 km by
100 km tiles, something closer to a 5 km by 5 km resolution would be
useful. Let’s show people what these changes in the frequency and severity of weather events actually mean. Still, it probably wouldn’t stop some
of the more outrageous claims by otherwise rational people, blaming the
Calgary floods on the previous council, for example. There was a lot to
digest, physically and intellectually.
They were drinking tea in the sitting room, chatting about plans for the
summer and Christmas, interspersed with reminiscences about Christmases
past. For four years when she was still in elementary school, her father
had commuted weekly to Kingston, living in a cottage to the east of the
city during the working week. At long weekends and holidays, her mother
would gather up the family and they would stay in the cottage. She still
remembered those Christmases as some of the most fun and magical. They
would go for Winnie the Pooh type expotitions[21] into the wood behind
the garden and chop down a Christmas tree. She still kept the photo of
her and Harry in their first snow hole. The small community where the
cottage was located held a barbeque and bonfire on the frozen St Lawrence
for FebFest,[22] and they would play hockey and skate between the islands
in the bay. She didn’t recall the St Lawrence freezing like that for a while
now and she doubted that the residents of Alex would have as much fun if
the Potomac froze. Perhaps climate change meant less winter fun.
“I’ve made up your bed and Harry can carry your bags up,” Marianne’s
mother said. Harry rolled his eyes and Marianne smiled a thank you. “I
thought that you might be staying with your brother, but I’m so glad that I
will have you for a while.”
Marianne had originally intended to stay with Harry, but it would have
been awkward with his girlfriend living with him now. He would have
probably agreed without hesitation, but Marianne didn’t feel comfortable
asking him. She’d find something soon enough. She valued her independence and space. She had shared with two other girls in New York in a
claustrophobic apartment, which was probably part of the reason that she
had been happy to move to Alex, where she had a nice bachelor apartment
in the old town. When her boyfriend suggested that she move in with
him, he had unwittingly struck the death knell for their relationship. She
would have to find something. She belonged to a new demographic that
was changing the dynamic of cities. Increased single occupancy in ever
more densely constructed city centres, disconnected from their neighbours
except through social media. Many of her friends were marrying and
having children in those condos, unable to afford the move to the suburbs.
While local restaurants and businesses were adjusting to accommodate
this explosion of small children in the area, few cities had even recognised
it and there was an evident lack of schooling and recreational facilities for
pre-school children, let alone school-age children. Toronto was no better
in this regard and in many ways among the worst. The simple answer was
not to have children anytime soon and besides, it seemed unlikely that this
new job would give much opportunity to meet a likely life partner.
DISCUSSION POINT: What can be resilient? Can people be
resilient; can communities, organisations, and associations be
resilient? Can a bridge be resilient? What do we perceive resilience to be in our day-to-day use of the term? What do we
base this perception on?
The Resilient City, April 3
In which Marianne critically reacquaints herself with
Toronto, reflects upon the nature of the city, investigates the
multidimensional nature of infrastructure, and looks into the
concepts of resilience, what makes a community or city resilient,
and how resilience can be incorporated into urban design.
Marianne opened her eyes and stared at the familiar ceiling. The house
was quiet, though there was a gentle hum of traffic in the background.
Strange how she should notice this now. It was one of the things she liked
most about her apartment in Alex. When it was quiet, it was totally quiet.
The bedside clock said 5:30 a.m. That clock’s new, thought Marianne as she
swung out of bed. Twenty minutes later. she was letting herself out the
front door for a run. What else has changed in the neighbourhood? she thought
as she breathed in the chill morning air. Many of the old businesses were
still there, but the main shopping street had been redesigned and the bike
path had been removed.[1] At the far end by the park, some of the seedier
shops had been replaced by something more genteel, and all in all, things
looked to have improved. The disappearing bike lanes worried her, though.
Toronto, like any city, needs transport options, and if anything it needed
more bike lanes to make cycling safer, not make more space for cars to sit
in traffic jams. This is the most tolerant city in the world, where anybody
can be anything and everyone is accepted as themselves, yet she often
thought that that same tolerance came with a near total disengagement
with politics and common interest; a disinterest, even. The waterfront was
still a shambles, paling beside Chicago’s. Transit was a perpetual topic for
toxic debate in the city, but it always centred on the type of transit and
not what was needed where. It was like arguing what tool to use before
identifying the job that needed doing. Her sensitivities around her home
city were heightened by her chosen specialisation and she felt, not for the
first time, that Toronto could be so much more. By the time she emerged
from the shower, she could hear her mother in the kitchen. She was ready
for breakfast and the fresh coffee smell only increased her appetite.
Marianne headed to the Toronto Reference Library. The outside didn’t
look like $34M[2] had been spent on revitalisation, but the inside was
wonderful. It was as busy as usual, but somehow it had become an even
better space in which to work. She had always been a huge fan of the
excellent Toronto Public Library system and the TRL in particular. You
could explore the planet from these shelves; investigate anything. The only
limitation was your imagination. Somehow, the greater use of computers
and internet research hadn’t changed that. Of course, the finest improvement was the coffee shop by the entrance. She wanted to congratulate the
person who gave the space to Balzac’s instead of the ubiquitous Tim’s or
Starbucks. Besides, the coffee was better. She settled herself at a desk and
connected to the free wifi.
Where to start? Harry had mentioned this CRCI at the university, so she
started with their website.[3] There was some good stuff there and some
essays, papers, and references.The previous Sandford Fleming Forum meetings did look interesting and she decided to join her brother that evening.
In synthesising the ideas, more questions presented themselves than she
was answering. She decided to reconstruct the evidence.
Infrastructure is multi-dimensional. Including the physical dimensions, plus
human, cyber, and temporal ones. The physical dimensions are obvious, but
the others relate more to infrastructure as a system. Infrastructure changes
with time in how it is used, its condition, and its value. This is very much
the temporal dimension, but also reflects the fact that infrastructure exists
within a context and that by its very presence influences and changes that
context. A road may be built between two cities. Over time, communities
and industry will develop along the road and the use and value of that road
changes. Eventually, the need for higher capacity between the two cities
means that a new multi-lane highway is built, but this does not mean that
the original road can be removed. Its original purpose has changed and is
no less important. When we look at this infrastructure as a system, it also
explains the cyber dimension. Most control and monitoring systems are
connected to the web, whether through a Supervisory Control and Data
Acquisition (SCADA) system or a maintenance system.The ones that aren’t
either use a private communication network or use an air-gap for security
reasons. Increasingly, the interface of Building Information Management
(BIM) systems and Geographic Information Systems (GIS) with control,
security, and maintenance systems mean that internet connectivity is as
normal an aspect of any new infrastructure as timber, concrete, and steel.
When we now consider how the infrastructure is used, operated, and
maintained, and its relationship with the local community and environment, the human dimension becomes more apparent.
Accepting this multi-dimensional nature of infrastructure means that its relationship with its context can now be defined, and therefore the consequence
of a change in one on the other. This idea of consequence is also intriguing.
The consequence of any event, whether a stress or catastrophic shock, is
political, mission, and financial. Political consequence can be the value of a
company’s brand, its relationship with the local community and authorities,
and its relationships with other companies, operations, and the market place.
Mission is the purpose for the organisation, operation, or infrastructure. The
idea of mission is interesting because it speaks to why we are building this
infrastructure in the first place.What is it that we wish to achieve by building
it? What do we want to be capable of that this infrastructure enables? That
speaks to the heart of strategic planning and long term visioning. The financial consequence is obvious to grasp, but all the literature indicates that it is
the direct cost of loss or compromise only.The operational costs are captured
separately. This means that the true cost of loss can be measured against the
enabling component of the operation and so accurately related to risk treatments and represented in business cases and financial statements.
Marianne pushed back her chair and stifled a yawn. She decided to take a
stroll around the labyrinth of book stacks. She felt restless for some reason
and was finding it hard to concentrate. Walking to the central atrium, she
leaned on the balustrade and looked down towards the coffee shop. The
lure was too great. Balzac’s was selling their Margaret Atwood blend coffee.
A strangely appropriately named coffee for selling in the TRL, she thought. She
bought a mug of it and settled down at the long table in the middle of the
coffee shop. The coffee was very good. Looking about her again, Marianne
noticed how many faces seemed familiar to her, but there was no way that
she could know any of them. She stared out onto the street with her coffee
cupped in both hands and steam wafting over her face. A couple with a
stroller were waiting at the pedestrian crossing. Though the lights were
turning, the traffic didn’t appear to be about to stop any time soon. Once
the traffic light turned red, the traffic stopped. Marianne watched horrified
as a cyclist collided with the suddenly stopped SUV. That had to hurt, she
thought. The cyclist picked himself up, adjusted his helmet and, lifting his
bicycle, spun the front wheel to check that it wasn’t buckled. A red-faced
rotund driver had emerged from the SUV and was remonstrating with the
cyclist, who completely ignored him. The traffic light had turned back to
green. The car horns signalled the impatience of the cars behind this little
drama. The cyclist got back on his bicycle, wove around the SUV, and
carried on his way, leaving the driver standing in the road hurling insults at
him. Wow, thought Marianne. How does a person crash their bicycle, get back on
it, and cycle on as if nothing happened? They would have to be bruised at the very
least and really quite resilient. There’s that word again, and yet I’m instinctively
applying it to something completely unrelated to infrastructure. Perhaps resilience is
a characteristic or property of something? There were few things that Marianne
enjoyed more than puzzles, but this time she didn’t yet understand the
question. She finished her coffee and returned to her study area.
When we look at the purpose of infrastructure, we need to look at the
planning process. There is a clear disjoint between strategic planning in
business and infrastructure. The strategic planning portion of her MBA
had spoken about the generic five steps of strategic planning.[4] Determine
where you are; Identify what’s important; Define what you want to
achieve; Determine who’s accountable; and Review. It had then focused
on the commitment basis for strategic decision making.[5] Looking at these
from an infrastructure perspective, it doesn’t really address the core issues.
When a municipality’s strategic plan is five years long and it can take more
than that just to construct a single transit line, let alone represent the life,
value, and purpose of that line, there must be an infrastructure-specific
approach to strategic planning. Of course, the longer the strategic planning
period, the greater the risk context, or more specifically, the greater the
unknowns. This she would come back to.
Finding a definition of Resilience was also something of a challenge.
Finally, she came down to two definitions, one for communities and
one for operations. Thankfully, they had a shared ethos of recovery. The
definition for Community Resilience Planning, articulated by Antonio
Gómez-Palacio on last year’s CityAgeTV[6] conference video clip is:
“... the ability to creatively and collaboratively adapt, respond to, and
recover from change.”
She liked that one. It suggested the community was part of the ‘managing change’ process and implied a recognition that things will change.
The second was from the University of Toronto Centre for Resilience of
Critical Infrastructure (CRCI).[7] Typically a much drier definition, but
suggesting a more generic application. The CRCI defines operational
resilience as:
“... that essential ability of an operation to respond to and absorb the effects
of shocks and stresses and to recover as rapidly as possible normal capacity
and efficiency.”
When you think about it, the functioning of a community can be defined
as an operation, as much as an industrial process or military action. The
idea of infrastructure having a purpose and being able to recover from
catastrophic events was a topic that she would have to return to. But for
now, it was time to get a head start on her new job and read into the two
projects that she’d been told about. One was about the development of
new GO Transit[8] planning standards and the other was a proposed light
rail transit extension line. In fact, another quick coffee would be of more
use right now.
Marianne sat in the student coffee bar under the Daniels School of
Architecture.[9] This was without question the best cup of coffee in the
city. She was always pleasantly surprised at Harry’s choice of meeting place.
For someone so detached from most aspects of social interaction outside of
his lab, he had an uncanny knack of suggesting a place to meet that would
immediately put the other person at ease. She wondered if it was down to
his girlfriend, Sandra, but he’d been like that before he met her. Perhaps
that was how he managed to charm her. Despite this sixth sense of his, he
was always late. Harry’s world moved at Harry time and every now and
again, it coincided with the same space-time continuum that the rest of
humanity occupied. He was unbelievably quirky. She was on her second
cappuccino when he finally appeared.
“You’re here already!” he exclaimed.
“I’ve been here for half an hour, Harry.” She wanted her voice to show
a slight irritation, but it didn’t come out that way. They were still in time
for the Resilient Cities meeting and had arranged to meet early so that
they could chat a bit beforehand. The extra time had been used up. Harry
ordered an espresso.
“So how does it feel to be back?” he asked.
“Oh, you know,” she said. She didn’t really know how she felt.
“Well, what about the job you’ll be doing? I know that you’ll have been
researching it to the nth degree by now. Is that what you were doing all day
at the TRL?”
How well he knew her. “Yes,” she replied.
“Well, there are two projects. One is the development of new standards
for GO Transit operations and the other is an LRT extension in the north
of the GTA.” She went on to describe all that she had researched that day
around the two projects. She always felt that understanding the context in
which a project existed provided a far better working perspective and in
truth had served her well over her short career. Most of her peers rarely
bothered to read in or around a project, preferring to simply launch
straight into the plans and detail. She had started to research the context
of a project so that she would be seen to be taking it seriously and to
bring value to the team. Now, more confident in her own abilities, it was
something that she saw as a valuable effort. The thing that had occurred to
her about both projects was that there was little apparent consideration of
these changing trends in extreme weather or any real statement of what
the projects were trying to achieve. Those resilience articles that she’d read
at the TRL and online had got her thinking. It made her feel uncomfortable, but she was sure that everything would make sense when she started
work and was properly introduced to the projects.
They walked to the Faculty Club,[10] where the Resilient Cities meeting[11]
was to be held. It is just off Spadina on Wilcocks. It is a beautiful ivy-clad
stone building. She lingered a while to read the plaque and look about her.
All the other buildings were from a different era and yet this one stood
alone and proud as a distinct reminder of days past. Formerly the Primrose
Club, a private club for Jewish gentlemen, it was now as firmly a part of
the University of Toronto establishment as any of the old buildings around
St George Campus. She wondered that in all her time at the university
and since, she hadn’t seen or noticed this building before. Inside was an
air of calm with the gentle hum of multiple conversations. They joined
the group and were soon enjoying an exceedingly good gin and tonic
and chatting with a policy advisor and an RCMP officer. It was clearly an
eclectic mix of people with even, she couldn’t be quite sure, a couple of
politicians. She wondered why they would turn up to a meeting with no
cameras, but even they are probably interested in learning something from
time to time.
A bell rang and they were all invited from the cozy warmth of the sitting
room into what was clearly the dining room but now arranged for the
presentations. The three speakers were sitting as a panel and the MC
stood at a lectern and announced his parish notices before beginning the
evening. She was surprised at the first speaker. Clearly a leader in his field,
Jim Rosenbluth[12] was providing a contextual picture of the threats and
hazards and how they are perceived in North America compared to the rest
of the world. This presentation had her mind racing about the ideas that
social structures and culture could influence a community’s perception of
threat and risk,[13] but before she could arrange her thoughts, the second
speaker was up. Nick Martyn[14] was the CEO of RiskLogik and was talking
about how we can map the relationships between the various functions of
an operation or community and the infrastructure and services upon which
they rely. These dependencies could be mapped to the nth degree and presented through a geographical interface for the user. He then illustrated a
software application[15] with a hypothetical scenario in downtown Toronto
that just made her blood run cold. He referred often to work that had been
done by the University of Toronto and the City of Toronto Infrastructure
Resilience Study.[16] Curious. Finally, Antonio Gómez-Palacio[17] was up.
There was no doubt that he was the same person she had seen only six
months before in Philadelphia. His presentation included a lot of new material and it was clear that this was a fast developing field of work. He spoke
about the DIALOG framework for planning resilient communities[18] and
how one could stimulate a community to become so.
The open forum discussion that followed was equally thought provoking
and by the end of it, she had scribbled a few reminders on an old receipt
in her purse: city study, dialog framework, risklogik, risk perception, and
failure characteristics.With the purpose of infrastructure and strategic planning questions from this morning, she felt that she was about to explore
a new area of study that had completely passed her by, despite working in
infrastructure planning. There must be a disjoint somewhere, a misalignment of terminology. If this was being discussed openly in the same city in
which she was about to start a new job in infrastructure planning, she was
going to make damned sure to at least learn enough to appear aware and
current, if not necessarily fully knowledgeable.
DISCUSSION POINT: How is infrastructure affected over time
by changing purpose and context? How does our perception of
risk and purpose influence that?
Purpose and Strategy, April 4
In which Marianne investigates the concepts of resilience and the
origins of the term, the enabling purpose of infrastructure, the
characteristics of communities that have proved to be resilient in a
catastrophe, how dependency clusters can impede the recovery of a
community post disaster, and how these can influence infrastructure
development strategy in support of a sustainable economic development.
The following morning, Marianne decided to forego her run in order to start
looking for somewhere to live. She’d probably regret that decision, but life
was too short to worry about everything all the time. She could always live
with her mother, but she’d rather not. She liked the idea of living downtown
in one of the new condos, but some of the horror stories about build quality
really put her off buying. Perhaps a conversion or one of those apartments in
the Annex. The parts she could afford were just a bit too frat house for her
liking. A couple of reasonable options did pop up towards Ossington, but
sadly out of her price range. She hadn’t yet paid off her MBA expenses, let
alone the cost of living in New York, so the idea of increasing her debt, even
in the short term, was a real concern. She also tried a few of her unmarried
friends, only to discover that they either had live-in lovers or were sharing
already. She didn’t want to think of the morning as having been wasted, but
she had nothing to show for it and felt frustrated with the added sense that
a headache might be on its way. Time for something else. She dropped into
one of her favourite eateries, the Corned Beef House,[1] to take stock.
She wanted to be within walking distance of work, a short cycle ride in
summer perhaps, and street car access for the winter. That would really
mean University Avenue was her eastern boundary, Little Portugal her
western boundary, College on the north, and Lakeshore to the south.There
would be a lot of university connections reaching as far south as Queen
and west to Bathurst. Harry is well connected around the university and
he could help her find something. That was enough house hunting for
one day. She remembered her parents saying that when they moved to
Toronto from Holland, they’d been in something of a rush and had found
and bought their house in one day. It suddenly seemed that life was so
unfair. She ordered a corned beef sandwich and a soda water and began to
make plans for the next few days. She phoned Harry and explained what
she needed from him.
After lunch, she returned to the TRL and settled in to investigate this resilience thing a little more. The initial things that came up were, to say the
least, a little confusing. There was a paper by Holling,[2] which described
resilience in ecosystems. Set against what she had read so far, it seemed
as if this paper was the origin of this way of thinking. This was further
reinforced by an excellent book called Resilience Thinking by Walker and
Salt.[3] She particularly liked the Australian cattle ranch study and how tree
planting had saved the ranch from catastrophic loss during the droughts.
She’d buy that one. Conversely, there were many suggestions and even
some statements to the effect that resilience planning was not new, and
had been a part of strategic planning for millennia. There were clearly no
shortcuts in this project.
Marianne also found some fascinating papers as references to other works
and promising source documents. The first was a perspective paper in Risk
Analysis called ‘Integrating Risk and Resilience Approaches to Catastrophic
Management in Engineering Systems’ by Park[4] and colleagues. This paper
espouses the idea of resilience as an emergent property of what an engineering system does, rather than a property that the system has. A subtle
and interesting distinction, which she would definitely have to revisit.
There were papers by Petit[5] around the concepts and after she’d scanned
five resilience papers, it was definitely clear that the essentials of what they
all spoke about were consistent. She felt that she was getting a sound basic
understanding of the concept, but losing track of the application. There
were also several resilience themed editions of journals, though the IET
had produced a transportation-specific one,[6] which she ordered. One
of the articles[7] spoke of a preliminary study of thirty or more cities and
identified characteristics common to all of them that survived catastrophic
events and which were absent in some way in those that failed. This tied in
neatly with what Antonio Gómez-Palacio had spoken about the previous
night. The characteristics are:
Identity. Each community had its own identity of who and what it is. They
took ownership of their situation and there was a clear passage of information, both vertically and horizontally through the community.
Focus. Each community had a clear focal point, a part of the public realm
in which all members at some point in their routine activity interacted at
a personal level. This could be in the street, in shops, or in facilities. The
point is that they didn’t cocoon themselves in their cars. Marianne thought
about the cyclist crashing into the back of the SUV yesterday and how the
cars would only stop once the traffic light was red. Rear-ending crashes must
be quite common, she thought, particular as so many are talking on mobile phones
or drinking from coffee cups while driving. How many car drivers are even vaguely
aware of their surroundings or fellow commuters?
These first two characteristics connected closely with both Jane Jacobs’[8]
commentary and the idea of healthy communities.[9] This made sense and
demonstrated a correlation in thinking. Did these lines of thinking develop
independently or did this later work develop from Jane Jacobs? She suspected
the latter, judging by some of the terminology and not quite synchronous arguments.
Balanced Infrastructure. The infrastructure that enables the community is
proportionate to the community’s needs. If a multi-lane highway is built
beside a village or through it, the village will die. Similarly, if the utilities
are inadequate to sustain commerce and industry in a town, these enterprises will go elsewhere.
This introduced the idea to Marianne that resilience was not just about
catastrophic events, but slow creeping changes, such as the aggregate of
influences that brought Detroit[10] to its knees. She soon discovered that
there is a distinction in resilience planning between the two. Shocks
happen suddenly and might be an extreme weather event, earthquake,
or catastrophic industrial accident. Whereas stresses are the slow creeping
changes that together change both the context and the vulnerabilities of
the community. Curiously, terrorism was not necessarily one or the other.
September 11, 2001,[11] was a shock to New York and had a profound
effect[12] on people’s lives and the conduct of business. More to the point,
the effects were felt by the city as a whole for years to come. Conversely,
the G20[13] disturbances in Toronto were fleeting and the effects concentrated to a specific area. Terrorist activity in London, UK, was so routine
that the normal pattern of life was barely affected by the July 7 tube bombings.[14] There was clearly a background level of stress that could be actively
managed and only events above this level would impede city function. The
idea and delineation of threats and hazards was not going to be straightforward either, but she figured that applying a risk management approach
might be a useful way to unravel this aspect.
Strategic Framework. The strategic framework is the big picture arrangement
that sets the community’s relationship with its neighbours and the higher
authority. This relates to everything from economic and social inter-relationships, to politics, defence, and emergency response. It needed a clear
vision of how the community would evolve in this context and so enable a
balanced approach. She would definitely have to get to the bottom of this
strategic planning malarkey.
Confidence in Leadership. It appeared that confidence in leadership meant
far more than the actual presence of leadership.[15] Instinctively this made
sense and chimed closely with the earlier ideas about public perception.
Communities that were confident in their leadership tended to make do
with what they had before reaching into the shared resources pot. Perhaps
this is a reflection that the same leadership actions that promote confidence
are the ones that do provide for emergencies and invest in understanding
vulnerabilities and what to do. Communities without this confidence in
leadership have less understanding of their situation and tend to reach into
the central pot before using their own resources.
These five characteristics are consistent with everything else that she had
been reading, as well as many of the core references that she had worked
from through her education and career. So building from these, accepting
that they are from a preliminary study, it means that the stimulation of
community resilience would need to target these characteristics. Therefore,
revisiting each one again, how does one stimulate them?
Community identity appears on the face of it quite ethereal. However,
she knew from her own work on transit that there is a natural tendency
for communities to self-identify.[16] Reinforcing this characteristic by using
self-identifying communities to define ward boundaries would play to
the strengths of these communities and reinforce existing unofficial communication networks and representation. A parish council or residents
association will produce a leader of some sort. Empowering that leader
with a clear understanding of the risks to the community for a range of
hazards and what can be done about it, invests authority in that person
and motivates interest and activity in preparatory work. In fact, there have
been many examples of existing self-identified communities that have
galvanised to resolve issues that external intervention proved incapable of
doing. Nobel Laureate Elinor Olstrom’s Governing the Commons[17] speaks
about these self-identifying communities adequately empowered with the
necessary understanding, capably resolving such intractable problems as
declining fish stocks and deforestation. The interesting aspect to this is that
it is entirely scalable. Some of the references that Marianne came across
were briefing articles and papers that referenced equilibrium[18] between
the community and its infrastructure, enabled by the higher authority providing an understanding of the hazards and interdependencies.
Community focus is rather more straightforward and can be stimulated
by our design of the public realm.[19] If we wish to promote increased
social interaction among the community, we make sure that shops and
services and recreational facilities are in close proximity, and ideally not
too far between residential and commercial. It wouldn’t make any sense
to have a communal area in which you would only go if you had money
to spend. By having a community police office, library, post office, and
some transit intersection, we can make an area of cafes, shops, bars, and
restaurants a more continuously used zone with more interaction between
different social and economic groups. In effect, if we design mixed use
areas and complete streets, we can achieve this. It’s curious how zoning
and imbalanced land and property taxes have promoted the very opposite.
What was particularly interesting about community focus, though, was
its relationship to demand and consumption of emergency resources in
a catastrophe.
Marianne paused and contemplated another coffee. It occurred to her, not
for the first time, that she might be addicted to the stuff. Being Dutch, her
mother considered a constant intake of coffee a perfectly normal habit,
whereas her twin believed that she simply used it as a way of avoiding
working longer than an hour at a time. The truth was likely somewhere in
the middle, but didn’t remove the desire for a coffee. Perhaps I’ll see another
crash, she thought. She sat down with her coffee at the same seat as the day
before. This time, there was light traffic and less theatre to admire. She idly
picked up a magazine that was on the table and flicked through the pages.
An article about the loss of manufacturing in Windsor caught her eye. It
spoke of the untapped potential of the area and the seeming reluctance to
invest in its recovery. How do you invest in recovery? she thought. If we invest
in something, it must be for a benefit. We must be paying for something
and that something must represent a capability or other benefit. Therefore,
it is investing in a capability that enables economic recovery. Interesting.
She drained her coffee and strolled back to her study area.
Each community represents a demand cluster.[21] That resource demand
can be for a given utility, product, or transit. Irrespective, as a building
block of demand patterns across the city, each community will demand a
certain amount of a resource. It is quite common to see heat maps illustrating all sorts of statistical data to compare one community with another
and determine priority of resource allocation. If that demand cluster represented a sole dependency for the particular resource, you could think
of the community as having a single dependency. However, when there
are several such dependencies, there will be areas of correlation and so a
higher exposure to risk. More specifically, if the entity that this community
depends upon is incapacitated for any reason, the effect upon the community can be acute. Such a correlation of dependencies designates the community as a dependency cluster or possibly as a critical dependency cluster.
In a catastrophe, such critical dependency clusters can destabilise the city’s
ability to respond and self-recover because a disproportionate amount of
the city’s resources will be needed to simply maintain essential functionality rather than being used for the collective response and recovery.
Such dependency clusters are not reflections of economic status. A particularly wealthy ward will have high land prices and ground rent, meaning
that few if any grocers, drug stores, post offices, and even ATMs can afford
to operate there. Travel habits would likely mean that families shop weekly
and are used to car travel for all purposes. Consequently, a municipality might not see the need for transit services through this community.
When the municipality is flooded and this wealthy ward is suddenly cut
off without access to food, fuel, or cash, often the political influence that
wealth brings will make the ward a priority for response resources. This
does happen and has directly affected the response and recovery of cities
in a catastrophe. The same is most often applied to community housing
where the estate has been situated between established communities. This
interstitial — that is, the space between established communities — positioning of community housing all too often means that they are in food
deserts with more than fifteen minute walk to fresh food, much less community services. Fast food outlets do not count. In an event that hits the
fuel and power supply, the sudden loss of transit will quickly make these
communities critical dependency clusters and priority draws on municipal
response resources.
Marianne noticed various references to mobile grocery stores, which
would be in the same place each day for set hours and provide post office
and prescription services in addition to a reliable supply of fresh produce.
Quite common in many rural areas in Europe, they can create a community focus and the conditions to make dependency clusters less critical
and eventually more stable. It also argues strongly for equity of access to
public services rather than social equity for essential functions. Finally, she
found reference to an exam question that clearly stimulated anxious debate
beyond the examination hall.
“How does an elderly infirm spinster living alone on the twenty-fourth floor of a
community housing block feed and warm herself during a prolonged winter power
outage?”[22] The blogger’s conclusion was simply that she doesn’t. Not
wishing to trouble anyone, she will likely die.
Marianne paused in her investigation, realising that at once this blog had
made her uncomfortable and left her wondering about how an incident
unfolds. After all, there were many references to response and recovery,
each intimating that something else had happened. There was also a performance relationship between them. She added response & recovery to her
to do list. After another coffee to refresh the senses, she would dig into this
idea of purpose.
Her reading continued to plague her as she sat staring through the
window of Balzac’s onto Yonge Street. All this talk of dependencies defining vulnerabilities and causal relationships placed an enormous emphasis
on understanding how one function depends on another. Nick Martyn
had spoken about this the previous night and it was also the basis of that
six-month study by the City of Toronto with the CRCI. She would look
at that once she had nailed purpose. The very word was beginning to irritate her. How can something so fundamental be so abstract? Her mobile
rang. Not recognising the number, she paused and contemplated. She must
get a local mobile plan; the roaming charges for a US phone in Canada are
astronomic. Probably worse the other way – so often the case – that she
might do well to keep the US number as a PAYG[23] when she gets the
Canadian plan. Answer the damned phone, she almost said aloud. It was her
brother. A colleague of his knew of a professor who was being attached to
UNESCO[24] in Paris for a year and was looking for someone to occupy
his apartment on McCaul Street. It was one of the bachelor street-access
apartments opposite the Brink’s building, now part of OCAD.[25] It
sounded ideal and she thanked her brother after writing down the contact
details. It hadn’t been a wasted day after all. She phoned immediately and
arranged to visit the professor’s office at 6 p.m. That gave her three hours.
Enough time to make a start on purpose and leave it at that.
The reason for building infrastructure is to enable something. Infrastructure
is not an end in itself, but rather the means to an end. Infrastructure
enables communications and travel, and high density living through sanitation, water, and energy transmission and distribution. It allows us to trade
and enables the institutional functions upon which our society depends.
One could almost say that infrastructure is the foundation of civilisation.
Therefore, there must be a purpose to it. At certain periods of history, infrastructure was used as a method of getting people back into work,[26] but
unless there had been a strategic or long term purpose, the benefits were
only transitory. Since the use of infrastructure and its relationship with the
community and environment was inevitably changed by its presence and
over its life, that core purpose needed to be something fundamental and
over the horizon. In effect, the reason for building infrastructure needed
to be to enable some capability or other at some point in the future. How
do you determine that purpose, particularly when so much will change
with increasing uncertainties over its life? Purpose is intimately bound
to strategic planning. Strategic business planning, at least the way she had
been taught, certainly didn’t cut it for this little teaser. Besides, how did
municipalities seemingly obsessed with five-year strategic plans and budget
allocations ever manage to build any capital projects? It appeared that few
have since the eighties and less has been spent on infrastructure, resulting
in a $123bn[28] maintenance deficit.
If we take a traditional approach to strategic planning, we would identify
an organisational vision of what we wish to be capable of in twenty-five
or forty years’ time. Standard Oil might have said that it wished to dominate the South American oil production.[29] Toronto might have said that
it wished to benefit from the labour resource residing in neighbouring
Etobicoke. One of Toronto’s objectives would then have been to provide
rapid efficient transit to bring those workers from their homes into the
downtown core, and from that identify a requirement for a subway line
to the far edge of Etobicoke. As they recognised that the presence of such
a transit link would attract as much business as currently existed, it would
make sense to construct it through to the far side of Etobicoke, through
wheat fields, because that is where the housing will expand to. That vision
of greater economic activity drove the objective of building a subway
out to Kipling. That purpose was over the horizon and now almost a half
century later, it is one of the busiest transit lines in Canada. Even then, the
vision for a subway for Toronto dates back to 1912.[30]
So for the strategic planning of infrastructure, we need to know the
purpose of the organisation, the role of the operation that the infrastructure will support, and hence the purpose and objective of the infrastructure itself. Wrapped in such a context, the influence and relationships with
the operating context can be recognised and the planning parameters for
the infrastructure itself defined. Even as the unknowns increase and with
them, the contextual risks to the operation and the infrastructure over
its life, so the planning constraints become narrower and more focussed
on the objective. These constraints are the resilience parameters and are
defined by consequence and dependencies. As the risks change over time,
so too must the operational dependencies to avoid correlation of risks as
well as correlation of dependencies. This means that all the usual key performance indicators are supplemented by key risk indicators that identify
how changes in the risk context can affect the operation, and therefore
provide notice that a response or intervention will be required. This ties
in closely with the risk management requirement for leading rather than
lagging key risk indicators.[31] The strategic planning of infrastructure processes is therefore similar to the business model, but capability based. The
US Department of Defense have a useful definition of this process:[32] What
do we want to enable; a general requirement statement of time, distance,
effect and obstacles; and the capability must reflect the lifecycle. Simple
and effective. If we apply these principles to the strategic business planning
process, we get:
Define your vision
Identify the through-life risk context
Stage objectives and responsibility
Key Performance Indicators
Key Risk Indicators
Resource allocation
Not bad, said Marianne to herself and closed her notebook. Time enough
tomorrow. Now, however, she had an appointment with what could be her
future landlord.
DISCUSSION POINT: What infrastructure systems do we rely
upon in our daily routine and how does this compare with the
actual purpose of that same infrastructure? Where there is a
difference, is it due to the contextual changes influenced by the
existence of the infrastructure, or is it a deliberate repurposing of
other infrastructure?
Complexity, April 5
In which Marianne discovers the nature of essential functions
in a simple system and how multi-dimensional dependencies
between systems can result in complex systems of systems
where the issues are both persistent and flexible.
Marianne peered blearily at the clock. It was 10:23. Had she really slept in
so late? When she got home yesterday from chatting with the peripatetic
professor and quickly looked over the apartment, it was 8 p.m. and her
mother had a meal waiting for her. They had started chatting and before
she knew it, it was past 2 a.m. and they were still going strong. She hadn’t
chatted like that with a girlfriend in years, let alone her mother. Still, it
had been good and she felt somehow much better for it. Despite her close
confidence with Harry, there were some things that you could only discuss
with a female intimate. Last night, she unburdened about six years. It was
Saturday morning and if she were in any way sensible, she’d spring out of
bed and go for a long gentle run. The lure of the duvet won and she closed
her eyes.
By mid-afternoon, she had been for her run, joined her mother for a late
lunch, and was now sitting in the Air Canada cargo offices waiting for her
boxes. Her mother had driven her over. Marianne was almost surprised to
see that her mother was still driving the same Honda Odyssey that they
had when she was in high school. Her parents had always maintained the
view that there was no need to replace something unless it was broken.
Still, a fifteen-year-old van was perhaps stretching that principle. Then
again, maybe not. She got up and paced irritably around the waiting room,
which was full of apparently irritated customers. She marvelled, not for the
first time since returning home, at her mother. She was an island of calm
and serenity with her book amid unhappy customers.
She decided to get some fresh air and walked into a fog of cigarette smoke
as all the desperate souls were puffing away their frustrations. Smokers tend
to be more sociable, she thought, and casually asked one of them whether it
was usually this busy.
“No. They phoned us up to say that the chiller unit had failed at Customs
and that we should be ready to receive our produce as soon as it clears.”
“You’re all waiting for frozen produce?” she asked, surprised.
“Uh-huh. I have two hundred weight of chilled lobster and it’s been sitting
in Customs for a couple of hours. It’ll probably be spoiled. I can get the
money back from insurance, but I won’t have my tails for the reception
tonight. This sucks and none of that lot care.”
It occurred to Marianne that this must be a critical vulnerability in the air
freight process, but not apparently a business continuity issue for either the
Customs officers or the airline. Naturally inclined to problem-solving and
in danger of exceeding every known measure of boredom, she sat down
to piece together how the freighting of chilled produce must work. The
customer packs his lobsters into insulated boxes and hands them to the air
freight agent at, say, St. Johns with all of the usual food labels and tags to
ensure expeditious handling and chiller storage. The air freighter will have
taken all sorts of precautions to ensure that chilled produce is unlikely
to suffer from a flight cancellation or delay, or indeed for that matter a
power outage. She had seen the reefer containers beside many of the air
freight terminals and knew that these could generally be run from either
the mains or their gas engines. When the freight is in the aircraft, it is likely
chilled anyway, as the air temperature is seriously cold at those altitudes.
During taxi and loading, the insulated packaging should be enough for
that half hour at each end. If the air freighter has this arrangement at the
departure terminal then it will likely be at the arrival terminal. It then just
needs to be checked and accounted for before handing to the customer.
Simple. In fact, as air freight is part of the business definition of this airline
service, even the most basic Business Continuity Plan[1] would allow for
stand-by power for the chillers and routine precautions to properly store
the produce freight in the event of a flight delay.
This person was importing lobster from Maine. Aside from the obvious
point that he should have bought Canadian lobster to keep things simple
and avoid any additional risk, how did Customs introduce this additional
risk? The Customs officers are required to check various imports and in
this case, they are checking foodstuffs. They will need to inspect between
airside and landside, the boundary between international and national territory, so before the air freight storage at the receiving terminal. Without
really knowing if this inspection means x-rays or actually opening the
packaging for a visual inspection, let’s say that there are two officers getting
through a consignment. It is unlikely that they would stop inspecting
purely because their chiller has failed and anything that could be brought
in to replace it would need to go through various checks. The Customs
officer’s business is inspection and so that will be safeguarded. They do not
accept responsibility for anything that they are inspecting – the signs are
everywhere. So who is responsible? Even if the officers recognise the chiller
situation and expedite the inspections, they will still be done by batch or
container and passed through to the air freighter. There is another delay in
this process, or else there wouldn’t be so many customers fretting over a
failed chiller in Customs. When we look at the range of possible risks, the
possibilities suddenly explode. We have everything from a special Customs
operation that takes priority, to under-manning, to incorrect paperwork.
This is a classic operational risk problem. It’s no comfort to the chain
smoker with a lobster reception tonight, but it’s possible to comprehend.
Marianne’s thoughts were interrupted by the desk agent calling her
number to collect her boxes. Calm as anything, her mother rose and seemingly floated to the pick-up point. Marianne noticed herself looking for
the coasters that her mother was apparently using to move around.
“Is that it?” Marianne’s mother asked.
“Yes. I got rid of most of my stuff before coming home. It was cheaper than
shipping everything back.” She could see that her response didn’t sit well
with her mother for a few moments, and then it passed. Phew, she thought.
They brought the boxes home and left them in the garage. Provided the
rehab professor’s apartment works out, she would be moving into a fully
furnished apartment in three weeks. No need to unpack. She phoned the
professor to leave a message confirming that she was interested in the
apartment and asked to confirm move-in dates. Now what? She took out
her notebook and began to reassemble the logic of what she had previously researched at the TRL.
It occurred to Marianne that while the freighting of produce by air was
a simple operation with its own attendant risks, there were two external actors: the airline and Customs. The risk context included several
unknowns purely because she couldn’t know the internal processes of
either organisation. Nevertheless, the processes, identification of risks, and
assessment were straightforward. What would you do with a city? The discussion at the Resilient Cities meeting had revolved around the complexity
of interdependencies of city functions. It hadn’t really sunk in at the time,
but each city function is itself a simple operation. Therefore, it should be
possible to assess each in isolation and then combine the results. However,
if each function is related to the other ones, there will be a correlation
in dependencies and with it, risk. For example, if two separate functions
depend upon the same infrastructure, then the loss of that infrastructure, or
even a reduction in its capacity, will affect both of those functions. What’s
more, changing one functional chain will in effect change the context for
the other functions, and so on. It is a classic complex issue, persistent and
changing. Nick Martyn had spoken that same evening about mapping the
dependencies and inter-relationships and that was clearly key. However,
you would need to define the functions first and in order to do that, you
would need to define performance thresholds.
Marianne paused. Her parents had come to Canada with small children.
They were taking a significant risk and weren’t moving to pre-existing jobs.
They were going to recover their livelihoods, and in order to do so, they
would have had a series of qualifications to regain (thresholds) that would
constitute the minimum functionality to progress onto the next stage. Some
of these functions would have been essential, such as somewhere to live and
food to eat, both of which depend upon having a minimum level of income.
Another threshold. Yet the income generation isn’t an essential function of
the young family’s existence, but so many essential functions depend upon it.
This makes it a critical function, which they must be capable of prior to
landing. So they must have prepared for it and had a clearly defined plan for
how they would re-establish themselves and provide for a young family at
the same time.This process of recovering their livelihoods implies more than
preparation, it suggests self-reliance and a clear understanding of the situation in order to navigate a clear and simple path to success. Understanding
context is key, irrespective of how complex the operation might be. Starting
afresh with a young family can’t be a picnic and would probably qualify as a
complex operation at a small community scale.
Makes sense. So what about the municipality?
When a municipality or complex operation embarks upon a resilience
assessment, the first thing that it must do is understand its own operation
and dependencies, and the hazards it faces. To understand the operation, it
needs to be clearly defined what the municipality does and what it’s for. In
short, what its purpose is. This can be broken down into lines of operation,
and each of those into its functions. Not all functions are essential. Essential
functions are those that must continue in a catastrophe in order for the
organisation to recover. In effect, they are the absolute minimum operating
capability for the organisation to survive. No niceties, no padding, just critical functionality. For practical purposes, we can grey out the non-essential
functions and any lines of operation that do not include essential functions.
Typically, a major municipality would be down to around eight lines of
operation. Each essential function is then evaluated for its thresholds.[2]
If the municipality is to survive, these essential functions need to remain
capable, but they don’t all need to be operational or ready at the same time.
Each essential function will contribute in its own way and so will have
different tolerances for interruption. The ventilator in an operating theatre
may have a five second tolerance of power interruption, whereas the area
lighting might have a twenty minute tolerance, as long as the lights over
the operating table do not have any interruption. So too with a municipality, albeit at a greater scale. Fire and rescue stations may be able to tolerate
a four-hour power outage provided their communications remain intact,
whereas a correctional facility cannot tolerate any power outage to the cell
locks and controls. The performance tolerances of each essential function
is expressed in terms of a minimum level of performance over a maximum
period.[3] The aggregate effect of all of these tolerances cannot effect the
overall tolerance of interruption to city operations.
By now, Marianne was in desperate need of a coffee. She remembered her
mother telling her that after the twins were born by caesarian section, she
still had some spinal fluid leakage from the epidural puncture. The hospital
prescribed coffee. How Dutch, she thought. Perhaps that’s where she gets
this coffee obsession from? It was in her mother’s milk. Returning to her
notes, she went back to the bit on essential functions and consequence.
Each essential function is then analysed for what it relies upon.These thresholds define the degree of reliance and the consequences of an interruption that exceeds the threshold. This consequence is measured in terms of
mission, political, and financial consequence. Mission concerns the loss upon
the operation as a whole. Political consequence encompasses all manner
of socio-economic relationships, from market position and brand value to
community and political influence.The financial consequence is measured as
the direct cost of loss only. Each of these consequence categories is measured
using quantitative and qualitative metrics. These threshold and consequence
data are used to define the functional dependencies. Having identified the
infrastructure and services and other functions that the essential function
depends upon, each of these dependencies is then assessed in the same way.
Manually, one might reasonably take this no further than the third order of
dependency, but modern software models can continue ad infinitum.
These essential functions will typically link to other functions and even
some that had originally been greyed out. Before long, one has a complex
relationship map depicting the entire operation or municipality. This is
precisely what the City of Toronto Infrastructure Resilience Study did,
demonstrating not only that it can be done for a large scale complex operation, but more importantly, it identified correlations in both dependencies
and risks that crossed dimensional boundaries. For example, the streetcar
service depends upon the power supply directly, but indirectly upon the
bus service via the people who are needed to drive and maintain the
street cars. The buses bring them to work. Remember the six dimensions
of infrastructure, and these interrelationships become much clearer. The
relationship from essential function through to its contextual dependency
— the end of the chain — is known as a causal chain.
As we now understand our own operation and what makes it tick, we really
need to understand what can affect us and how. This is ostensibly what allhazards is about, though given how her resilience voyage of discovery had
challenged some of her urban design assumptions, Marianne suspected that allhazards would be more than just listing every possible hazard. Lost in thought,
she stared at the rain collecting into little streams at the edge of the window.
“I’ve bought a couple of pies for supper,” called her mother.
“Oh, that’ll be nice,” replied Marianne. In fact, she was rather more excited
by the prospect than she sounded.
“We can have something else,” responded her mother “they’ll keep
another day.”
“No, it’s okay. Pies will be really nice.” Besides, thought Marianne, they
won’t be okay tomorrow because these are real pies from the Pie Commission[4]
and not some factory transfat abomination. On her last visit home, her mother
had introduced her to the Pie Commission and Marianne found her true
gastronomic delight. Hugely fattening, she’d have to compensate with an
extra-long run tomorrow, but they are so worth it.
DISCUSSION POINT: Business Continuity is generally considered introspective, whereas Resilience is considered extrospective. How would you relate the air freighting of Maine lobsters
to Toronto in resilience and business continuity planning terms?
How are they similar and how are they different?
Taking Stock, April 6
In which Marianne summarises her understanding of
community resilience and what this means for infrastructure
systems planning, and relates the same to her brother.
“Have you visited your new job yet?” Harry had called the house and was
talking to Marianne as she finished her breakfast.
“No, I’ve been doing some reading and researching. I was looking for an
apartment, as you know, and thank you so much for the contact. I think
that it will work out perfectly. He is after a house sitter more than a tenant,
and so will only charge me half the market rent if I look after it. We also
picked up my baggage from the Air Canada freight office. In fact, I don’t
feel as if I have stopped.”
Harry’s idea of being busy wasn’t quite the same as Marianne’s, so he
simply grunted.
“I start on Tuesday,” continued Marianne, “and will wait until then before
making any plans. I read around the two projects that they said I’d be
working on. After hearing what was discussed at that Resilient Cities
meeting you took me to, it set me to wondering. There are so many gaps
in the public arguments about both projects and I almost think that it
would have all been simpler if I didn’t think about what these projects
are trying to achieve. Anyway, I’m off to supermarket now to get a super
deal on a phone. They seem to provide better deals than the phone stores.
Where’s Sandra? Do you have any plans for this afternoon.”
“She’s working on a project in Halifax and will be back next weekend,”
replied Harry. “I can be free this afternoon. What do you have in mind?”
The minute hand on Harry’s watch just touched noon when Marianne
walked in the door of the Grenadier Restaurant in High Park.[1] They both
liked this place. They came here often as children with their parents and
saw the seasons change and the wildlife move through their own seasonal
activities. It was good to see that the farm had survived the numerous
budget cuts in recent years.
“You’re at least a hot chocolate late, Marianne.”
Marianne rolled her eyes, sighed, and sat down. “Sorry. Love you, too. Shall
we order?”
Harry nodded and they went up to the counter to order something high in
calories. Harry got the full breakfast with a side of extra toast and sausages,
and Marianne the steak frites. This would also move to her thighs, so she’d
gone for a long run this morning and, besides, it was really quite chilly out
today. Marianne had a long-limbed athletic figure. Her running and highly
active lifestyle kept the pounds off, making her calorie awareness all the
more entertaining to her brother. An unashamed carnivore since she had
teeth to chew with, her food preferences had either offended her female
colleagues or made them jealous in New York and Alex. It was one of the
many things that he liked about his sister; they could go to a nice steak
restaurant and enjoy a good meal. Most girls would pick at a salad and
push the meat or fish around the plate. Though very feminine in so many
ways, she would always be one of the boys in his eyes. They returned to
their table and waited for the food to arrive.
“You know,“ he began, “we should go to Copacabana,[2] that Brazilian
steakhouse on Adelaide.”
Marianne was an absolute sucker for Brazilian churrasco. “Fabulous. When
did you have in mind? Will Sandra be back?”
“I thought next week sometime to celebrate your new job. Sandra won’t
be back until the weekend and besides, she’s not really into the meat
fest thing.”
That was certainly true. Sandra had grown up in a vegetarian Hindu family
and while she had discovered that she really rather enjoyed eating good
quality meat, she could still find a rodizio a little overwhelming.
Their food arrived and they began to eat. Marianne explained what she
had learned about resilience and how much of it made sense, while some
things simply didn’t. What was troubling her was that many of the primary
references that all these resilience papers referred to were also standard
texts for urban design and transportation planning, and even from her
MBA.Yet, no one appeared to teach or practice resilience planning. Clearly,
she must be missing something. Harry said nothing and finished his meal.
Once Marianne had exhausted herself and resumed eating, he pulled a
rolled-up journal from the pocket of his overcoat and put it on the table in
front of her. It was a special themed publication of the Proceedings of the
Institution of Civil Engineers on Infrastructure Resilience.[3] She flicked
through the pages. It was clear that resilience planning was practised. The
IET special publication had included many examples and useful papers.
“They think about resilience on the other side of the Atlantic more than
we do in North America,” he said quite matter-of-factly. I borrowed this
from the CRCI office. A couple of them are working through the weekend
to finish a report and said that I could take it. One of the first papers is by
Hudson;[4] worth a read through.”
“Thank you.”
“I wasn’t sure what you wanted to talk about, but given your recent interest in this subject I thought I’d bring this along.”
“Thanks, Harry. This is really kind of you.”
Harry could feel the sincerity in her voice and it made him feel good.
They finished up and walked outside into the crisp air.
“Apparently, summer is round the corner.”
“Don’t bank on it,” Marianne replied. “Winter will have one last bite at
us yet.”
They walked down to the pond and Marianne explained what she
had learned.
“Resilience is about an organisation or municipality surviving a catastrophe. That catastrophe can be the accumulated effect of mismanaged
stresses, like in Detroit, or a sudden shock like Sandy. The fundamentals
are the same for each case, whether a simple operation or a complex one.
The operation is broken down into its functional components, component
lines of operation, and each then into functions, in the complex case. Some
functions will be known to be essential to the survival of the organisation,
like a data storage vault or a trading data recorder. These functions are analysed to determine what they rely on to be effective. Each of these things
are in turn analysed to see what they rely on and so on. Generally speaking, we go to three degrees of dependency, but the software application[5]
that Nick Martyn spoke about the other night can continue ad infinitum.
This dependency relationship is defined by the threshold performance of
the function. So, for example, a function might be able to tolerate an interruption of a few minutes or a reduced performance to x% for y minutes
before it needs to be fully effective again.[6] The dependency relationships
are defined by consequence,[7] qualitatively and quantitatively estimating
the political, mission, and financial effects of a loss or compromise or interruption in the provision of the resource that the function relies upon.
“They mapped all the essential functions of the City of Toronto[8] this
way, a complex, large scale operation. That was in Toronto by people at
University of Toronto. Neat, eh? Each of these dependency chains for a
given function is known as a causal chain and they interlink with one
another. In this way, we can identify when a particular event effects certain
assets or resources, what the impact will be on the city’s essential functions
and so its overall resilience. We also know that resilient cities have certain
characteristics. Well, it was a preliminary study but it correlates nicely with
other established and independent works, so I’m inclined to accept it as
reasonable for now. A resilient community has both identity and focus. The
identity could be a parish council, residents association, or even a religious sect. The focus is how people interact in the public realm, mixed use
squares, parks, etc. The community’s needs and the infrastructure enabling
the community must be in balance. Too much either way and we introduce vulnerabilities. There needs to be confidence in leadership, whether it
exists or not, and there needs to be a strategic plan that defines how each
community relates to the other – socio-economic, infrastructure, utilities,
etc – and to the municipality or province. The more I read about this, the
more apparent it becomes that resilience planning seems to fit in that area
between risk management and strategic planning. Are you still with me?”
Harry nodded and smiled at his sister. He recognised that there was a significant amount of study behind this brief summary and wondered at how
she had synthesised it so quickly. Why was she so gung-ho? Was she trying to
prove herself? If so, to whom? She hasn’t started work yet.
“There is also this idea of clusters and how a demand cluster[9] can become
unstable if the demanded resources are provided from a single source, or
that there is a correlation in dependency. There were several examples of
dependency clusters destabilising municipalities’ ability to self-recover. In
some cases, they didn’t recover despite massive external assistance. New
Orleans [10]and Detroit,[11} some municipalities in New Jersey,{12} and so on.
There was an interesting case study, published by Arup,[13] on Concepción
in Chile, following a devastating earthquake, but I need to read that
through again properly. There is also mention of an enabling relationship
that draws on Elinor Olstrom’s Governing the Commons[14] – she became a
Nobel Laureate for that, by the way. Will you take me with you when you
get yours for robotics?”
Marianne smiled and paused as she assembled her thoughts. Harry ignored
the last question and followed her gaze across the Grenadier Pond to the
precariously perched houses and decks on the far shore. After a couple
of minutes, Marianne hooked his arm again and they continued walking
round the pond.
“The valued resource in this relationship between municipality and infrastructure is understanding. You know, the whole Elinor Olstrom thing.
Anyway, there is more to this relationship and I want to understand it,
because it seems to feature in all sorts of papers. Then there is the idea that
you can stimulate a community to become resilient. This stimulation, as
Antonio Gómez-Palacio[15] pointed out, could be as simple as moving a
bus line, addressing a food desert, or repurposing an intersection. I thought
that there was a correlation between healthy cities, complete streets, and
so on. They aren’t the same thing, but they are certainly related. Similarly,
resilience is related to business continuity planning and operational continuity planning, but not the same. Business continuity planning is essentially introspective and focuses on the organisation. I certainly never heard
any reference to multiple and complex dependencies. Similarly, operational
continuity is tightly focused and less holistic. What is abundantly clear
is that it is necessarily conducted from first principles rather than using
a standard model or process. I’ve come to this conclusion because each
model has a series of assumptions behind it.You don’t know if the assumptions are valid until you have analysed the operation in its context, by
which time you are already quite far down the road. Also, critical thinking
and deductive reasoning are the foundation tools for this approach. What I
don’t understand is why it isn’t used more.”
“You’ve raised some good points,” replied Harry, “ but you haven’t mentioned what kind of understanding you need of the threat. The whole argument about resilience against protection is that for protection you are identifying a level of threat to protect against. When the threat exceeds that level
of protection you could lose everything, and so relying on protection is little
more than self-delusion. Conversely, resilience assumes failure of the protective systems and enhances the organisation’s ability to survive and continue
through that failure or catastrophe.” He paused to gather his thoughts.
“You need to know how your dependencies are affected by these threats
so that you can identify the impact on your operations and therefore
devise which measures are necessary. You also need to define the relationship between the municipality, the utilities that enable it, and the province
or region. You said that it was based on understanding or information. Of
what? The other thing that doesn’t make any sense is what the infrastructure is doing. I suspect that might put the difference in approach on either
side of the Atlantic into perspective.”
The threat and risk matrix was something that Marianne had already
identified, but it occurred to her that this municipality relationship with
infrastructure and province might well be key. It certainly makes sense for
the GO Train standards project she had been researching.
“What the infrastructure is for and so its role in enabling essential functions,
and so on, is its purpose and that relates to the strategic plan. We can’t use
the typical business strategic planning process, because most capital projects are still in construction when the strategic plan and budget has cycled
through and their goals and horizons are a complete order of magnitude
apart. The business strategic plan cycle is measured in years or even quarters.
The infrastructure cycle is measured in decades. Consequently, an adaptation of capability-based planning is used, which looks almost exactly like
traditional strategic planning. The traditional approach would say what the
organisation wanted to be capable of in twenty-five or fifty years. A range
of objectives would be identified and infrastructure requirements written to
enable those objectives with the broader context. Railroads were built on
this basis, for Heaven’s sake. But purpose is definitely the key. If we identify
the purpose, we can develop an efficient resilience plan. Perhaps, that does
effect perspective. There has been surprisingly little capital investment or
even maintenance by municipalities in the last thirty years. The Federation
of Canadian Municipalities (FCM) has done studies and there is an astronomic infrastructure deficit[16] that we will inherit. What changed? I don’t
think that we can place all the blame at the feet of the federal government
and the delegation of municipal funding. Nor can we blame it on the shift
in strategic planning from a public service and development agenda to a
business and budget one. After all, the driving force in all of the debates and
particularly at the Resilient Cities meeting last week was this idea of sustainable development driving the need for resilience. I may have got that wrong,
though. Then again, perhaps it is cultural. Canadians simply don’t perceive a
threat. Even after the flooding in Calgary, ice storms, tornados, wild fires, and
who knows what else.” Mother had declared that everything was back to normal.
“Canadians riot more per capita than they do in the US, though it tends
to be about hockey, or a G20 event. Canada has more domestic bombings
per capita than in the US, albeit perhaps on a smaller scale. Nonetheless, it
still happens. Conversely, 9/11 shook the US psyche and now so much allhazards protection reflects a counter-terrorism focus.”
Exhausted, Marianne looked down. They were at the end of the footpath
around the pond at the junction of Ellis and the Queensway. She would
need to tease out how all this relates to sustainable development. The allhazards bit and the perception of risk would also need a bit of investigating.
“So, what do you think?”
“I think that you’re nuts; positively barking mad,” her brother replied.
“What’s this really for? There are guys who specialise in just this, who
research various aspects of it for years. Why are you so determined to
understand it all now?”
“‘It applies directly to what I do in transit planning. Why it isn’t included
in any of the transit plans that I have been part of, I can’t say. However, it is
clear to me that it should be a consideration in the strategic planning stage
of a transit program. I don’t know if I can change the way things are done,
but I can at least ask questions of the client, operator, and municipality
about what it is that they want to achieve. More importantly, I think that it
will allow me to reduce whole project and operation risk associated with
transit systems, and make me a better planner.”
“Come on, Marianne. That’s enough serious talk, let’s get a pint.”
“Mom will be home by now. How about coffee and apple cake? I smelled
her baking last night.”
“Done. Why does she always bake at night?”
“No idea, but I’m not going to complain.”
Marianne paused for a moment.
“Do you ever think about what it must’ve been like for Mom and Dad
coming here from Holland with us still in strollers? It must’ve been really
tough. Both were professionals. Dad was even a UK-qualified chartered
civil engineer and was recognised in Germany as a Diplom-Ingenieur. Mom
was similar. They moved here and none of their qualifications were recognised, so they had to start again. Can you imagine that? I would have said
that they were resilient, albeit to a self-inflicted set of circumstances. Is that
resilience like what we are talking about for municipalities? Reading this
stuff recently has given me a new appreciation of what our parents went
through to be as successful as they are now. It’s quite humbling. Do you
think that either of us could do something like that? I’m not sure I could.”
Harry stared blankly at his twin. “What are you talking about?”
“Mom and Dad are cruising along, have us, and for whatever reason decide
to emigrate to Canada. Their productivity drops to zero. Dad goes back
to university to requalify and Mom does books and things to keep food
on the table. Once Dad is requalified, he gets a job and quickly progresses.
Mom then requalifies. Everything is sacrificed for a vision of a new life
for us, not them. They had to restore each aspect of their lives. They must
have been prepared, though I remember Mom saying that they didn’t
have much cash when they landed. How did they prioritise what to spend
money on and what to do first and all that stuff? It makes me queasy just
thinking about it.”
Harry nodded. “I hadn’t really thought about it in those terms. I guess that
I’ve always just taken our situation for granted, but you make it all sound
quite precarious, at least during our elementary school time. I’m glad that
Mom still bakes, though.”
Marianne punched her brother and harrumphed. Here she was getting
quite emotional about their parents and her twin was thinking of cake. She
does make very good cakes, though.
DISCUSSION POINT: How can resilience be used to guide or
influence our development of a vision-based strategy?
The New Job, April 7
In which Marianne begins her new job as a lead transit planner,
is surprised to discover that she is instead to conduct a firmwide resilience assessment and strategy, begins to plan how
she will go about the project, and investigates the structure,
culture, and administrative arrangement of the firm.
Marianne had forgotten what a scrum rush-hour transit could be in
Toronto and she felt a little flustered as she emerged from Osgoode Station.
She turned west down Queen Street towards Spadina and her new job. It
was twenty minutes before her appointment and the office was a seven
minute walk away, so she decided to stroll and calm herself. It was always
exciting starting something new. That tinge of anxiety about the unknown
mixed with the thrill of something new. She paused in the human flow
and looked up at the leaden sky. Breathing deeply, she rounded the corner
and went up to the offices.
She was met at the front desk by a very pleasant receptionist. She was in
her forties, Marianne guessed, very calm and professional. Marianne liked
her immediately; which gave a wonderful first impression of the company.
Marianne was offered a coffee, which was exceedingly good, and took a
seat. In Marianne’s view of the world, coffee was the distinguishing feature
of whether people appreciated taste and quality, if they just followed a
fashion, or simply didn’t care. This place was definitely in the first category.
Andrew walked into the reception with his hand extended and a big smile.
“Welcome, Marianne. It’s really good to see you here. Did your move go
okay? I heard that you were taking a week off before starting with us.”
“Yes thanks, Andrew. It’s really good to be here and everything is fine.”
Andrew was dressed in black. It was clearly an architect thing and it
occurred to her not for the first time that if he took off the red-rimmed
glasses and put on a white collar, he could pass as a Roman Catholic
priest. Funny.
He whisked her through the studio to introduce her to all of her new colleagues. She remembered the first two names and everything else became
a blur. It was her being shown to the studio and not the other way round.
She’d have to work on this office / studio thing. It clearly mattered to
Andrew and, she guessed, the other principals also. She was then passed to
HR, a short woman with fluffy slippers on, for induction and orientation.
Oh, joy! she thought.
Around 1 p.m., Marianne emerged from her induction feeling like a pinball
that had been played for a straight four hours. She walked out of the building and back onto Spadina. There used to be a really good wonton place
on the corner of Dundas and Spadina, but she couldn’t remember the
name. With a clear hour before she was to meet the principals, she decided
to explore and get some air and perhaps dumplings. King’s Noodle.[1] That
was the place.
Refreshed by a rush of student nostalgia and a sizeable lunch of wonton
and beef soup, she strode back to the studio, using her new swipe card to
go directly to her desk. In the ten minutes she had before the meeting,
she quickly confirmed where the meeting room was, took a selection of
basic stationary, and dumped it in a jumble on her desk. Grabbing her
precious Moleskine notebook, she walked to the empty meeting room and
sat down. The principals came in over the next five minutes with Andrew
arriving last. The first one in was Jamie, shorter than her and about as
round as he was tall. He seemed very jolly, but at no point did Marianne
catch what he actually did. Then came Graeme, older than the others and
a little stooped. What her father used to refer to as the silverback in the
company. Jamie and Graeme were dressed quite normally, she thought,
Jamie in a grey suit without a tie and Graeme in slacks and sports jacket.
The other principals, she supposed they were architects, Mark and James,
could have been lesser clones of Andrew. Dressed head to toe in black, lean
and pasty with earnest expressions, but somehow not carrying the same
presence as Andrew. What a mix. Marianne wondered if she would have
to start investing in black clothes, which she’d always found so depressing.
The pleasantries over, Andrew made quick introductions around the table.
She had correctly pegged Mark and James as architects, and Andrew and
Jamie were planners. Graeme, the silverback, was the transit planner and,
in effect, her new boss. Clearly and succinctly, he then summarised the
company as a whole and how their Toronto studio fit in. There were
offices and studios in six cities across North America: Toronto, Calgary,
Vancouver, San Francisco, Chicago, and New York. Each location had its
own specialised lead in the company with other overlapping skills. Toronto
was the urban planning lead, Calgary the structural engineering lead, San
Francisco the architectural lead, and so on. It didn’t seem very joined up
to Marianne, but it must work or else the company wouldn’t have grown
as it had.
“Marianne, we asked you to join us to develop the transit planning capability within the Toronto studio. We have two sizeable projects on the go
and a proposal just out the door. We still need you to set up this capability
with Graeme, but the pressure is off for a while and there is something else
that we’d like you to do first.”
Marianne’s stomach tightened. Doesn’t it make more sense to carefully and
deliberately build a capability precisely when the pressure is off? she thought.
“We had quite the service disruption last year during the Calgary floods,”
continued Andrew. “The firm’s servers are in Calgary and when that studio
was cut off, we lost connectivity across the whole company. Though the
event was less damaging than when our offices in New York flooded
during Sandy,[2] the impact on the company was far greater. HR has been
running with the business continuity plan and quite frankly, it didn’t work
as we would have liked. We want you to investigate and come up with a
plan of how we can protect ourselves from this in the future. I needn’t
tell you to be sensitive, as the IT and HR people were quite invested in
their systems and are feeling particularly raw about two failures. What do
you think?’
Marianne tried to digest what had just been thrown her way. “Okay,
sure, but why me? Don’t you want someone more familiar with the
firm’s workings?”
“You are new to the company and from what I know of you, have a first
rate brain.You will be able to look at things objectively, identify the issues,
and develop a series of measures that we need to implement. I also know
that you will be sensitive. Besides, I assured our head office that you were
the right person for the job. So you’re it. Have a read into it all. I’ll be
working with you on this, representing head office, so let’s say we arrange a
time tomorrow to go through it. Speak to Susan at the front desk and she
can find a time in my calendar.”
Andrew rose and the meeting instantly broke up. They clearly didn’t waste
time in meetings here. Quite refreshing. Graeme leaned across the table as
Marianne was getting out of her chair.
“Just a minute, Marianne.”
She sat down and Mark lingered behind her chair. He already gave her
the creeps.
“This doesn’t change why we asked you to join us. In fact, you should see
this as a recognition of our faith in you that we are asking you to do this
job. Frankly, not all the principals in the firm think that there is any issue.
The head office guys are sensitive to the risks, but the people in the studios
have forgotten what happened last week and rarely look beyond the next
year-end bonus. Be careful and you will be successful.”
“Thanks, Graeme. I see why me and not a consultant. May I pick your
brain on the firm? I’ve got quite a bit of reading to do first.”
“Of course. My calendar isn’t quite as busy as these fellows. Just drop by
my office when you need to. Good luck.”
Marianne gathered her thoughts. The first thing to do is make a plan
of how to address this problem. Perhaps I’ll schedule that appointment with
Andrew first. She went to find Susan.
Andrew at 4:30 p.m. tomorrow. That means I have just over twenty-five hours to
get my thoughts together on how I’m going to tackle this thing. Thinking back
to her undergraduate classes, she recalled one slightly eccentric professor
who spoke about problem solving. The key is to identify the requirement.
After that, everything unravels. He banged on about critical thinking and
deductive reasoning and how you must challenge any and all assumptions
if you are going to be effective.They’d all thought him a little on the fringe
at the time and only paid passing interest since it was a non-credit short
course, but she now felt glad that she’d persevered and attended all the
lectures. She wrote:
What do I know?
The company / firm was affected locally by Sandy in New York.
The company / firm was affected as a
whole by the flooding in Calgary.
New York is a branch studio, located on Water
Street in Manhattan.They specialise in security
engineering and protection design. How ironic!
The Calgary studio is comprised of head office and the
notional structural engineering lead, though in truth
all disciplines are represented there. All administration
is based out of Calgary, with a satellite in Chicago
to deal with the US-specifics, mainly HR.
The studios are autonomous fiefdoms and really
only coordinated by the head office.
What do I need to know?
How were the New York and Calgary studios affected
by these events? We need a chronology of events.
What local and corporate equipment is retained at each studio?
How is each studio interconnected?
What are the studios vulnerable to?
What is the company / firm vulnerable to?
Marianne began chewing her pencil end between scribbles and doodles.
That doesn’t really tell me anything. As business continuity planning has already
been done, albeit unsuccessfully, many of these questions must have already been
answered. Or maybe not, since it failed the company. Either way, I need a copy of
the BCP.[3] Knowing what happened at the New York and Calgary studios does
not tell me what the impact was. After all, the studios exist for a purpose and it is
the impact on that purpose that is the real effect of these events. Perhaps we can use
the resilience planning approach for this problem. We aren’t really talking about a
municipality. However, it is a relatively simple operation, and geographically dispersed.That was the basis of resilience thinking prior to the City of Toronto study.[4]
Therefore, it is worth looking at, at least just to formulate a requirement.
Step one is to understand the operation. For that I need to understand what depends
upon what, the culture of the organisation, corporate structures, and administrative
networks. Ouch. Step two is to understand the risk context, comprised of the allhazards – I need to learn that – the operating environment and the operating
context. That’s doable. Step three is the synthesis of the operation and its context
to see how events can impact the operation. This will expose the interventions necessary. Really, the requirement is wrapped up in each step, which is not helpful.
However, if the New York studio failed, despite normal precautions and a BCP, and
the Calgary studio interrupted the whole company, we are looking at continuity of
essential functions and recovery post event. I need to learn about incident timelines
as well. So, step one.
Marianne sketched out six small circles in a ring. Each represented a studio
and she put a letter in each to designate which one it represented. Next,
she took a roll of tracing paper and cut off pieces the size of her notebook.
On the first one she wrote IT, the second Telecom, the third one HR, the
fourth one Accounts, the fifth one Organisation, and put the remaining
sheet aside. There was bound to be something else.
I need to be able to map the relationships at a company-wide level in each of
these categories. I then need to represent each of these relationships at a studio
level. Therefore, I need to separate the company functions from the studio functions.
That makes it easier. So looking at the company level, I’ve identified the essential
business functions of communication – ah, I forgot Corporate Communications. So,
yes. I have telecommunications and corporate communications, IT / data, finances
and accounting, and HR. These are all facilitated by the coordinating function that
included direction and decision-making. I’ll speak to Graeme about these. That will
allow me to break down what I need to ask of each administrative team. Where is
the old silverback?
She found Graeme at his desk blowing on a steaming cup of coffee.
“Ah hah, that didn’t take you long. Got it worked out already or do you
have a question for me?”
Marianne explained her thinking and why she wished to focus on the
company-level functions first.
“Well that makes sense. Shoot.”
“What is the relationship between the studios?”
“You don’t start with easy questions do you? Well, each studio is a semiautonomous enterprise. They are licensed and registered in their respective
jurisdictions and can be in the strictest sense thought of as stand-alone.The
managing principal of each studio sits on the firm’s board, which is led by
the chief executive officer (CEO), chief operations officer (COO), and
chief administration officer (CAO). The COO coordinates all the bigger
proposals and facilitates teaming across the studios to match resources
to projects. The CAO coordinates all the administrative functions, from
accounting to marketing and communications (MARCOM), as well as
overseeing our insurances, risk management, and business continuity. She
controls each of the administrative directors. The CEO reports to the
trustees of the firm, who manage the trust on behalf of all the beneficiaries – the employees. The chairman of the Board of Trustees is also the
chairman of the firm’s board. They gave each studio a lead discipline in
order to encourage closer cooperation between them, but it’s only been
marginally successful. Each studio is keen to stamp its independence on
everything it does and so more often than not resents direction from the
board. Somehow this perpetual state of chaos and angst produces a successful dynamic.”
Marianne nodded as she scribbled. Why couldn’t it be a straightforward hierarchical set up? Does nothing resemble the standard cases they showed in the MBA?
“Thanks. Err, what about the administrative functions. How are
they arranged?”
“Winona, the CAO, likes to control things directly and doesn’t delegate
easily. Consequently, all studio and firm financial transactions are handled
by Calgary and Chicago for Canada and international, and the US respectively. That was one of the problems when Calgary flooded: Toronto and
Vancouver couldn’t pay bills or receive money. When it came to payroll, it
was a complete mess and took four or five weeks to sort out. The flood
happened just before the next payroll was finalised, which is a week
before people are physically paid. Therefore, payroll and pay are exactly
out of sync on a two week cycle. It meant that the payroll adjustments
couldn’t go through, including expenses. As we have contracted out
the payment process, we could still pay the staff. However, it needed a
special authorisation since all the normal processes were interrupted. Our
finance director went over each person on the roll with them to manually
confirm payments.”
Marianne felt a little uncomfortable. She was sure that few if any of
the staff knew these details. It was like being exposed to the company’s
seedy underbelly.
“HR was a bit of a non-event. Their routine functions were unaffected,
but because Winona is so paranoid and risk adverse, contact details had not
been shared with even the managing principals. The consequence was that
we couldn’t contact the staff to let them know what was going on. Which
brings us to the IT system. Everything, including back-ups, are in Calgary.
The back-up servers are in the next door building, but frankly collocated.
When the downtown started flooding, Enmax[5] shut down the substation in the area and with it the power to a larger area. Consequently, the
studio lost power before the flood waters came in the basement windows.
The server room was raised up and just wet under the anti-static floor. Air
cooling went down with the power cut and the whole system shut down
soon after as it overheated. Since we run the company mobile phones and
studio phones through the same servers, we lost all communications as
well as data access. Just as embarrassing was that we couldn’t tell our clients
what was happening and how their projects were being impacted. Our
inability to reassure lost us an important client, who we really couldn’t
afford to lose.”
Marianne returned to her desk and sketched out the administrative relationships on the tracing paper.
She wasn’t sure if she’d got any further by graphically representing these
relationships, but it did become apparent that the administrative structures
did not match the culture of the organisation.[6] She knew from her risk
management courses during her MBA that when you select your risk
management framework, you adapt it to the existing culture and processes
in order to optimise acceptance. Irrespective of whether the company’s
culture and organisation made sense, the administrative functions have to
reflect it in order to enable operations.[7] How these relationships should
look will depend upon the impact they have on the organisation and
operations, as well as their own respective internal cultures.
She trawled the company’s website, but beyond a general statement of
values, there was nothing that even hinted at a unifying purpose for all of
the studios. She decided to assume that the purpose was production. After
all, production generates income and everything is oriented to enable
it, from marketing, to IT, to the various disciplines, to the retention of
staff. That seemed a reasonable starting point. However, it challenges two
features of the organisation. Projects are rarely single discipline and from
her induction, she learned that inter-studio collaboration was a normal
practice, making data streaming between studios, albeit through Calgary /
Chicago, a vital enabling function. If each studio specialised in a specific
discipline as opposed to the intellectual or technical leadership of the discipline, then should a studio fail, the whole company would be deprived of
that specialist resource. The corollary is that each discipline is represented
by individual principals. For example, transit planning is Graeme, which
is why she was brought in. Succession planning of a sort. However, given
the semi-autonomous nature of each studio, what happens if the managing
principal is suddenly prevented from discharging his responsibilities due to
being stranded in Cuba by an airline strike, or worse, unexpectedly occupies a casket? This would need unravelling and to do so, she would need
to have a detailed breakdown of which principals and directors are where,
and responsible for what. That would provide a basic operational picture
of the company. The local structures should be simpler, but are somewhat
opaque with each studio potentially configured separately.
Marianne looked up from her desk to find the studio deserted and only
the lights over her desk and in the corridor still on.
Damn. I promised Mom that I’d join her for dinner.
She quickly called her mother, apologised profusely, and explained that
she’d be a bit late. Her mother was already waiting at PJO’Brien’s[8] on
Colborne Street. Her mother really didn’t like sitting in pubs and restaurants on her own and Marianne was now feeling extremely guilty. She
shuffled together her papers, locked her computer, and turned off the
monitor. With one last look about her workstation, she grabbed her purse,
turned off the desk lamp, and pulled on her overcoat as she left the studio.
DISCUSSION POINT: How important is company culture?
How might culture influence how Marianne develops her resilience assessment and plan?
All-Hazards, April 8
In which Marianne learns about all-hazards assessment
and how this directly and indirectly affects the operating
performance of an organisation at all levels of function
and control, as well as the site of the operation.
From her earlier researches at the Toronto Reference Library, Marianne
had collected a series of links to federal[1] and provincial[2] policies, and
some from the US Department of Homeland Security,[3] the Australian
Attorney General’s Office,[4] and the UK Cabinet Office. Nailing down
exactly what all-hazards actually means was proving quite difficult,
even though it is referred to by everyone on the assumption that it is
understood. Like similar cases, everyone has their own interpretation.
She decided to see those CRCI wonks that her brother had mentioned.
She still had that copy of the ICE journal, which would provide a
useful icebreaker.
From what she had ascertained, the common features of each all-hazards
reference is that it is loosely considered to be comprised of three categories. The first are natural hazards – earthquakes, extreme weather, wildfires,
volcano eruptions, and so on. The second and third are human hazards,
accidental and malicious respectively. Accidental events might be a train
derailment, like at Lac-Mégantic in 2013,[5] or a propane gas plant explosion, like in Toronto in 2008.[6] Clearly, safety regulations and procedures
only go so far and there remains an operational risk. For whatever reason,
Marianne found the third category, malicious hazards, somehow easier to
comprehend. She had been exposed to a near constant terrorism focus
while in the US, though natural and accidental events had done far more
damage to the economy. There is something about a malicious act that
sticks in the collective psyche, whether the betrayal of secrets, like the
actions of Snowdon[7] and Delisle,[8] or domestic bombings like Ludwig[9] –
like her, an import from Holland, and terrorism, Toronto 18.[10] This is over
and above the normal background level of riots and unrest, such as NHL
matches in Montreal and Vancouver[11] and Toronto G20,[12] and good old
fashioned crime. To get a sense of scale and frequency, Marianne looked up
the Canadian Disaster Database,[13] which proved an absolute treasure trove
of data, despite tailing off somewhat after 2012. She also had a reference to
the RCMP bomb database,[14] which proved a little harder to track down,
but morbidly fascinating once she located it. She compared these results to
US data to discover that Canadians are just as bomb happy as their southern cousins. The per capita incidents are of the same order of magnitude.
For all its expanse, the Canadian population is pretty concentrated in a
narrow belt along the east and west coasts and the US border. Why do
we have the perception that it is safer here? Looking then at crime, she
found that Canada was indeed a safer place with isolated pockets that had
more to do with gangs and drugs. That’s everywhere, she supposed. It’s
certainly one of the safest countries for murders,[15] which made her feel
rather better about being Canadian.
It occurred to Marianne that many of the events that she was reading
about were relatively recent and so she began to extract data from the
disaster database for yearly wildfire, wind, and flooding events. In each
case, there was a definite upward trend. So the statistical evidence supports the
anecdotal claims of changing weather patterns, she said to herself. She looked
up the UNEP website[16] to see what the climate change scientists were
saying about weather patterns. The trends of general warming change the
moisture collected from the Great Lakes resulting in higher precipitation
on the GTA. She also found a reference to a City of Toronto study[17] that
had fused the climate change data with weather models, achieving just the
granularity that she had wished existed. This stuff is all out there, she said to
herself. You just need to dig for it.
Marianne took a break from her desk to find the coffee machine. She did
a full circuit of the floor before she discovered that the kitchenette was less
than ten metres away from her desk. How she had missed that was beyond
her, but it did promise a never-ending supply of coffee close to her desk.
She poured herself a cup and then dumped it down the sink after taking
a couple of sips. The company — sorry, firm — obviously has one coffee
for the public and another for the staff. She walked to reception and asked
Susan if she could have a coffee, in an almost conspiratorial way.
“All the principals take this coffee. I shouldn’t worry,” Susan said and
showed her how to use the machine.
Refreshed, Marianne returned to her desk. It occurred to her that while
all this stuff on trends and statistics was useful, she needed to get back
to what all-hazards means and how it is applied. She phoned the CRCI
and arranged a time to visit during the lunch period, and got back to
her research. What she really needed to understand about all-hazards is
how it translates to risk to the company and to the studios. She looked
up the Ontario Hazard and Risk Assessment,[18] noting that municipalities
were required to have something similar. The Ontario one was easy to
access, but the municipal ones seemed to be secreted away. She’d have to
request the information directly from the municipalities using freedom of
information legislation if necessary. Flood data was also poorly provided.
The provincial flood maps were accessible,[19] but notably out of date. The
federal mapping was useful in a big hand over a small map sort of way.[20]
She imagined Stalin referring to flooding in Siberia with a general wave of
his hand that covered half of the Soviet Union. She wondered if Putin did
such things today. Focus!
At a local level, she needed to know how the studio would be affected by
a hazard event. She knew that the indirect effects are often greater than
the direct effects, and this is cited as one reason for the depressingly high
number of businesses that fail to reopen following a catastrophe. What she
needed to know was how the studio would be effected by a flood, say. She
had an idea and went in search of the GIS[21] analyst.
Scott was sitting in splendid isolation behind three large computer screens
in a corner of the studio. Marianne introduced herself and chatted for a
few minutes. Noting his impatience and apparent inability at small talk, she
took a deep breath and presented her idea. Scott broke into a smile. Finally,
he had an interesting problem to get stuck into instead of churning out the
same maps beloved of urban planners the world over.
“Okay, but to develop that kind of trace, we would need to pick specific events and create layers for each utility and service, likely in a 3D (or
Digital Elevation Model – DEM). So let’s say we focus on flooding. We
would calculate the worst case flooding extent and from that, the influence
upon utilities. The first layer would be power and would show how the
flooding affects power distribution. The next layer would be, say, potable
water and hydrants, the next sewers and water treatment, transit, transportation, and so on. We can do this. Where do you want to do this for?”
“Calgary first.”
“What’s the event and how bad?”
This question made Marianne pause. She didn’t know yet what the main
hazards were for Calgary. They had a serious flood last year, so they could
start with that. As for how bad, she remembered in her reading last week
that the resilience approach was about operational survival and rapid
recovery when the system fails.
“Flood. Identify how bad it could flood given the topography and ground
roughness, levees etc.”
“Okay. When do you need it?”
“How about 4 p.m.?”
“Whiskey Tango Foxtrot! Do you have any idea what you have asked for?
This will take a couple of days and I have actual projects to deliver.”
Marianne wasn’t sure what Whiskey Tango Foxtrot meant and had never
met someone who could talk in phonetics.
“Okay. As soon as you can, accepting that you have other deadlines as
well. However, Scott, could you provide the flood map for the downtown,
showing surface flooding and the Calgary studio location?”
Marianne smiled and left Scott to his computers. She supposed that he
must have been in the armed forces or something, or else excessively into
war action movies. Curious. Returning to her desk, she collected her purse
and notebook and went out.
The CRCI office[22] was in the Galbraith Building of the University of
Toronto’s St George Campus. She knocked on the door to be greeted by
a muffled yelp. The door opened. All she saw was a beard and she instinctively looked down to check that he wasn’t wearing sandals. He was barefoot. She smiled and introduced herself.
The office was very small, with just three desks and a spare chair for visitors.
Marianne elected to sit without being asked. The beard who had answered
the door, turned out to be a post-doctoral fellow and the main point of
contact for infrastructure resilience, which was just as well for Marianne.
By far the biggest part of the CRCI was the structural resilience area with
blast, impact, and seismic work going on.
“So, what can I do for you, Marianne?” asked the beard.
“I meant to return the journal that you kindly leant me. Sorry, I forgot it
on my desk, but I’ll bring it back tomorrow.”
“No rush.”
“Thanks. Also, can you explain all-hazards to me and how you apply it?
I’ve read various references to it, including the Federal Action Plan[23] and
there’s nothing I can actually use.”
“Yes, not the most helpful document, that. Well, it’s quite simple really.
All-Hazards is simply a way of categorising hazards and threats by nature,
vector, and effect. The all-hazards spectrum is comprised of natural and
human hazards. Human hazards are sub-divided into accidental and malicious. Not all hazards apply to a given operation or site, so you need to
first look at what could be a hazard. There are some checklists to start you
off, but a healthy imagination will suffice. Aside from the alien invasion
and shrink rays, my preschool daughter can compile an excellent starting
point.You then start weeding out hazards by asking if they are relevant. For
example, a tidal storm surge is highly unlikely to affect Barrie. With what’s
left, you need to do two things. The first one is to decide what effect these
hazards represent. For example, a car bomb, a propane gas explosion, and
a dust explosion are all explosions. If they all apply to your operation and
site, the effect is an explosion and you identify the worst case or Maximum
Realisable Threat and the Statistical or Baseline Threat. It’s a simple sliding
scale. You assign a relative scale to the other side, where one is the MRT
and zero the baseline. The current level of threat is then annotated. You
collect all of these hazard effects together and put them into a threat wheel
with the one on the circumference and the zero at the centre. It shows you
at a glance what level of threat your operation and site face. The second
thing is to understand how the hazard can affect you. For this, you must
understand your dependencies. Do you know about dependencies?”
“Yes, thank you.”
“Well, you go through each identified hazard and for the identified thresholds determine whether that hazard can impact your operation directly or
indirectly. If not, disregard that hazard.You’ll find that the list has narrowed
considerably. Skim off the worst case ones and the most likely; these are the
hazards that you will start with. You now have three products. The hazard
impact assessment gives you risk priorities and allows you to start a normal
operational risk management analysis. The hazard spectrum tells you what
the minimum design and construction standards are for protection and
the threat wheel provides, at a glance, the level of threat. When you then
overlay your protection levels, you can illustrate how much risk is carried.
It correlates closely to the residual operational risk after initial treatment
and highlights where you either need more protection or need to invest in
further resilience measures.”
“Sorry, I’m confused. Aren’t threat and hazard different things?”
“Sort of. The generic is hazard and threat is malicious. Used interchangeably. Bad habit.” The beard’s voice had become staccato and Marianne
sensed that perhaps he was caught off guard by her challenging his flexible vocabulary.
“So how does the threat spectrum inform design?”
“Oh, yes. You always design to the MRT and the minimum construction
standard is the baseline threat. That way, if an upgrade is needed, you don’t
need to rebuild, just retrofit. It is cost effective. So, for example, you would
design and build the structural frame to withstand the MRT, but the outer
walls may just be at the baseline standard. You look at the hazard / threat
vector and decide how long a threat / hazard will take to manifest itself.
If it takes longer to upgrade the protection to meet that increased threat
than the warning you have, you need to decide if you are going to proceed
with the higher protection level at the outset or not. One project that we
worked on was a government building in the Middle East. The client had
identified a certain terrorist bomb threat. We had identified the potential
for a greater threat and incorporated this into the structural frame design,
at minimal cost difference. We also put in anchorages into all of the edge
beams so that if an upgrade was needed, the reinforcement strapping could
be simply screwed into the anchorages with minimum disruption. After a
few seasons, the client did require an upgrade. Each evening, during the
normal cleaning routine, the panels along one side of the building, one
floor at a time, were replaced. The disruption to the offices, which were
operational twenty-four hours a day, was minimal, since we only needed a
four-foot clear space along the outer wall for that day.You need to understand the travel time of the hazard, which is part of that impact assessment process.”
“Thank you, I think. You’ve certainly answered my question, though I
think you’ve probably given me more to think about.Thanks. Hmm. Can I
drop by again to pick your brains?”
“Of course,” replied the beard. “Just not next week, as I’m presenting a
paper in Paris and we’re using it as an opportunity for a family holiday.”
Marianne felt like she’d been attached to a firehose for a lesson in drinking
through straws. Stopping briefly at a restaurant for a take away, Marianne
returned to the studio and pensively ate her lunch at her desk. She sketched
out the threat spectrum that the beard had described. What was his name?
All-Hazards only makes sense if you know how you can be affected by
them, hence the operational dependencies are the first priority. That’s clear.
What about this MRTC? How do we work this out? Generally speaking, she
knew how bad it can get; a catchment area can hold so much water, the
topography supports so much flooding, after which we are into a repeat of
Noah’s flood. What about criminal activity? Well, there are various constraints where higher crime rates deter talented people from living and
working in the area and so the business has to relocate. There are also
various social management processes. The terrorist one is more difficult
and she made a note to phone the New York studio about malicious threats
generally. Nonetheless, the greatest economic consequence has consistently
been natural events and that was where she felt she should focus.
San Francisco and Vancouver are threatened by the Cascadia[24] fault. They
must have earthquake response requirements. Marianne seemed to recall
something about each building owner and business operator being mandated to make earthquake provision. She’d have to phone San Francisco.
She liked the city and with any luck there’d be a good excuse to visit
soon. She had spoken with a couple of San Francisco city staff at that
CityAgeTV conference last year and they had spoken about the driving
fear of depopulation following an earthquake. Consequently, the city was
taking resilience really seriously, seeking to demonstrate active engagement
in the issue and so instil confidence in the population. It was that perception thing again.
Scott stood quietly beside her desk with his hands behind his back and a
huge grin on his face. Marianne almost jumped out of her skin when she
realized that he was there. That guy was creepy — talented, but definitely
creepy. Scott produced a plot of downtown Calgary and opened it out on
Marianne’s layout table.
“I took the publicly available topographic data for Calgary, hydrology
features, and stream flow data. The stream flow data was collected from
the Water Survey of Canada for a number of water gauge stations on
the Elbow and Bow Rivers, Western Irrigation District Canal, and Nose
Creek. Stream flow data for June was used because this is when floods have
occurred historically and when stream flows are highest. I modeled the
2005 flood and validated it against the known extent of the 2005 flooding.
Using June 2013 stream flow data, the 2005 flood model was repopulated
and compared with the extent of the 2013 flooding. Projected increased
stream flows were modeled to anticipate future flood extents. This hydrological modeling was based on HEC-RAS 4.1 using ArcGIS 10.2. This
gave me a direct association between flood plain and surface flooding. I
overlaid the Enmax power distribution system – substations – and estimated the electrical distribution for each substation using optimised
polygons. When the substations within the surface flooding zone are shut
down, you can see that the power outage associated with the flooding is
far more extensive than simply where you get your socks wet. Neat, huh?”
Marianne looked at a beaming Scott and was immensely impressed despite
only understanding about half of what he had just said.
“So you have mapped the flooding and the power outage resulting from
it. That means that we can say for anywhere in this mapped area how the
flood will directly affect a site and whether the power will be lost.”
“That’s what I just said. Cool, isn’t it?”
“Yes.Very. Thank you so much, Scott. Wow.”
Scott danced away, leaving her with the map.
Suddenly, the location risk question was very real. She was now able to
say with some confidence that in the next flood, the studio would almost
certainly lose power, even if it wasn’t physically under water. More importantly, she could say where they might like to move their studio to. She’d
have to discuss the detail of these location risk maps that Scott was now
producing for her, but first she had to tell him what events to map against.
After some further consideration and reference to the federal and Alberta
environment maps, she decided that ice storms and floods were the two
main concerns. Tornados are highly localised and there is nothing geological to worry about. Similarly, wildfires aren’t a serious issue. She sent
Scott a quick email thanking him again and confirming the two hazard
concerns. She then began collecting her thoughts for her meeting with
Andrew in thirty minutes. Time for a coffee. She scribbled her wish list as
Susan made her a coffee. She was ready for the meeting.
“The firm is more complex than I thought,” began Marianne. ”The
organisational structure is like a federation of studios, but the administration services that support the organisation and its operations are highly
centralised. It means that anything affecting the Calgary studio will affect
the whole firm, instantly. This federated structure and dispersion of the
studios mean that each is subject to a very different risk context. Therefore,
we are left with two distinct entities to assess. The firm-level functions,
including all the administration, and the local studio level, where the actual
production takes place. I have assumed that the purpose of the firm is sustained economic growth and the critical enabling operation to deliver that
is production. Therefore, the resilience of the firm and the studios must
be around continued production. I haven’t been able to go much further
in the analysis yet, but have started to identify the critical functions at a
firm level – that is, those functions that need to continue or else recover
almost immediately if the firm is to continue to operate. I’m not yet clear
what the minimum level of production the firm can sustain and remain in
business, or how long, but that will come out of the research. I have started
to look at the location risk for the studios, starting with Calgary. This map
shows the flood plain in dark red, the associated surface flooding in light
red and the resulting power outage in grey. It shows for a worst case flood,
how we and our neighbours will be affected by it, directly by the water
and indirectly through the power network. We are repeating this for all
utilities and municipal services so that we can make an informed estimate
of impact on the studio and where it could be located to permanently or
temporarily, if necessary.”
“You’ve made an impressive start. Careful about firm organisation and
culture. There are many raw nerves around that. The Calgary studio won’t
move. No discussion. The address is prestigious and easily accessible to all
of our primary clients there. The idea of a temporary relocation is interesting though. So what do you need from me?”
“I need a who’s who of principals, directors, and associates in the firm and
what their technical and corporate responsibilities are. From this, I can
identify who to speak to about matters as they arise and where the sole
capability points are. What is the succession plan? I will need to know the
cost of simply running each studio and the firm as a whole, so that the
minimum cost of interruption can be captured to set against risk-based
investment decisions. I need to understand the financial and IT systems in
quite some detail and would welcome the opportunity to study them in
person, in Calgary.This will give me the opportunity to question the directors as issues arise and so expedite the assessment. Finally, I need precise
chronologies of the New York studio during Sandy and its aftermath and
the Calgary studio during last year’s flood.”
“The who’s who is simple enough. Speak to Graeme and he’ll help with
that. Good question about succession planning. I’ll speak with the chairman about sharing his plot with you. Providing you with the running costs
of the firm may be a challenge, but I see why it is necessary. Let me speak
with the CEO first and we’ll both speak with Winona. Visit to Calgary
– agreed. Two nights enough? Now the chronologies may be the biggest
challenge. These need to be written by the studio managing principals.
Carving out that sort of time for something that neither of the two particular characters in question see much value in may be difficult. I’ll deal
with that one and chat with the CEO and COO first. Anything else?”
“No, not for now.”
“I’m glad that you’ve so quickly identified the mismatch between organisation and administration. I can see the issue now that you raise it. It can
be frustrating not being able to write or receive a cheque. I really like this
location risk map. Where’s that from?”
“I read that in order to do an assessment of vulnerability of a site, whether
for security or resilience, you need to understand the direct and indirect
effects of an event at the location in question. I discussed this with Scott
and came up with this.”
“Oh, good. I’m glad that you’ve got him engaged on this. He’s very talented and, frankly, underemployed at the studio. He can be a little odd at
times and talks in phonetics, but is harmless and will give you the shirt
from his back if you asked him for it.”
Whiskey,Tango, Foxtrot. Of course. How could I be so dumb?thought Marianne.
“Well, is there anything else?”
“No. Thank you, Andrew.”
“Good. Well done again. I think you are probably tackling this in the
right way. We will need to have something for the board by May. Can you
achieve that?”
Marianne felt exhausted and sat back down in the meeting room when
Andrew left. Now what? How on Earth did she get into a situation where
she was sorting through her new employer’s dirty laundry using a process
that she didn’t fully understand? It was dark outside and definitely time to
go home.
DISCUSSION POINT: Understanding how a site can be
directly and indirectly affected by an event is an extremely
useful planning tool. How might you use this to inform your
approach to the operational resilience of the site? How would
this influence your design of a new site?
Outside Opinion, April 9
In which Marianne develops Location Risk Assessment traces,
explores the consequence concepts of shock and stress, learns
about the relevance of essential functions to the survival of an
operation and its recovery, and is introduced to the practices
of causal chain analysis and malicious threat assessment.
When Marianne got to her desk the next morning, she found a book
laying on her keyboard with a spider scrawl of a note from Graeme. “Have
you read the Grosvenor Report?” Marianne had no idea what that was.
The book looked interesting, though. It was called The Edge of Disaster[1] by
Stephen Flynn. She sat down and started to flick through the pages, scanning or reading a paragraph every once in a while. She would definitely
read this through carefully, perhaps during her Calgary flight. She fired up
her computer and wandered off in search of a coffee.
Marianne typed “Grosvenor Report” into Google. Graeme must have
been referring to the Grosvenor Resilient Cities Research Report,[2] which
she opened. It was published just yesterday, and points to Toronto as the
most resilient city, globally. The authors haven’t visited, clearly. Marianne
looked at the Grosvenor website to discover that they are quite a sizeable
and established property developer. She turned back to the report and
began to read. Anyone with that sort of standing would be careful what
they publish, she figured. It deserved a closer look. The definition and
parameters of resilience were different in this report to all that she had
been reading so far. But are they really? She had focused on infrastructure
and operations, whereas the Grosvenor report was looking at economic
resilience and confidence for long-term real estate investment. Resilience
is most definitely multi-faceted and she would need to be careful not to
pre-define parameters or influences. It also called to mind that relationship between municipality and infrastructure. Equilibrium.[3]
This time Google was a dead loss and only showed her links to a disturbing sci-fi movie. Finally, she found references to it, but nothing descriptive.
She would suggest to the beard at the CRCI that he should write a paper
on it. What was his name again? From what she could ascertain, it appeared
that the argument went something like this:
Sustainable economic development is the prime motivator for municipalities, regions, provinces, and the country. Per the UNISDR report[4]
from last year, resilience is a pre-requisite for sustainable economic development. The CRCI research and apparently similar work at the École
Polytechnique in Montreal and Argonne National Laboratories near
Chicago argue that resilience is not a deliverable in and of itself. Because
economies are complex systems, as the municipality develops, so does its
resilience — if resilience has been incorporated into its strategic plan. Being
resilient allows you to attract the best because people perceive their work/
assets to be safe. Attracting the best means that there is greater economic
potential and stimulus, and hence growth. Actively planning for resilience
instills confidence in the population and allows you to respond, thereby
influencing people to stay and rebuild. Potential depopulation is the real
fear and can entirely prevent recovery. The carrot is sustainable economic
development and the stick is the risk of depopulation.[5]
The economic development of municipalities is enabled by the infrastructure that supports it. The regional utilities and service infrastructure
enables the municipality. The municipality depends upon this infrastructure. However, the municipality places demand stress on the infrastructure
in the form of electricity rate caps that limit maintenance and reinvestment, changing distribution demands and patterns of use. In effect, it is a
parasitic relationship and needs to find a balance. This balance is equilibrium. How to achieve it is through understanding. This understanding is a
common resource irrespective of municipality size and therefore requires
common access. In effect, there is a commons that needs to be governed.
From Elinor Olstrom[6] we would say that the province should enable the
resource users to share and manage the common resource. The nature of
the understanding is how municipalities rely upon the infrastructure and
the consequences of loss or compromise. It is also about the nature of the
demand stresses that municipalities place on the infrastructure. If we look
at the Ontario infrastructure as a whole, the relationship that the GTA has
with the infrastructure is influenced and affected by Barrie’s relationship,
Kitchener’s, Hamilton’s, Oshawa’s, and so on. It is this collective understanding that allows balance to be achieved. Since the driver remains economic development, it makes sense that the enabler should be controlled
by economists at the cabinet office or treasury. If a department is the agent,
there will be a natural bias to that department’s portfolio.
Municipalities do not experience shocks.[7] They experience stresses that
combine or which accumulate over time, if incorrectly managed. Detroit is
a good example.The population of a municipality does not suddenly fail or
die. Infrastructure does suffer shocks – but power lines come down, dams
breach, and so on. This shock is translated to the municipality as stresses.
Areas of the city might be without power or water. The city in turn translates its stresses upon the infrastructure. If the relationship is unstable, this
cycle will quickly deteriorate. However, when the relationship is stable, the
cycle is quickly controlled and both are able to recover promptly.
Returning to the particular issue confronting me, how does this affect the studios? In
many ways, the studios are like small simple communities or municipalities,
which need to understand their relationship with the infrastructure and
their environment. In effect, they need to know how hazards can affect
them – directly and indirectly — and the location risk maps will provide a
large part of that. They need to understand their context generally, including how they fit into the fabric of the community and the infrastructure.
They also need to know what they are susceptible to, a developed risk
profile one could say, and be provided a framework solution that they can
adapt to suit their own culture and organisation.
Marianne decided to develop two products. One would be a generic
framework that provided the means to manage a catastrophe and recover
from it. The other would be a detailed risk context report that would
inform the studios of the risks that they face and how their operations are
affected. She would focus first on the generic framework and have Scott
develop the location risk maps for each site before developing the studiospecific risk context reports. She went through the all-hazards documentation for each region, discovering that California’s is far better developed
and of a far higher quality than anything else she found. Strangely, Canada
was consistently good across the country, whereas the US was a complete
mix. By lunchtime, she had identified the main natural hazards for each
studio and passed them to Scott. That would keep him occupied for three
weeks – two and a half days per site for all the utilities layers, etc, for all six
cities. He would be happy with that.
Framework. Starting with the sequence of an incident,[8] she could assume
that the normal level of operating performance of an organisation is PN.
An incident occurs and the performance drops to or close to zero. Let’s
say that the incident happens at time tO. The organisation must react to
get back to that essential functionality that she looked at earlier. This is the
Minimum Operational Capability, PO, and represents the most basic level
of functionality if there is to be any recovery. Below this level, the operation and organisation fail. The organisation has a time tolerance associated
with how long the essential functions can be interrupted, t1. It means that
the Reaction must be complete within this window, which suggests that
it must be generic and not situation-specific, automatic. This is necessarily
followed by a situation-specific response and therefore requires informed
decision making. This information therefore needs to inform those decisions and the Risk Context Report is the means to do that. The response
is successful when it achieves the Minimum Sustainable Capability, PS. This
means that the operation is self-sustaining and the organisation can survive.
Once again, it’s known from the dependency analysis that the organisation
can tolerate, at a macro scale, a maximum period of performance below
this level, t2. The generic description of these tolerances uses the parameters RPerfO and RTO. These are very different from the IT versions.[9] In
resilience planning, RPerfO is the Recovery Performance Objective,
specifically the minimum performance to enable recovery. RTO is the
Recovery Time Objective, namely the maximum time before the RPerfO
can be reached in order to enable recovery. There really ought to be other
abbreviations, thought Marianne. So the Planning Point/Requirement
in the Incident Sequence is the macro, or organisational, RPerfO and
RTO. That is, the point at which recovery can begin post incident. From
this point on is the recovery. The recovery process is a predefined strict
sequence of actions that restores the organisation to at least the operational
levels of performance existing prior to the incident. Often the resulting
performance is higher than originally existing because in going through
a strict recovery process, many of the inefficiencies that existed previously
are simply lost, resulting in higher performance.[10]
The question of how long an organisation can continue before commencing recovery is a challenge. It is influenced by market expectation,
shareholder interests, and the situation with respect to the organisational
objectives. Following 9/11 in New York, there was a general acceptance
amid the shock that pervaded the entire city and nation that two weeks
below capability was reasonable. Even financial institutions paused, and
Wall Street operations closed for seven days. When Superstorm Sandy
occurred, that tolerance had decreased to a matter of days, despite the
direct and indirect losses far exceeding 9/11. Public and market expectation in North America is rapidly aligning with European expectations of
a return to business the following morning. In effect, if an organisation
wishes to retain market share, it will have commenced recovery by 8 a.m.
the following business day, if not before. For financial and international
institutions with round-the-clock trading, this can mean that the incident
must be regionally contained and the recovery commenced by 8 a.m. the
following business day. Anecdotal evidence from Europe during the floods
in Germany in 2013 showed that spark plug manufacturers had to have
commenced recovery within two hours of flooding affecting their factories or risk losing the just in time deliveries to engine manufacturers. It is
indicative of the contextual pressures on organisational RPerfO and RTO.
Marianne opted for a firm RTO of 8 a.m. the following business day. In
the worst case, that would mean eight hours. So what?
Marianne then phoned New York to speak with the security principal.
A former US Marine, Mac was refreshingly straight down the line and
said up front that they had got their studio planning badly wrong. They
had followed the protection and security mantra, feeding false positives
into the inadequate operational continuity plans, and HR’s BCP. He added
with total candour and no trace of irony that neither the managing principal, nor the profession, nor the city had much interest in changing their
approach. “The feds have put $10Bn into the pot to prevent this scale of
catastrophe in the future and all the different stakeholders from energy to
transit to the Port Authority are arguing about the priorities for protection, and no-one appears to be asking how we feed the city after the next
catastrophic flood. We could do with some of the same thinking that kept
Goldman Sachs functional throughout.”
It was that perception thing again. Cognitive dissonance. Marianne made
a mental note to look more into how to influence perceptions and finally
managed to steer the conversation back to the original subject of her call.
“John, err, Mac, I was wondering if you could help me. How do you assess
how bad a terrorist threat can realistically be?” She had read about risk
assessments that ranged from something the beard’s preschool daughter
could devise to complex models based on influence, access to technology, access to resources, logistics support, local support, ethos and doctrine,
actors, access to the target, and an intelligence apparatus. She could see
why so many simply deferred the analysis to the RCMP / FBI, preferring the relative ignorance. However, doing a general assessment must be
invaluable for understanding how one terror or crime threat can manifest
itself. How else would you do the assessment of impact on the operation
dependency network – what was it called again … Causal Chain?
“It’s Mac. Well, that can be a little challenging,” he began. “There is no end
of advice that stops just short of being actually helpful. The basics are that
you look at the regional capability and the relationship between known
adversaries and those holding the technology, resources, and finance. That
defines their potential capability. You blend in actual support by the local
population, logistics, a control network, and some poor fools willing to
sacrifice themselves, and you have it. It is extremely rare for the perpetrator
not to be caught and many are seriously injured in the capture process.
Whether you die in the act or rotting behind bars is a moot point. The
principles are the same for organised crime, though most is unplanned and
opportunistic or about a gangland show of balls. Who’s the biggest cock
in the hen house, that type of thing. The real value of these assessments
is that in analysing how a threat manifests itself, you are able to calculate
travel times, indicators to inform readiness, and trigger events for response
or intervention.”
“I was meaning to ask you about travel times and how they are used to
inform KRIs.”
“Oh, that’s straightforward. I’ll send you some studio guidance notes to
inform a security integration plan. Ahh, here you are on the system. Good,
I’ll send them through this afternoon. Good luck with the project.”
Marianne thanked Mac and they chatted some more about Alexandria
before hanging up. He used to live in Alex, when he was instructing at
Quantico and then later as a contractor at Fort Belvoir. They were both
admirers of Chadwicks[11] and the Old Torpedo Factory.[12] Marianne
though it curious that her tastes should coincide with someone almost
twice her age. Perhaps she was getting old before her time. She put it down
to the company she had kept in Alex, and in particular her boyfriend.
Just as well that’s done with, she reassured herself and looked through the
window at the gathering darkness. Another day gone. She had yet to get
used to the shorter days in Toronto. It was logical and really not that different to Alex, but somehow seemed to catch her unawares. She wrote up her
notes and began filling in the gaps in her studio resilience assessment to-do
list, grandly marked as ‘Studio Resilience Plan’ on the folder.
Marianne shut down her computer. She decided to leave her briefcase in
her desk drawers tonight, as she had no intention of taking any reading
home. She turned south out of the studio building towards Adelaide Street
and the Copacabana[13] to meet her brother for dinner. She was early, but
the restaurant did excellent cocktails, her brother had assured her, and she
deserved a well-made Manhattan.
DISCUSSION POINT: How and why would public opinion,
the market, be so influential in deciding the planning parameters for operational resilience? Can you think of instances
where public opinion would be less forgiving than actual operating constraints?
Demand & Dependency, April 10
In which Marianne develops her understanding of the incident
sequence and operating performance management through
and in the recovery from a catastrophe, determines that the
Resilience Assessment must be in two parts to reflect the
different organisational structures of the firm and the studios,
and learns about demand and dependency management.
As she enjoyed what turned out to be a very fine Manhattan yesterday
evening, the studio resilience framework kept imposing itself on her
alone time. She hadn’t been able to formulate quite what the issue was.
Her brother arrived and they went to their table for a fabulous evening
of excellent food, wine, and entertainment. This morning, the fog had
cleared and it all became very clear. If the organisation has an RPO and
RTO, as do the essential functions, so must the component equipment that
enables those essential functions. That might be because they have long
restart periods, like aluminium smelters, or because the consequences of an
interruption are serious, such as a ventilator in the operating theatre. She
stepped off the streetcar, wrapped her coat a little tighter about her, and
stomped to the office. It was definitely an office today and not a studio.
By the time she was at her desk, she didn’t wait to start her computer
or even take off her coat as she started to sketch her ideas. They didn’t
really make sense at first, but soon she arranged the equipment into three
generic and arbitrary groups: critical, important, and routine. Against each
item she drew a horizontal bar denoting time tolerance of interruption
and annotated at the end the percentage performance that would constitute Minimum Operating Capability, PO. She stylised the bar chart to represent a curve that went through each bar end. That would be the general
relationship between the various equipment.[1] The critical section would
be provided an instant stand-by power supply, the important could tolerate
an interruption, and the routine didn’t matter in an emergency. This made
sense to her, but the real question would be one of scale. How practical
would it be for the critical equipment to be on a separate circuit that
would have an Uninterruptable Power Supply (UPS) and stand-by generators. What if the studio felt, unhelpfully, that everything was critical? Would
it even be practical to separate circuits? It had also occurred to her that
some people are more important to the firm and the studio than others.
Some represent actual capability, whereas others are simply capacity and a
few were undecided on what they contribute.
She had only been at the firm a couple of days and she already noticed the
same water cooler loiterers. They’re everywhere. How would the Toronto
studio function if Andrew was knocked down by a streetcar? The only
person with remotely the knowledge and reach is Graeme, but he’s closer
to using a catastrophe as an excuse to take an extended coffee break than
go into hyper-drive and get the studio on its feet. There was no logical
alternative to Andrew, or for that matter a successor. She couldn’t see the
other principals getting dirty. But then, the principal in charge of the
incident should really focus on the response phase. After all, the reaction
phase is supposed to be automatic. That meant they would need three
key people in the studio – Andrew, an alternate for when Andrew is not
around, and an administrator who coordinates all the automatic activity. A
design studio, functions on data and overwhelmingly IT. That is the critical
resource. It isn’t even the staff. They’re just important. The data and access
to it are critical. Therefore, the top studio priority is safeguarding the data
and that has to be the reaction phase priority. Of course, she couldn’t’
really tell the staff that they are less important than the data they are processing, so she would dress it differently. I therefore need to know in priority:
how vulnerable am I to telecom and power failure, staff travel interruption, and
inadequate and unsafe working conditions. I need to develop those location risk
maps further, thought Marianne.
The plan was simple. A continuity framework for the equipment; an
outline framework for the firm resilience; and an outline incident framework for the studios. No pressure. No rush. The last of these was probably
the easiest to tackle with what she knew, so that’s where she would start.
The Studio Incident File was a suitably descriptive title. It said everything
and nothing. It needed to be simple to reference in a hurry. Therefore,
she’d split it up into four sections: Preliminaries, Studio, Communication,
and Personnel. These appeared to capture all that Andrew and his helper
would need in an emergency. Besides, calling something an Emergency
File sounded far too dramatic. Marianne laid the sections out like this:
At-a-Glance Cover Sheet. One page summary of five important telephone numbers, alternative locations, who does what, and
what decisions are needed when. Perhaps have a wallet version
for all staff.
Preliminaries. Expanded at a glance.
Distribution and latest update. Allow for staff changes, etc.
Most important telephone numbers – principals, board,
admin directors, key staff, alternative facility. Fire, police,
EMS, a reliable coffee shop. Insurance. Clients.
An outline action list for the studio staff and the firm.
Studio. How the studio functions.
Insurance documents – scan, notification procedure, and
points of contact.
Bank accounts – bank account details. Instructions on
what to do if no processing through Calgary with details of
discretionary spending. Alternate forms of running accounts
locally in extremis.
PROPMAN – building owner / manager contact details.
Summary of emergency provision in the event of a power
failure or so. Summary of emergency procedures.
Alternative Facility – details of where alternate facility is,
who will work there and how will it be set up. Points of
contact etc.
Data – backups, RPO/RTO by function, remote access
Communications. Media, internal, actual and clients
Firm Media Strategy – who will formulate, policy statements, studio responsibilities, coordination. We need to own
the event and be seen to be proactive.
Telecom and Networks – voice communications systems and
back-ups, data communication, videoconference streaming,
and alternatives.
Clients – consolidated list of clients.
Personnel. Who, where and situation. If no firm email or
phones, contact details to advise on situation. If staff on the far
side of a flooded area or riot, we need to be able to say don’t
come in or go to alternative location. We should be able to assist
with transport coordination when transit doesn’t work.
This would make a good framework once she populated it with the
right information against the Incident Sequence phase requirements.
The reaction measures would need to cover off the worst case and most
likely hazard effect scenarios. Therefore, the Risk Context Report should
provide an All-Hazards effects summary without the detail or analysis – that
would just confuse the studios. It needed to give a clear and unambiguous
assessment of risk. For example, the plan would need to be able to say
where the managing principal should look for an alternate facility and
what would be needed to physically make the studio systems more robust
so that he could make an informed investment decision on what to do.
The next one was the firm level resilience framework. The firm needed
to enable the studios to be capable of operating for a period of time independently, because that would allow the firm to contain the effects of a
catastrophe locally and hence enhance its survivability. So, the firm would
need to delegate some administrative functionality, for example, IT staff in
each studio would need to be able to reconfigure servers, if they are to be
able to relocate to an alternative facility. The bookkeepers in each studio
would need to be able to process cheques and Electronic Funds Transfer
(EFT) locally and so need local bank accounts. They should also be able to
process and authorise expense payments and billing notification to clients.
That would likely be a manual stopgap rather than rolling out additional
software. They would need to continue proposal writing, as that was
always a multi-studio effort. There would need to be a separate back-up to
Calgary. It was all very well each studio backing up in Calgary, but where
does Calgary back up all of its administrative databases and systems, including VOIP and smartphone servers? They should use either Chicago as a
double act, or better, an off-site data centre. It would need to consider how
each studio communicates with the mother ship and the robustness and
alternatives to these links. They would need to inform this with the AllHazards, but as with the studios, restrict this to the output of worst case and
most likely. Marianne decided she would need to address the succession of
personnel and corporate retention of capability. The firm needed to have a
back-up principal policy and perhaps a more robust succession plan – wait
for the chairman’s comments. They would also need to blur the disciplines
between studios. Principals can and should be technical leads and would
naturally have a dominant team in that discipline with them in that studio.
However, a studio should be able to continue the basics of architecture,
structures and electrical / mechanical within each studio. It was probably
best not to do that at the principal level; better at the associate level. All of
this would help to structurally align the administration to the organisation.
One last thing – a communications policy and strategy that aligns with
the firm’s strategic plan. Each studio will know where they fit in that and
be able to play accordingly. It will present clients with a common voice
and could present an opportunity for the sort of well-managed press that
attracts the right client interest.
Marianne now began to run out of steam. She looked at the page, wrote
‘equipment’, and drew a complete blank. This was the sort of blank that
even a coffee would not be able to cure, though she’d have one anyway.
Time to explore, she thought. It’s half an hour to lunch, so might as well go early.
She headed east towards Bay Street and Queen, turned south along Bay
and went in the Gabardine.[2] She got a single table beside the wall close
to the window, and ordered the special. She pulled out her notebook and
began to doodle.
Each equipment had a demand and a dependency characteristic. She
recalled in one of the conference proceedings or presentations that she’d
scanned, there was a case study on a supermarket in the West End that
suffered a dramatic mid-summer power outage in 2010.[3] The temperature
was in the mid-thirties. The supermarket had a stand-by generator that
was rated for the whole load. Few in Toronto take stand-by systems seriously – it’s that perception again that bad things don’t happen here – and
the generator was either badly maintained or the staff were unfamiliar with
it. Either way, it failed to engage and chilled produce went beyond the
food safety guidelines. Poor reactions and responses by staff compounded
the issues. The net result was that just in time deliveries were redirected,
produce was thrown away, a deep clean was needed, they had to restock,
and they suffered lost business. Apparently the Queen was with the Prime
Minister in the Royal York Hotel at the time and continued their state
dinner despite the power outage. So, some are able to cope in this city.
Anyhow, they looked at the demand profile and found that the essential
power demand could be met by alternative power sources, even allowing
for seasonal adjustment. These included photovoltaic, wind, and a smaller
generator that staff would find easier to operate and extend the life of
the existing fuel supply. If the supermarket then included some energy
efficiencies and separation of essential functions, they could for much of
the year run at routine power loads off grid. Marianne wondered if this
could be applied to the studios. She put her pen down and focused on
her food. Still wrapped deep in thought, she paid and walked back to the
studio via a detour across Nathan Philips Square. This was a fabulous place
to go skating in winter.
Back at her desk, Marianne sat staring at her computer. There were emails
from Andrew and the chairman and two from the CEO. Hmm, I’ll get to
those later. It’s best to get this stuff clear first. She was sure that she had a way
forward and the information was starting to come in. She decided to brief
Graeme. Talking something through often helped free up those thought
fragments and get them properly connected. The priority had to be the
firm level resilience assessment, though the studio level seemed more
attractive to her. She collected her ideas, sketched them out on her layout
pad, and went to brief Graeme. It was going to be a long afternoon.
DISCUSSION POINT: Marianne considers the separation of
firm and studio important. Would you agree, and why? How
else might you approach this problem?
Analysis, April 11
In which Marianne develops the business case for a
resilience strategy by modelling the investment analysis
for resilience measures against the cost of loss.
Yesterday afternoon, Marianne had discussed her progress with Graeme.
She now had all of the information that she needed to get started. Over
the course of their discussion, Graeme had become increasingly interested in where the logic was taking them and he suggested capturing this
logic train as a short, one page briefing note to the CEO and managing
principals. He explained to her that no one in a position of authority or
responsibility appreciates a surprise and certainly not on something that
so fundamentally affects the firm. “Send it to the CEO and discuss with
him over the phone. Then send it to the studios,” he’d advised. Marianne
felt that was a sound piece of general advice and drafted an outline after
their meeting. When she emerged from Graeme’s office almost two hours
later, she had a couple of minor epiphanies. The equipment question was
complicated by the statutory compliance and standards applied to each
equipment and system. This meant that there was neither a standard level
of protection applied to each equipment, nor a common demand tolerance. Therefore, she would need to look at grouping the equipment by
reaction, response, and recovery measures. For example, her critical group
would need to have an automatic fail-safe to bring them all to the same
effective tolerance. UPS could do that, but would need to extend beyond
the alternative power supply activation time. In part, this provided a buffer
for problems, but more specifically it meant that one can build the load
gradually and by priority. Therefore, the UPS coverage would extend to
some of the important equipment, while the alternative power supply
would take on the more important equipment first and then bring the
critical ones on. This would also mean that the critical equipment with
lower tolerances would generally be more sensitive to power spikes and so
better to add once everything was stabilised. That pretty much made sense.
The other epiphany was that because diesel oil has a shelf life within
which it needs to be used, and the stock rotated. If the catastrophe hits
on the morning of the next fuel delivery, we would be starting with, say,
20% less reserve. Also, they couldn’t use the last 5% due to contamination
and water. Finally, unless their company was the priority for fuel under the
municipality’s emergency procedures, they wouldn’t’ get any more diesel.
That was probably why so many were converting to gas-fuelled stand-by
generators. Something to ask the beard for clarification.
That morning, the questions and what she wanted to convey in the briefing note had crystallised. She went to see the beard on her way to the
studio. He was in something of a rush, but answered her questions and
she returned to the studio to put it all together. He also pointed out that
the protection effect of compliance measures on individual equipment and
systems did not matter if they were considered collectively. All systems have
some level of inherent protection against the routine background level of
stress, which he called Phi Beta [Фβ]. The collective protection provided
by the compliance measures that may or may not contribute to the overall
resilience, Phi Alpha [Фα]. The cost of routine protection is therefore Фβ
- Фα . This makes the cost of risk treatment easier to capture and directly
representative of its contribution to loss reduction and recovery. The challenge is that compliance measures are usually introduced because of some
major failure in the past and this measure is supposed to prevent a recurrence. The problem is that sometimes these measures impede the efficiency
of the operation and even the ability of the operation to recover. Marianne
had a living dread of algebra and talking Greek symbols brought back the
schoolroom angst, which she thought that she suppressed reasonably well.
“You’re looking a bit peeky, there,” the Beard said in parting. Clearly she
wore childhood angst more openly than she thought. However, it was
useful to know that her approximation of critical equipment was not only
reasonable, but spot on.
Marianne stopped by the architecture students’ coffee shop on her way
to the studio, but it was closed. She supposed that the unpredictability of
opening times was the compensation for serving such awesome coffee.
Consoling herself with a Starbucks, half of which she ended up throwing
away, she strode happily to the studio, her mind bursting with great ideas
and a renewed energy. At her desk, she opened a fresh sheet on her layout
pad and revisited her equipment sketch. She noted the fuel tank requirement for the running time needed. She then went back to her notes on
the firm-wide resilience framework and began filling in the deductions,
conclusions, and actions. By lunchtime, she had finished her analysis of the
firm’s resilience requirements and pushed her chair back from her desk.
She starred at the ceiling and spun idly round with her legs tucked under
her seat when a voice interrupted her thoughts.
Ben introduced himself and explained that he worked a couple of workspaces along from her. He asked if she was interested in joining a few of
them for lunch. They had a Friday lunch group. Feeling more than a little
self-conscious at being caught by a colleague while she was reliving her
pre-teens, she could only nod and smile nervously. Ben laughed.
“Oh, thank you. I’d love to,” she managed.
“We’re going in five minutes or so for dumplings.”
“Okay, I’ll be ready.”
The briefing note could wait and this would be a great way to meet her
new colleagues. It occurred to her then that she hadn’t actually met anyone
in the studio outside of those directly involved in this project. Had she
really been that absorbed? There were forty-five people toiling away in this
studio and she had so far only really spoken with four of them.
As it turned out, the Friday lunch group was a gathering of six architects
who planned their week around ramen noodles, dumplings, and something
different once a month. Last week, they had ventured as far as the Rex[1]
on the corner of St. Patrick and Queen for burgers. They were still talking
about them and Marianne made a mental note to try it. This time, they
were going to Lee Garden,[2] a Toronto Cantonese institution on Spadina
south of Baldwin. They were a delightful group and Marianne quickly felt
at ease with them.
Taking far longer for lunch than she had intended, Marianne resumed her
work on the briefing note as soon as she got back. She finished just in
time for her progress meeting with Andrew, which he had requested by
email last night. She brought him up to speed, sensing as she spoke that
Graeme must have already briefed him in outline. She then showed him
the briefing note and waited until he’d finished reading it. Apparently satisfied, he simply restated his earlier demand that all measures be accompanied by overall cost estimates and an NPV[3] that takes the risk reduction
into account. Capturing the residual risk would be the challenge with this
one. Nevertheless, she decided to put together what she had and take it
from there.
Thankfully, many of the recommended firm-level resilience measures that
she’d identified were simply administrative functions, processes, and delegations. They fell within the studio level discretionary figure of $5,000.
She decided that these wouldn’t need to have their own NPV calculations,
particularly as the total combined cost of these measures was $11,575. The
difficulty would be the data and server backup. There was no simple or
obvious solution. Each option was going to cost a large amount of money
and take time to implement. Like most companies, the firm used a system
of evergreening[4] their IT, which was really little more than preventative
maintenance and routine upgrade. Marianne decided that for any of the IT
options to be viable, they would have to maximise the existing evergreening process.
Marianne had identified that the greatest issue facing the firm was access
to data, and this meant where it was stored and how it could be accessed.
She had options to virtualise the servers and so spread the data between all
studios, twin studios to back each other up, and centralise in Calgary with
a replicated site in the Chicago studio that could be activated in the event
of another Calgary failure. The real problem with each of these is that they
still relied on a studio to studio communication system.While the firm had
invested in several fail safes and alternative channels between the studios,
there were still problems with videoconferencing and large data back-ups
each evening, and during the Calgary flood everything was compromised.
She found herself coming back to renting space at a data centre. The
idea was that all the administrative servers would be run out of the data
centre and each studio would back up data to it each evening. In so doing,
Calgary would become an administrative hub without also being the data
hub. If each studio was going to be capable of administratively functioning
on its own for a few days, this would mean that they could access their
data routinely even if the communications links with Calgary were down
or the studio was under water. She decided to give the problem to the IT
director and phoned him to explain what she was thinking.
The phone call turned out to be her first introduction to corporate inertia.
The director made it clear that she didn’t know what she was talking
about and he had personally verified that what happened last year couldn’t
happen again. In fact, the system would have worked perfectly last year
if they hadn’t been going through a system upgrade when the city was
flooded. He simply refused to believe that there could be anything that
could possibly improve the system that he had built and developed. The
call ended without a result. What now?
Marianne prepared the case for a data centre and explained why each
of the alternative options were no good. The argument didn’t look that
compelling on paper, when it had been so clear in her mind. She did a
SWOT[5] analysis, but that didn’t really change things. She needed something that could fix this to real times, people, and places. She phoned Bell
Canada and was finally put through to someone who appeared to know
about data centres. He explained that there is a data centre just outside
Calgary that had been built to Department of Defence specifications,
but was now available for commercial use. The prices for set up and then
rental seemed steep, but she supposed they were par for the course. Armed
with the facts and figures, she then phoned her brother to see if he could
recommend someone who understood something about data centres
and communication networks. Predictably, he did. Marianne followed up
immediately and arranged a phone call later that evening. She then captured the studio costs by the day of the data system being down and the
captured cost to the firm overall from the outage last year. She then put
together a time schedule that showed the working periods of each studio
to identify the time available for equipment and functional transfer to a
data centre without disrupting routine operation. Then she phoned the
datacentre expert.
She wasn’t terribly sure if she had learned anything from the call beyond
that the process seemed based in common sense. He gave her typical transfer times for moving and setting up a server in a data centre. She didn’t
realise that you have to do it yourself. Some things need to be reconfigured
and others don’t. He suggested transferring the administrative functions
first, then the databases.
Marianne added this information to her calculations and reasoned that the
transfer to the data centre would take around three months of effort if
routine operations were to be unaffected. Of course, this meant mainly
weekend working and didn’t include public holidays and other downtime.
She decided to recommend a five-month transition period, which would
also allow testing and confidence as they went along. She found that the
loss to the firm arising out of the last Calgary flood was several times the
cost of renting the data centre for a year. Even allowing for the insurance
payments and the reimbursement from their landlord, the cost of running
the data centre was still about a fifth of the net losses of that one event. The
question was, how often would that sort of event happen? Also, how much
did other data interruptions at other studios cost, which would have been
mitigated by having a data centre. Marianne decided to break this down
into three parts.
From the all-hazards data that she had collected, she was able to ascertain
a trend in flooding and precipitation that was distinctly upward, reflecting the rise in global temperature. The predictions are that this rise will
continue and precipitation would be more deluge like as a result, causing
greater surface flooding incidents due to increased run-off. The relentless
development of the Bow River and Calgary don’t improve things much.
Marianne decided to be conservative and took the estimates of what last
year’s flood revised return period was. Several references had opinions,
none the same, so she took a mean value of thirty-six years. She then
looked at the concentration of value and projected increase in business
from the firm’s latest statements to the board. She reasoned that the consequence of loss would be roughly 5% increase above inflation each year.The
firm’s current strategic business plan was set out to a five-year horizon, so
she would use five years for her NPV calculation. From all of this, she
was able to add up a value for the risk reduction. Last year’s event cost of
loss divided by thirty-six, which she took as her datum. For each year, she
calculated a value to reflect the projected growth and assumed an inflation
rate of 2%. Lastly, she wrote down the set up cost and five months rental
over the set up period as the Investment. Against this, the rental at the data
centre was calculated as an outgoing each year, which she assumed would
go up in line with the same 2% inflation.
Next, she went back to the disaster database and extracted every incident
that caused a power outage over the preceding twenty-five years. For each
incident, she checked to see if it lasted more than four days. If so, it was
recorded as a six-day interruption to the power grid as an initial estimate.
For all other interruptions, she did an internet search of the Calgary Sun
to see reporting of the incidents. In fact, the outages associated with these
interruptions were far greater and she ended up investigating each event
from the disaster database. She also discovered that Calgary had similar
flooding in 2005. The firm had been similarly affected to 2013, but the
consequences weren’t as severe because the dependency on a centralised
IT system had not existed. Then, it was purely data backup. When she
aggregated all of these events, from floods to ice storms, she had more disruption days than last year’s catastrophe. She would check each one against
the company records on Monday.
Finally, she did a similar trawl for events that caused power outages and
similar interruptions at each studio location over the last twenty-five years.
This data was simple to gather for the Canadian cities and San Francisco,
but she simply failed to find reliable information for Chicago and New
York. Fires featured more often than she’d supposed, as well as major
blackouts like 2003. Gathering all of these events into a list, she found that
she had close to two hundred events to check against the firm’s records.
She wanted to know how the firm’s cash flow was affected and of any
associated insurance claims.
First impressions suggested that she’d have a compelling case to present to
the CEO and hopefully the board. She was entering the belly of the beast
on Monday and she’d ask then. It made her think more widely about what
she was going to ask the directors and c-suite when she saw them. The
administrative directors had not been all that helpful so far, though that
would be the sensitivity that she’d been warned about. Whatever she did, it
would have to be something that they can own, even present as their own
ideas. That would be quite doable, as long as those ideas were what they
were supposed to be. Marianne could lay on the charm like no one else.
She felt sure that she could win them over. She collated the framework
measures and her notes on the data centre with the Calgary flooding and
power outage consequence map. Upon reflection, she also picked up her
working file. It went against her instincts to take her core notes with her,
but she still had work to do to prepare for Monday.
Once again, hers was the last desk light still on and the rest of the studio had
disappeared for the weekend. She must seem the most pathetic individual
to her new colleagues, with nowhere to go in the evenings or weekends.
Then again, they might think that she was impossibly driven and keen.
She got the distinct impression that she was taking life more seriously than
the other girls in the office and was probably the only one not attached.
That marathon chat with her mother had given her a taste for some girl
company. She’d missed it and now wondered if any of her old friends had
plans for the weekend. Of course they did. Besides, wouldn’t it seem odd
if she only called them a couple of weeks after arriving in the city. To Hell
with it all, she said to herself. As she shut off her light and computer, she
consoled herself with a relaxing weekend at home being cooked for by
her mom, and preparing for Calgary. “What will I wear?” she said aloud
suddenly, as it occurred to her that Calgary would still be positively Arctic.
DISCUSSION POINT: What do you think of Marianne’s reasoning about the cost of loss against the cost of resilience of
the IT systems? What sort of corporate inertia do you think
Marianne will encounter as she presents her findings?
Preparation, April 12-13
In which Marianne identifies the capability requirements during
the routine, reaction, response and recovery phases of an incident
and uses the location risk assessment (consequence) maps to
determine the arrangement of essential function equipment.
Marianne arrived home to an empty house. She casually supposed that her
mother was probably entitled to a life, but it hadn’t occurred to her that
she might actually have one. Of course she did. She’d been an army officer
and travelled the world. This was a woman who could mix it with the best
and come out smiling. It just seemed unfair that she should choose tonight.
Marianne changed into sweats, made herself a sandwich and a plate of crackers
and cheese, and curled up in front of the television with a glass of red wine.
She woke the following morning, stretched out on the sofa with a thick
soft blanket over her. The wine bottle and glass were empty and on the
coffee table with her plate of half eaten crackers. Her mouth felt like the
bottom of a parrot’s cage and she wondered how she’d ended up falling
asleep in front of the television. She hadn’t done that in years. It occurred
to her that she hadn’t been thinking about this infernal project either,
which was probably a good thing. Her mother walked over to the sofa
with a mug of coffee and set it down on the coffee table.
“Goedemorgen,” she said, and cleared the remains of last night’s
supper away.
The coffee smelled wonderful and Marianne managed a small “Dank je
wel.” As she sat up and sipped it. There was something grounding in the
brief exchange in Dutch. She got up and padded to the kitchen, put down
her coffee, and padded on to the bathroom. When she returned, she was
wearing a bathrobe and feeling a little more human. Breakfast was ready
and she sat down with her mother. Marianne had never been a morning
girl and after the first seven years of trying to coax any human interaction out of her, her parents had simply accepted that she needed breakfast
before she could be nice. They sat in silence with her mother casually
leafing through a cookery book between forkfuls of scrambled eggs and
smoked salmon.
“So, what are you doing today, Marianne?”
“I guess I’m getting ready for Calgary on Monday.”
“You didn’t say you are going to Calgary,” her mother exclaimed, closing
the cookery book. “When do you leave? How long are you going for? Is
it for work?”
“I leave tomorrow, but it’s only a couple of days to learn about the Calgary
flood and how it affected the studio last year.”
They chatted some more. Marianne wanted to ask her mother about their
experience of coming to Canada and starting fresh. Somehow, she felt sure
that it was a tale of resilience at a human level. However, she never felt that
it was the right time. Her parents had never spoken of those early years in
Canada and Marianne had always been left with the impression that they’d
much rather forget them. She finally got up and announced that she was
going for a run. “Oh, where is my old parka and cold weather gear?”
“I’ll dig it out, dear. Go for your run.”
Marianne returned to find an old trunk on her bed with winter coats,
scarves, mittens, and toques. It wasn’t all hers. What was hers, she hadn’t
worn since university. She wasn’t going to get any awards for fashion, but
she would at least be snug.
“Sort out what you want to keep. The rest is going to Goodwill,” called
her mother.
Marianne selected a medium weight jacket and a heavy weight coat, a
couple of toques, and a pair of fur-lined gloves. She hung the coat in her
closet and set the rest of her selection on the dresser. She repacked the
trunk and lifted it off the bed. Her mother was clearly stronger than she
thought. She carried the trunk through to the landing and walked straight
into Harry.
“You frightened me. What are you doing here?” So that’s how she got the
trunk down from the attic.
“I’m on my way to the airport to pick up Sandra and just thought that I’d
drop by. How’s it going?”
“Packing for Calgary.”
“Oh, you must’ve been trained in observation,” quipped Marianne and
immediately regretted her tone.
“It’s okay. Saw the weather forecast on the news last night. Rather you
than me. How’s the project going? I haven’t seen or heard from you since
our dinner. That was really good, wasn’t it?”
She hadn’t thanked him for dinner at Copacabana. She felt bad now.
“I’m sorry. I’ve just been, well, distracted. I’m having to learn everything
for this project and my first contact with the administrative directors wasn’t
exactly encouraging.”
“You’ll blind them with facts and that can frighten people, particularly if
they are sensitive about being seen not to understand. Just structure your
argument so that if you are getting negative vibes from them, you can
adjust the tone and meter to suit. Brief the case to the bosses first and they
will then be seen to be knowledgeable and own the project when it comes
to the full briefing and implementation. If they’re smart, they’ll engage
pretty quickly so that they can take credit for finding the solution. If that
fails, just tell them that I said you’re awesome and that they should listen to
you. That’ll work.”
Aside from being awesome, Marianne didn’t particularly like the sound
of this. She didn’t want to burn bridges in her second week in a new
company, though it was already clear that in one way or another some
blood would be spilled in this project. “Perhaps. When does Sandra get in?”
“Quarter past one at Pearson. I’m thinking of taking her out tonight,
perhaps the Oxley.[1] It’s just down the road and has fabulous food.”
“She’s been eating out for over two weeks. I suspect that she’d prefer to
have something nice at home with you. Don’t be a dummy. Besides, she
might be impressed if you cooked something vegetarian for her. Something
she likes, maybe?”
Harry looked completely blank and Marianne rolled her eyes. How
he’d ever managed to land the nicest and most beautiful girl in school
was entirely beyond her. He was about as attuned to the female psyche
as a spanner. Men! “How long have you lived together? You don’t know
what she’d like? Really?” Marianne dumped the trunk in Harry’s care and
turned back to her room with a “harrumph!”
Marianne sorted a few clothes out and made a note to get a few things
from the Shoppers around the corner. She went downstairs to find Harry
and their mother hunched over a vegetarian cookbook humming and
muttering. They looked quite conspiratorial together. “What are we doing
for lunch?”
“Make yourself a sandwich, dear.”
It wasn’t quite what she’d expected, but then, what had she expected? She
suddenly felt bad about having bullied Harry into cooking. Like her, he
didn’t have a culinary gene in his body. Odd, considering that their parents
were keen cooks and had until recently made bread, pickles, condiments,
jams, pasta, sausages, hams, and even butter and yoghurt themselves.
“Your father sends his love. He thinks your project sounds fascinating.
He’ll be back next month and will want to hear all about it.”
“Where is he again? Some big project in the Middle East?”
Marianne would have liked to discuss this project with her father, but she
also wanted to be able to show him what she could do on her own. It
was academic, anyway. She had to present to the board before he returned
home. Of course, he was doing flood protection works and would likely
know something that could help her. Then it struck her. A flood protection scheme was both regional and local. Locally, it affected the routine
of community life. Regionally, it provided a definite level of confidence
against a variable hazard. You had to pick a return period and accept that
an event greater than the flood protection would inundate the region and
potentially prevent the waters from draining. Therefore, you had a series
of essential function provisions that supplemented the flood works. She
recalled her father explaining to her once how the Dutch had changed
their flood protection approach following a major flood in the 1950s.[2]
There is a definite interplay between the regional and local, or in her case
the firm and the studio resilience measures. What is good for one level is
not necessarily right for the other. The firm would hang onto the studio
address in Calgary, but it was in a vulnerable spot. Therefore, remove the
critical assets – the servers and data storage and communication systems
are all being relocated to the data centre, or at least she was proposing that
they be relocated. But, the staff working at their workstations are the core
production means and they would remain in a susceptible building. They
therefore needed to have an alternative site to move to. Relocating, even
in an emergency, takes time, so they would need warning. They needed
leading Key Risk Indicators. Mac had sent those security integration notes
over from New York. They included the idea that you have pre-cursors,
indicators, and triggers. If they knew the time needed to relocate, that
would show the decision point and therefore the trigger with a reasonable
level of confidence. However, the more immediate question becomes, what
functions would need to relocate, and how and where? Marianne went
back to her room to get her notebook and file. She returned a few minutes
later and unrolled the Calgary flood trace on the dining table and spread
some tracing paper over the top. She drew the main highways on the trace
so that she could align it again. She sat back and looked at the map.
Her sudden change in mood and determined actions attracted Harry’s
attention. He came over to the dining table to watch what she was doing.
Meanwhile, her mother let out a heavy sigh and put the kettle on. She’d
seen this trait in her husband and recognised a brainstorm in the making.
Nothing could interfere. She started making sandwiches for three.
“What are you thinking?” enquired Harry.
“We are developing these consequence traces, which show how our
little patch of paradise is affected directly and indirectly by a flood, for
example. This one is flooding and resulting electricity outage for Calgary.
We are doing similar ones for transit and water and sewerage, etc. Once
we combine all the traces, we’ll be able to identify what areas of the city
would be unaffected by a flood, or ice storm or whatever event we chose
to throw at it. The aggregate of all of these events will identify where we
could relocate the studio to in a disaster. As we don’t know what kind of
disaster would hit, we should really have a site that is unaffected by the
identified possible disasters. From these we can identify which staff can get
into work depending on where they live in the city. We are therefore able
to say what our possible emergency operating capacity is. That means that
we need to know … errm.” What do we need to know?
Marianne paused to collect her thoughts and Harry watched silently.
“We need to know what the minimum sustainable operating capability of
the studio is. We know the firm’s, but we need to know that for the studio.
That means that some people will need to be working close to a server,
whereas others can work from home. There will be a typical number of
projects at any one time in the studio, of which each stage will have a tolerance of interruption. Let’s say that contract documents stage is the most
critical and 25% of projects are at that stage. Each project team crunching
through drawings and files will be around five people. So let’s say that there
are four teams necessary, plus someone from accounts, a specifier, some
admin staff, and some principals – say, twenty-eight people. We haven’t
included the firm-level staff yet. These twenty-eight people will need to
have a server stack set up, loom, and both operating and welfare space with
communications. They will need to relocate in a set period of time and be
up and running by 8 a.m. the morning after the disaster hits. What if some
are on the wrong side of the hazard and can’t get in? They could travel
around the city and come in by another route. But the 2013 flood basically
cut off all river crossings for a fair way up and down stream.This is the stuff
I need to ask the Calgary principals. I also need to understand what it takes
to relocate.”
“Looks like you’ve got your work cut out for you.What will you do now?”
“Write all of these notes down and see about collecting them into some
semblance of order for Monday. The data centre move will be critical, as
will delegation of administrative functions, and a succession plan at the
firm level. The critical piece at the studio level will be engagement by the
principals and the administrative directors.”
“Your lunch will be waiting, dear,” chimed her mother, as Marianne quickly
sat down and began scribbling on both the trace and in her notebook.
Harry backed away, kissed his mother goodbye, and quietly left. The twins
and their father were alike when the brainstorm hit and they recognised it
in each other.
Six hours later, Marianne stood up and brought her empty plate and coffee
mug to the kitchen. She had traced out each of the so what strands and
equated the information that she needed for her studio incident file to
the questions she needed to ask of the firm and studio staff in Calgary. She
had been through her deductive reasoning and challenged each assumption. She was broadly satisfied with what she needed to know and it was
simply a matter of how to frame the questions. How direct can I be? She had
also sketched out a mind map of what would be involved in relocating.
Knowing the minimum capabilities, both operating and sustainable, and the
associated time tolerances would be key and drive the reaction plan. The
relocation would need to be meticulously mapped, planned, and rehearsed,
even down to having precut cables and server stack paraphernalia. She had
come across a reference in some of her father’s notes last weekend on planning. It was a simple rule of thumb: If the act of moving a facility takes
x amount of time, in an emergency it will take ten times x. This can be
reduced by 30% by planning to move in an emergency and a further 30%
by predefining the site and requirements. Further reductions would only
be achieved through rehearsals and leadership team workshops.That meant
that with a detailed and mapped plan, it would still take four times as long
to move in an emergency as it does in ideal conditions. That still seemed a
lot to her, but rules of thumb tend to exist for a reason, usually generations
of hard won experience. So, in the worst case, to be functional by 8 a.m.
after a disaster that happens in the evening, the studio has eight hours to
relocate, which means that the ideal relocation will take two hours. That is
tight. Twenty-eight workstations, a server stack and cable-loom, furniture
etc. Some provisions at the alternative site would have to be made and all
the IT infrastructure would need to be pre-packaged and ready to roll. It
also meant that this ready kit would have to include all the workstation
ancillaries, such as cables and keyboards, and that the workstations would
need to be predefined and marked up. How on Earth was she going to get
this past the IT director?
“I’ve booked us a table at Posticino. Make yourself presentable and we’ll
leave in an hour,” called her mother. Posticino.[3] That’ll be nice. She liked the
staff there. It can’t have been open long when she first went, shortly before
heading off to the States, but it had left a really good impression on her.
“Okay. Lovely,” she called back and went up to her room. Perhaps I’ll have
Prosecco with dinner.
Marianne woke early. It wasn’t quite light yet and there was condensation
on her windows that caught the street light from below. She felt good. The
resilience plan for the firm and studios was beginning to make sense and
everything was sort of falling into place. She just needed to finish packing,
enjoy a lazy brunch, and then catch the TTC to the airport. It was a simple
enough plan for the day and yet somehow she remained firmly implanted
in her bed. No part of her body was interested in moving, so she closed
her eyes and ran through everything that she would do in Calgary.
The plan still made sense to her, but she needed to know that the studio
could relocate and that the firm would accept some adjustment to its centralised control of all administration functions. Resilience is a local characteristic, enabled strategically by the firm through its strategic plan and
organisational structure, communications, and processes.
Marianne awoke mid-morning with a start. It was bright and sunny and
she could smell fresh coffee and baking wafting up from the kitchen. She
joined her mother at the kitchen table with the Sunday papers to enjoy
delicious fresh croissants and a huge pot of coffee. Her mother had apparently made jam and marmalade at some stage and these were out on the
table. She wondered casually if her mother had made the butter also, but
thought better of raising it.
“What time are you leaving, dear? Do you need a lift?”
“About noon or so. I’ll be fine with the TTC. It takes roughly an hour
door to door and I’ve only got a carry-on. Thanks anyway.”
“Well, wrap up warm.”
They weren’t great conversationalists. Somehow, they didn’t feel the need
to talk to be comfortable together. She felt far more chatty with friends
and strangers, yet with her family silence could be so comfortable. They
all just rubbed along together, easily. It was good to be home, she thought.
She had missed this quiet comfort, but hadn’t realised quite how much
until now. Finishing her mug of coffee, she went back upstairs to get ready.
Just over two hours later, she was standing in front of a kiosk with Air
Canada staff buzzing around helping all the mortals check in before ushering them to the baggage drop. She wondered if all these self-service kiosks
actually saved Air Canada any money, since there appeared to be more staff
than ever and longer queues with only two baggage drop desks open. It
didn’t affect her and she strolled on to security. She quickly went up to the
Maple Lounge and opened her notebook to begin outlining the questions
that she would ask. She continued on the flight and before she realised it,
the plane was touching down in Calgary. She took a cab to Le Germain[4]
on Centre Street and resumed her preparations. This would be her first real
chance to make a good impression, while also having to challenge a couple
of fiefdoms in the nicest possible way. She reasoned that the only way to
deal with it would be to be as professional and efficient as possible.
At last, she was content with her preparations. She looked at her watch,
which showed half past nine. She adjusted it to local time and went downstairs in search of something to eat. Today was clearly perfect: the hotel
restaurant is Charcut,[5] a shrine to meat and charcuterie.
DISCUSSION POINT: Consider what it would take to move
an operation from one location to another without an apparent
hiccup. Could you move your study rooms to a new location
ready for use by start of tutorials/lectures the next day? What
would it take?
Calgary, April 14-15
In which Marianne discovers the reality of local working
culture and conflicting interests that can impede the
implementation of a layered resilience strategy, and receives
unexpected support from Information Technology.
Marianne woke fully refreshed at five o’clock. She decided first to spend
an hour in the fitness centre. Besides, it would help burn off the enormous
rib roast that she ate last night. A light breakfast followed by a ten-minute
stroll delivered her to the firm’s downtown offices around eight. Neither
the studio nor the head office were particularly alive and she took the
opportunity to seek out the managing principal of the studio. She’d been
told that he habitually started work around seven and sure enough, he was
in his office under piles of papers and rolls of drawings. She introduced
herself and they began chatting.
“It’s interesting what you say about the indirect effects being more onerous
than the direct effects. That was certainly my impression, but it was quite
difficult to nail down.”
“We are putting some overlays together that show how the studio would
be affected by the critical hazards.” She pulled out the trace showing flood
effects on power distribution and laid it on the table. “This one is just
for power distribution during another serious flood. We are preparing
these for all utilities and municipal services to show how each location is
affected during a flood. It will also provide a good indication of how many
staff you can expect to be able to come into work after you allow for those
either cut off by the flood or having to take care of their domestic situation first. More importantly, it provides an indication of where you might
wish to look for an alternative location that you can temporarily move to.”
Marianne went on to explain the concept that she was putting together
and how it related to the reaction, response, and recovery during an event.
When she was finished, she paused uncertainly and looked at the principal.
He had a slightly bemused smile on his face. Marianne thought that she’d
blown it.
“So, you are identifying where in the city I could relocate the studio
to in a flood so that I can continue production? Why haven’t we done
this before?”
Marianne had no answer and simply nodded.
“Well, I’ll look up potential partners in these areas. When can you let me
have a consolidated map overlay?”
“They should be ready for Calgary in a couple of weeks.”
“I get the incident timeline that you spoke of and how there needs to be a
series of actions and plans for each stage. I’m too busy to do that. Can you
do it?”
“I can certainly put the studio resilience plan together for you, but you
will need to direct how you wish things to progress. Also, once we have
identified a suitable alternative location and negotiated our use of space in
an emergency, we will need to physically prepare the space and the equipment that we plan to move there. We will also need to rehearse.”
“Ridiculous. You can have some staff time to put together what’s needed,
but I’m not spending money on stand-by equipment and certainly not
wasting time on rehearsals. Besides, we’re not going to be flooded again.”
“You won’t be spending money on stand-by equipment, or at least there
will be very little expense. Virtually all of the equipment comes from the
routine evergreening process for the IT. The rehearsals would be a huge
advantage for all the key actors, but specifically those involved in the physical relocation during the reaction to an event.”
“Cost it out and let me know what I’m in for in staff time. Has IT seen
this plan? What about finance and the others? Are they relocating?”
“The firm’s administrative functions need to enable studio resilience and
this will include the delegation of certain functions when they are affected
by an event. The idea is that just because the head office is flooded, it
doesn’t mean that the studios cease to function.”
Marianne was feeling decidedly uncomfortable. This principal certainly
wasn’t going to be an ally in this project, but she had been able to set
it all out for him. He was mulling over what Marianne had said and
finally declared.
“Okay, we’ll play along. Do what you will, but I’m not investing any studio
funds until we have complete buy-in from the firm and these delegations are in place from Winona.You still didn’t say what you had discussed
with IT.”
“I haven’t had a chance to discuss the whole scheme with IT, but that’s one
of the reasons that I’m here, to work with them to devise a solution.”
It’s not even ten and I’ve had enough already, thought Marianne as she reflected
on her meeting. She confirmed her meeting with IT at eleven and went
in search of the associate dealing with the property manager. She wasn’t
sure if she’d previously understood that the studio was rented space, but
there would clearly be another layer of coordination and obstruction to
deal with. In what turned out to be a very short meeting, she learned
that the building owner had little if any understanding of how to recover
the property and things had been forced by the tenants. In fact, there had
been discussions about suing the building owner for lost productivity due
to the delays in reoccupying the building. That was something to raise
with the finance people. The associate agreed to investigate whether the
owner planned to have any stand-by power provisions or prioritise the
electrical circuits. It was clear that there was no provision for kitchen or
sanitary facilities during or following an event, nor would there be. The
priority was therefore to buy enough time to effect a controlled relocation
of studio business.
“Oh, hello. It’s you,” began Michael as Marianne entered his office. “I think
that we can achieve what you need to do by moving the server room and
all of its functions to the new data centre out towards the airport.”
Completely taken by surprise, Marianne managed a simple “Oh,” before
sitting down. He continued.
“Yah-huh. You see, the data centre is optimally sited in the area to minimise the likelihood of a catastrophe. It also has all of these back-ups and
stand-bys so if something did happen and we were flooded again, no one
would notice so much as a blip in service. I’ve done some preliminary
costs. It’ll take us about four months to relocate everything. We have to
do it ourselves, you see. The cost will be a bit difficult because there is no
direct financial benefit.”
“I think that’s a great idea,” responded Marianne. “And we can present the
financial pay back in terms of the risk that it is mitigating. I’ll use an aggregate of the last decade or so to determine a typical cost of interruption to
the firm and come up with a value that reflects frequency and loss if we
do not move to the data centre. I sense that there will be some financial
benefit once we factor in the value of the risk reduction. May I have a
copy of your cost calculations?”
Marianne wanted to hug him. After her earlier phone call, she’d expected
this meeting to be the absolute worst, but it turned out to be such a relief
after her meeting with the managing principal for the studio. Best yet,
Michael claimed it as his idea and so if she gave him the facts and figures
he needed to make his case, he’d be more likely to support her and perhaps
adjust a couple of items, like the telecommunications network. One step
at a time. Marianne dug out her initial data on the costs of loss and did a
quick Net Present Value calculation to see if the data centre option would
make financial sense once risk was factored in. It did. Sweet.
“I’ll need to verify the cost of interruption with finance this afternoon,
but from what I’ve already learned about the inherent risk – that is, the
current risk of IT interruption – and the costings that you have shown me,
the NPV is positive. It means that the cost of relocating the servers to the
data centre makes financial sense and will save money in the long run.”
Michael could not have smiled more broadly.
“Once I’ve checked all the facts and figures, would you like to present this
concept with me when we brief the board on the firm resilience framework measures?” offered Marianne.
“That would be fine. I’d be happy to help.”
Marianne smiled as she left Michael’s office. At last, she had an ally. She’d
make this work and if it meant sharing some of the credit, so be it. There
was just time to find finance and chase those costs of interruption figures
before lunchtime.
Armed with the cost of interruption data covering the last twenty-five
years and having confirmed the NPV projection with Michael, she felt
certain that she could make this work. Next stop, Winona. Marianne was
sitting in a coffee shop chewing on a decidedly mediocre baguette sandwich when she noticed a most curious woman walk up to the counter and
order. She was tall, or at least about Marianne’s height and so taller than
average for a woman. Her hair went in all directions with grey roots and
wild orange henna dyed locks. She had a gaunt expression and reminded
Marianne of those pictures of Boadicea, warrior queen of the ancient
Britons, that she’d seen a school. Quite fearsome. Marianne almost jumped
out of her skin when Boadicea strode up to her table.
“You must be Marianne. Winona. Unexpected meeting this afternoon.
Reception said you’d be here. Let’s talk. Why’d you come to this Godawful place. The sandwiches can kill.”
Marianne rose to shake Winona’s hand and smiled, but both were ignored
as the comments were thundered out for all to hear. Marianne wanted
to shrink. She’d never encountered someone quite like this before, male
or female. The staccato manner of talking was also a little odd. Boadicea
clearly meant to have their meeting here and now, and Marianne had left
her notes at her desk in the studio.
Winona sat down and harrumphed. “Well. What do you want to
talk about?”
Marianne explained what she had learned about the firm’s experiences in
New York and Calgary and over a wide range of other events in the last
twenty-five years that had directly affected the bottom line. She explained
that she felt that the solution lay in the studios becoming resilient, which
would mean that the firm needed to enable that resilience through its
provision of essential administrative functions. She described the essential
functions and went on to explain how the same functions can be affected
by catastrophic events. Marianne stopped short of offering her solution.
She looked at Boadicea when she’d finished, not defiantly, but with her
eyes slightly down.
“Andrew said you’re smart. Not like those wet clones of his in the Toronto
office. I know you have a solution, so out with it.”
Boadicea wasn’t bellowing anymore. She sounded almost conspiratorial
with eyes narrowed and lips pursed. This time Marianne looked at her
directly, switching her focus between Boadicea’s forehead and the happenings behind.
“I think that the administrative functions need to be able to continue if
the head office is interrupted. This is particularly important for accounts
receivable and payable, which must continue for both market confidence
and cash flow. Therefore, we need an arrangement in which each studio
can continue those functions independently in extremis. It means some
local training and preparation with clearly defined procedures, though
restricting all future payment to EFTs would go a long way to facilitating
this. This would be standardised across all studios. Also, we need to own the
information space in an event, so that the media do not fill it with speculation. We must demonstrate to our clients that we have things under control
and so promote confidence. We must also be able to communicate with
our own staff and have standardised procedures if someone is unavailable, a
system of deputies if you will.”
Marianne paused and Boadicea looked at her for what seemed like an
eternity. Boadicea took a bite of her sandwich, grimaced, and discarded it.
“Give me a summary of what you intend by the morning. Keep it short.
I’ll give you my answer by lunchtime. The deputy thing. Not me. You’ll
have to speak with the chairman, if you can get any sense out of him.
You’re more than a match for him. Don’t forget to speak with the CEO.
Andrew certainly knows his onions.”
Marianne smiled and rose as Winona got up from the table. She didn’t say
good-bye and simply turned on her heel and left. Marianne didn’t really
know what to think and sat down again. She took a bite of her sandwich.
Boadicea was right, it did taste awful. Marianne discarded the rest of it and
thought about what had just transpired. She wasn’t sure if Boadicea had
paid her a complement or not, but she did at least have an opportunity
to persuade another person to support her rapidly developing scheme for
the firm’s resilience framework. Besides, had she just been compared to an
onion? That was one hard bitten woman and didn’t seem to be hung up
about the whole studio / office thing either. Marianne liked her.
Marianne returned to her desk and began drafting a note to explain what
she required of the administration functions. She sketched over the IT
bit, focusing more on requirement and saying that a technical solution
within certain risk reduction parameters would be needed. At three, she
headed over to the CEO’s office in the next-door building. She passed by
Winona’s office to see her haranguing four people round her conference
table. She looked more Boadicea like than ever. She strode up to the EA’s
desk and explained that she had an appointment with the CEO at quarter
past. She was offered a seat and a coffee, both of which Marianne gratefully accepted.
Her meeting with the CEO was quite short and pleasant. He welcomed
her to the firm, enquired after her interests and aspirations, and briefly
about the resilience project. He’d clearly been very well briefed and
Marianne supposed that Andrew had given him a complete rundown. It
appeared to Marianne that Andrew was well respected in the firm and his
was one of the most respected opinions. She felt good to know that he had
tracked her down and recruited her and was now supporting her.
Marianne left the CEO’s office and paused at the EA’s desk to ask after
the chairman.
“He’s in a meeting with Winona at the moment. Would you like to leave a
message for him?”
“No, thank you. I’ll catch him later.” Marianne smiled to herself and felt
a sudden rush of pity for the chairman. She returned to her desk and
finished the briefing note for Winona. She then began sketching out afresh
the firm resilience measures, as they relate to the studio resilience measures. Aside from the whole issue of alternate people for responsible positions and capabilities, something was missing in this gradually assembling
scheme. She decided to revisit the whole studio resilience planning from
the incident file.
This iteration of the incident file was built in direct reference to the incident sequence. Marianne started with the firm’s tolerance of interruption.
This period, at least eight hours, would be the time between the incident
first hitting the studio and the recovery commencing. This meant that
the reaction and response would be completed. The missing information
was what reduction in performance would be sustainable for the firm.
Marianne went back to the cost of interruption. In the worst case, the
Cascadia fault has a huge shift and Vancouver and San Francisco are both
affected. Therefore, could the firm sustain itself if both of these studios
failed? It would appear not. She picked up her notebook and went in
search of the finance director, returning an hour later none the wiser. She’d
spoken with him, but he was unwilling to share that sort of information.
She decided to refer the matter to Boadicea.
Marianne decided that the firm would likely be able to operate through
the loss of two studios, but not sustain that effort. While that may be the
case, she should answer that question at the studio level. If the studio was
to commence recovery by 8 a.m. the following business day, what were
the essential functions required to enable response and recovery? What was
the minimum operating performance just to stay functional? And, what
was the minimum sustainable performance of a studio? Looking through
the cash flow data of previous events, there was a common threshold cash
flow to each. Below this threshold of loss over the month, the studio was
still able to absorb the impact. However, when the losses exceeded it, the
firm had to transfer funds to the studio. Marianne supposed that given
the close interdependency between studios on projects, the impact to one
studio would be felt across all of them involved in the same projects. She
decided to take this studio threshold as being roughly the minimum sustainable performance, that is, no profit or internal investment in capability.
This figure would need to be checked against the accounts and it would
probably be best to ask that question directly of Winona. The minimum
enabling capabilities and functions were the administrative ones that she
had already identified and which were provided by the firm to enable
the studio. The others were minimum production capabilities. This meant
that during the reaction phase, she could identify precisely what needed to
be restored. Going through each systematically, from data communications
and data access to a communications strategy, Marianne laid out exactly
what was required by way of operating parameters and what would be
needed to achieve this. She got a little stuck at the relocation of the studio,
but figured that she could come back to that once she better understood
the options for relocation and how many staff would have to move. Next
came the response phase, and she repeated the analysis, listing accounts
receivable and payable and staff access among others. She looked at which
of these actions needed situation-specific decisions by the managing
principal and decided that many didn’t actually need his direction, such
as accounts receivable and payable. Therefore, these were moved to the
reaction stage, but with a longer implementation time. The recovery stage
would need to be more bespoke to the individual studio, so she set that
aside and reviewed where she had got to. She had a series of activities
that would be conducted automatically in the event of a major incident.
Some had to be completed quickly, others she had at least eight hours. The
response activities were actually few, meaning that the studio managing
principal would not have to be involved in the minutiae and could focus
on what was genuinely important. It looked like a workable plan.
As Marianne contemplated her work, it occurred to her that she had yet
to filter each action by a so what evaluation. This process of critical thinking[1] and deductive reasoning[2] was throwing up all sorts of preparations.
The essential equipment in the studio needed to have prioritised electrical
circuits with an uninterruptable power supply, the relocation site needed
to be surveyed and measured, and all cables cut to the correct length in
advance. Therefore, the location and configuration would need to be
decided in advance. Suddenly, her tidy list of actions had exploded into a
complex mass of activities. Deductive reasoning be damned, she thought. Back
to the mind maps. Marianne opened FreeMind[3] and began transferring the
information onto the mind map. It started to make sense. She did the same
for the firm level activities that she set up as a framework connecting to
each studio. That made more sense and was easier to follow.
Marianne kicked back her chair, packed up her notes and laptop, and left
them in a neat bundle on her desk. She picked up the briefing note and
her coat and left the office. Dropping the note off at Winona’s office, she
walked out into the chill Calgary air and headed back to the hotel.Turning
onto Steven Avenue towards Centre Street, she noticed the James Joyce[4]
pub and decided it was probably time for dinner. It was 10 p.m. Toronto
time and her stomach had begun to suspect that her throat had been cut.
After an exceptional classic pub meal, she ambled round the corner to her
hotel, full and happy.
Waking after another extraordinarily restful night, Marianne glanced at
the clock to see that her body clock had already made the adjustment to
Alberta time. No run this morning. She had a leisurely start, breakfast, and
check-out before strolling back to the studio. She walked in the studio
doors shortly after nine to find a post-it on her desk with a summons from
Winona. Marianne took off her coat and sighed. It was all going so well.
“Media strategy, financial delegation in extremis, and IT risk reduction
are approved. I know that this wasn’t Michael’s idea and that you must
have planted it in his head. Well done. He’s your loudest advocate now,
so I won’t burst his bubble. I think that you are asking too much of the
studios. They see only the next project and their end of year bonus. They
probably don’t even think that anything will happen.You will have to lead
them yourself. I know you need managing principal input. You’ll find a
way. That’s all.” Winona looked back at her paperwork.
“There are a couple of questions that I’d like to ask,” said Marianne.
Winona looked up with the merest hint of a smile on her face. “Oh?”
“The finance people were being sensitive about sharing information on
profit margins and what a survivable income is, rather than a sustainable
one.” Marianne went on to explain where her thoughts had taken her
last night and how this would help, particularly as the likelihood of active
studio engagement was fairly limited. Winona nodded and thought for
a moment.
“Tell James to see me if he has any concerns about sharing the books with
you. I don’t want you giving them supplementary analysis tasks, though, as
we are working on year-end and they are all busy. That it?”
“Yes. Thank you, Winona.”
Winona didn’t respond, but simply looked back down at her papers.
Marianne wondered if she did like her, but was relieved to have her support
and walked back to her desk. She passed a coffee station and decided to try
the Calgary studio coffee. It was a mistake. Bitter coffee and bitter people. She
quietly poured it down the sink and went in search of something palatable.
Marianne settled back at her desk with her notebook in hand. She had just
spent two valuable hours with finance getting all the information that she
had needed for each studio. She packed up her notes and called reception
to hail her a taxi for the airport. She’d run out of time. None of her interviews had gone as planned, but she was relieved that she’d done as much
preparatory work as she had, or else she’d have precious little to show for
this trip. By the time she got to the front door, her taxi was just pulling
up to the curbside. The driver didn’t get out, but simply popped the trunk.
She laid her carry-on in the trunk and climbed on to the backseat.
As the downtown gave way to bridges and Memorial Drive and finally
the Deerfoot Trail, it occurred to Marianne that the person she should
have made a point of speaking with was the practice manager. This was,
after all, the person who would orchestrate the reaction and protect the
managing principal from all the noise and distraction while he focused
on how best to respond and initiate recovery. That is quite a lot of coordinating responsibility for one person. Given that many of the administrative functions were so closely controlled centrally, there was no need
for the studio practice manager to be as broadly skilled as they would
ordinarily be. Would the incumbents be up to the task and could they
help Marianne put the incident files together. This would be the person to
focus the surveys, rehearsals, and planning around. She decided to organise
a videoconference with all of the practice managers when she got back
to Toronto. She checked in, went straight to the lounge, and began going
through her notes, filling in the gaps with what she had learnt. By the time
her flight was called, Marianne had found that this trip had been far more
useful than she first thought.
As she stared out the aircraft window, it occurred to her that she would
need to conduct a series of workshops to get the right risks and measures
worked out, and that she had completely overlooked security despite all
the indicators through her working.
Workshops[5] would be a logical way to collect the detailed requirements,
but who to invite and what would the format be? A simple workshop
where a cross section of disciplines are brought together to discuss the
criticalities of a project to draw out the dependencies can often resemble
herding cats, with every opinion being voiced, whether reasonable or not.
Conversely, the Delphi technique is useful and may be a suitable option for
a generic project dependencies model. They could develop what looked
like a reasonable initial model and then circulate it to the various discipline leads with a series of questions. The model would then be adjusted
according to the expert feedback received and the process repeated until
consensus was achieved.This could end up being very drawn out. HAZOP
and similar systems are not really appropriate, as the complexity and consequence of failure does not warrant such an expense. There are also some
accident consequence models to consider, but it would come down to
the level of engagement across the firm and particularly among the studio
managing principals. Perhaps they would be better off establishing a resilience committee, which all the administrative directors would attend with
Marianne, plus one. Perhaps Graeme. That could address the mechanics of
firm-level stuff and usefully prepare for the board presentation. That made
sense to her, and as long as she kept it focused and efficient, she would
keep their attention. She decided to speak to Andrew about that tomorrow.
They would also need to gather input from the project workers, the ones
producing the contract documents and so on. This time, they could hold
a series of tool-box talks, where over a fifteen-minute break in the project
team space, she would present a model and invite comments and answers
to two or three specific questions. Keeping it short and pithy would keep
interest and not be seen by the principals and others as an imposition.
She’d have to start on the Toronto studio and roll out the process to the
other studios once she’d demonstrated that it works. Marianne had a clear
plan of attack to discuss with Andrew and Graeme.
The other problem that teased Marianne was the one about security, or
more specifically, client expectation and perception of security. The firm’s
pitiful performance during the last Calgary flood had resulted in the loss
of an important client. Client confidence is essential.The client must know
that its data is safe in the consultant’s hands. If we can’t control our own data,
what faith will a client have that we can safely control his? she thought. None.
Yet, the IT security systems were fairly typical of services companies. In
fact, they were probably somewhat on the light side with the majority
of staff bursting with creative talent and viewing security protocols as
restraints on free expression. Marianne had noted that there was still an
argument raging between the architects and engineers over whether PC
or Mac was the most appropriate system. Michael had already developed
a series of complex interfaces between the two systems and it was playing
havoc with data transfer and virtualising the servers. So, they needed to
look critically at the security of IT and find the right balance between
open creativity and surety. It also occurred to Marianne that the inclusion of security considerations in the resilience plan made perfect sense.
One seemed to flow naturally into the other. Was the same true for the
other way? Security is about identifying and responding to a threat as it
manifests itself, ideally intercepting it before it can cause damage. Those
indicators and triggers for intercept and mitigation actions are no different
to the Key Risk Indicators in a strategic plan or a risk management plan,
or indeed a resilience plan. She decided to speak again with Scott and ask
him to include precursors and indicators on his location risk overlays. She
would probably have to give him the timescales for response activities, so
she started with eight hours as the trigger, since it was the minimum reaction and response time.
The flight landed exactly on time and she was through the terminal in
minutes. “Whiskey, Tango, Foxtrot!” Marianne declared as she exited
the terminal for the TTC bus to Kipling Station. The temperature had
dropped significantly.Winter was having a last laugh. She hurried to put on
her warm winter coat that had been draped over her arm.
DISCUSSION POINT: Given the reception that Marianne
received at the Calgary studio, how do you think she should go
about organising a workshop and what type would be appropriate, if at all?
Synthesis, April 16-18
In which Marianne explores the issues around succession planning,
finalises the firm-level resilience strategy, and develops the studiolevel resilience strategy and incident management measures.
There is something strange about Toronto as it slowly wakes up from the
winter, as if there is a common sentiment that there has been enough
winter for one year and it is time to begin the summer. There is little if
any spring to speak of. That morning felt like it should be in the inexplicable transition phase. The ambient temperature yesterday had fallen to
typical temperatures for mid-March, yet tables were being put out on the
pavement in front of coffee shops. Marianne couldn’t imagine that anyone
would be using them, but you never knew. The papers were focussed on
the state funeral today of Jim Flaherty.[1] Not a particularly political person,
her views didn’t fit neatly in any one political party’s manifesto. Marianne
nevertheless felt particularly sad that he had died. She supposed that this is
the nature of state funerals, which are held for individuals who somehow
transcend the political divide. As the subway rumbled on and she’d finished scanning through MetroNews, she stared blankly down the carriage.
Mr Flaherty’s successor as finance minister, Joe Oliver, was a completely
unknown name to her. He may or may not be capable of handling the
portfolio that he’d been given, but Marianne hoped so. There was night
and day between the two in the public mind. This would be no different for a sudden change of any key appointment, which is why there
is usually a ritualised transition. In politics, this is through elections and
cabinet shuffles.
In business, this is handled as part of change management. In both cases, a
focussed communications strategy is in place before and after the change to
inform perceptions. Not so when someone dies. What if Andrew became
very ill, withdrew from work, and was dead a week later? How would the
clients perceive this change? In fact, how would the firm and the Toronto
studio cope? The national finance minister has an extensive staff to manage
every aspect and keep a complex portfolio running.The minister’s staff probably has as many staff as are in the whole of MTW. Nonetheless, the sudden
change has affected international relations and business confidence around
tax policy. The effect of Andrew’s sudden death would be more pronounced
for the firm, relatively. Besides, in Andrew’s case, there was no obvious
replacement. By the time Marianne found herself walking down Spadina
Avenue, the issues around key person risk were starting to form clearly in
her mind. Insurance was one aspect. She hadn’t seen any real analysis of that
in the insurance policies or supporting assessments. More fundamental was,
how would the studio continue to function, and what would clients think?
Marianne arrived at the studio front door just as Graeme was swiping his
pass code.
“Hello, Marianne. How was Calgary? You’ve brought their winter back
with you.”
Marianne smiled and gave him a brief summary of her visit.
“So what are you doing now?” asked Graeme as they strolled together past
her desk towards his office.
“I’m collating all that I have learned so far. It’ll be the third time and I
dare say that I will again throw up a series of questions for things that
I had missed before. However, I sense that I am getting closer to an
answer. I think that the firm-level resilience framework is pretty much
there. The studio approach is where the real wild things lurk. For instance,
what does the studio do if a key person is unexpectedly wearing a casket?
Let’s say that Andrew has a fatal car accident. What would happen to the
Toronto studio?”
“You asked that before, but I sense that you see this as a bigger issue than
you did then. What’s on your mind?” Graeme dropped his briefcase on his
desk, turned on his computer, and turned to face Marianne again. “Come
on. Let’s find a decent coffee. Susan’s not here yet and I don’t know how to
set the machine up. There’s a tolerable shop a block up.”
Marianne explained her concerns and how there hadn’t really been any
satisfactory answer from the chairman. He had answered her question in
a superficial way and broadly described the succession plan, which had
clearly been forced out of him by Winona. They carried on chatting as
Graeme led them into the heart of Kensington to the Grind House.[2]
Marianne hadn’t been there before and not for the first time wondered
about Graeme’s past life. Strolling around Kensington was definitely not
what one would associate with him. “Does the firm consider key person
risk as important?”
Graeme chuckled as he paid for the coffees and turned round to
face Marianne.
“I’d be careful where you go with that line of inquiry, young lady, but the
answer is no. We’re mostly architects and engineers with safe local experiences working in a highly commoditised market. Sudden fatalities is not
something that would occur to any of us, much less how we’d continue
production if a key person dies. It just doesn’t happen in our world.”
“But the effect is the same if Andrew is cut off by volcanic ash[3] that prevents him flying back from Europe.”
“Like I said, it hasn’t happened. When your focus is the end of a project or
competing with a practice with lower fees than you, the very notion that
someone key might drop out doesn’t enter into it. Most of the teams that
we put in proposals are not the ones that actually do the work. Ahhh, here’s
our coffee.” He handed her a coffee and took a quick sip from his. “Over
there,” he said, pointing to a table outside. It’s that Toronto summer thing,
mused Marianne and braced herself for the cold.
Their discussion on key person risk in the firm and studio had just given
way to a more casual chat about Easter plans when they returned to the
studio building. Marianne decided that she could really only raise it as an
issue with supporting scenario and statistical data. If Graeme was going to
get prickly about the matter, his more highly strung colleagues would be
positively hysterical.
For the rest of the day, Marianne worked her way through the firm resilience framework. As she deconstructed each essential function, she found
that the cost of implementation was negligible. She looked for hidden
costs and at the possible consequences, but the risks consistently reduced
without any significant funds being expended. Finally, she came down to
an investment of $2,800 plus an annual cost of $1,730 to realise a $590,000
annualised risk reduction across the firm.The figures didn’t make any sense
to her, because with that sort of return, they should have been done before.
In fact, the measures being recommended were so simple and obvious,
one would think that they would be in place anyway. So often, it depends
what question one asks to understand value. The IT resilience was a much
closer thing.
She reviewed the gap analysis to see how it should be applied, and identify
what would be needed to get it across and adopted.The IT reconfiguration
would cost $1,620,000 over five years with an annual cost of $72,000. The
annualised risk reduction was $859,000 and much of the IT reconfiguration was achievable through the evergreening process, reducing the initial
cost to $720,000 over five years and assuming a transfer to the data centre
in the first year. Each way Marianne reviewed the numbers, the result was
consistent with the risk reduction assumptions and valuations not changing the final values by that much. She decided to cluster the values that she
was getting to give a range of NPV values, both positive, so that she could
demonstrate the conservativeness of her calculations. She would run these
all by the finance people when she got a chance.
Marianne revisited her numbers for the firm resilience framework measures
the following morning. By mid-morning, she was confident that things
were in order and she turned her attention to the studio incident files.
Finally deciding on the name seemed to have been her biggest concern.
Extending the firm-wide measures to the studio had the effect of isolating
each studio from a firm or other studio failure. It meant that she could now
work with the direct effects of local failure or interruption. The cost of
loss was surprisingly easy to capture and annualise. More challenging was
ascribing the activities to phases in the incident sequence and so identifying a cost of mitigation against the risk. She decided to approach it afresh
using the phases of the incident sequence and the way she had decided to
structure the incident file. She began at the planning point, that is, the sustainable level of performance achieved within eight hours of the incident;
the point at which the recovery phase can begin. She had already sketched
out a series of reaction and recovery phase actions. She had also identified
the information needed to make the necessary decisions for the response
phase. However, this time the preparatory measures were falling out of her
analysis and soon she had a matrix of issues and measures for a generic
studio resilience plan. In effect, she had developed a site investigation or
survey checklist by deductive reasoning. To situate this checklist for each
studio, she would need those initial desktop studies (preliminary studies
of each studio) and the location risk assessments that Scott was working
on. She sent Scott an email casually enquiring about progress and plans
for Easter before digging through her initial studio notes. She collated her
notes for Toronto and Calgary – the only two studios she had some familiarity with – and began to revisit her research and each cross-reference.
Marianne got up from her desk around 2 p.m. a little lightheaded and
remembered that all she’d consumed that day was a hurried breakfast as
she raced out the door. She bought a take away box of dumplings from
King Noodle[4] and returned to the task in hand. She reduced her focus
to just the Toronto office and once again arranged her investigation. The
beard had said that one starts from the centre of the Earth, passing through
the site to the sun and back to the site. You then sweep the surrounding
area like the petals of a flower. Somehow, this visualisation helped her more
than simply working through the headings: geology, hydrology, topography,
meteorology, cosmology, and physical threats (natural, accidental, and malicious hazards, repeated for cyber and insider human threats).
Scott knocked on her desk partition and announced that he had no plans
for Easter.
“Oh. What will you do?”
“I’m writing a new code for autonomous simulant behaviour. It’s like
SimCity, but without the constraints on behaviour. I want it to resemble
termite colony behaviours reflecting local stimuli to prove some ideas I
have about emergent theory.”
Marianne looked at him blankly. What on Earth was he talking about?
It then suddenly dawned on her that this related to what the beard had
said about dependency clusters and how in a crisis their behaviour will
follow patterns influenced by local stimuli and information rather than
some greater or centrally directed plan. “We’re having a bit of a family get
together.Very Dutch.Very loud.”
“Not my thing. I didn’t know that you were Dutch.”
“I’m not, really, but my parents came from there to Canada and brought
many of their customs with them. Is tomorrow a holiday?”
“No, Monday is, though.”
“How do I code that on my timesheet?”
“Just write STAT under the project number and eight hours in the
time box.”
“Thanks. How’s the location risk mapping coming along?”
“Toronto, Calgary, and Chicago are done. New York is proving a complete
nightmare to gather information on. I suspect that they have locked down
all the information in response to 9/11. San Francisco and Vancouver
are proving slow beyond seismic. I’ll plot Toronto, Calgary, and Chicago
for you tonight and send the pdfs by email. It’s been a really interesting
project. I’ve written a couple of processes in Python[5] to help with the
flood analysis. The liquefaction assessments are really difficult, but I have a
couple of ideas that I’ll play with tomorrow after work.”
“Wow, thanks. That’s quick.”
“Once I’d got the process sorted for Calgary, Chicago and Toronto were
relatively simple.You’re welcome.” And with that, he was gone.
Marianne stared blankly after Scott’s disappearing profile and looked back
down at her notes. Why isn’t Good Friday a statutory holiday? She went in
search of Susan and a decent coffee. When she returned, she resumed her
analysis and completed the physical environment assessment for Toronto.
The hazards again gave her pause. Scott had looked at the natural hazards
and their direct and indirect effects upon the studio. She decided to focus
on external public threats from crime, riots, and terrorism to accidents and
city disruptions.
She was startled when Scott dropped off three large rolls of paper on her
layout table and looked at the time. It was past eight. She’d have to stop this
and she’d forgotten to tell her mother that she didn’t have Good Friday off.
“Thanks, Scott. Can I look through these tonight and we’ll discuss tomorrow? It’s just that I’m trying to get this done and it’s proving something of
a brain-teaser.”
“Of course. Good luck.”
Marianne looked back at her notes. Something was missing. Did she have
enough to go to Andrew with? The building transformer was at street level.
This area suffered basement flooding and surface flooding during extreme
rain storms – there had been a few of those in the last few years. The
transformer must have been effected. The studio had lost power during the
Manby substation fire, on Kipling. All told, they were quite exposed here
and Spadina Was one big construction site. She opened the Toronto map
roll and looked for the studio location on each utility trace for flooding.
Power loss, water pressure loss, transit loss, and mobile communications
loss. She looked afresh at which areas were unaffected by these events.
There was a patch in south Etobicoke and an area in Mississauga consistently unaffected. I wonder who owns this building? I’m sure that I’ve asked that
before, but it’s not in my notes. Time to go home. She drew a taxi voucher from
the reception desk and called for a pick-up.
Marianne had slept through her alarm clock and woke with a start on
Friday morning. To add insult to injury, she clearly hadn’t had a coherent
thought during her sleep because no epiphanies were bursting into her
conscious. She flew through the bathroom, got dressed, and was out the
front door with half of her mother’s bagel in her mouth within twenty
minutes. When she got to the studio, it was half empty, her colleagues
clearly choosing to extend the long weekend. Why hadn’t she thought of
that? She sat at her desk and for the first time stared at her notebook. She
let out a weary sigh. This was becoming a real slog. She felt tired, hungry,
and had expected to be further along by now. By mid-morning, she had
a list of questions for Andrew, including the suggestion that he look to
Mississauga for any partner companies that they could share emergency
facilities with. She felt sure that she would recommend finding space in a
company in a safe area, rather than identifying a stand-by facility and the
overheads that would entail. She put her package of notes together and
went in search of a coffee and perhaps something covered in chocolate.
She crossed Spadina and aimlessly walking down Dundas until she found
herself in front of the AGO,[6] contemplating the brunch menu at Frank’s.
The crepes looked rather good and her stomach growled.
“You sound hungry.”
Marianne almost jumped out of her skin and spun round to see Andrew
grinning at her.
“I hear that you’re concerned that I might be run over. I’m touched by
your concern, but you needn’t be. Have you had breakfast?”
Marianne shook her head and recovered her composure. Graeme must
have told Andrew about their conversation. She’d have to be careful just
how far she confided in him.
“I was contemplating a crepe brunch. I missed breakfast this morning.”
“Excellent idea. I’ve not eaten here myself, but friends say it’s tolerable.
Come on, let’s give it a try and you can tell me where you have got to
with your investigation.”
Marianne agreed and wondered quietly why Andrew had called it an
investigation rather than a project. She also noticed that he referred to the
food as tolerable, just as Graeme had about the coffee. Group think? It’s just
such an unusual word to use, at least in Toronto.
Brunch was indeed excellent. Marianne described her thinking, outlined
her plan for the firm resilience framework, and talked about where she was
with the generic studio resilience plan. She thought it best to leave out the
details of her Calgary trip.
“This all sounds perfectly logical and reasonable. The investment returns
seem reasonable also. You impressed Winona and if you explained your
ideas to her half as well as you just have over crepes, I can see why. It’s the
first time I’ve known her to offer a positive opinion on anyone.”
Marianne warmed to the core. Perhaps Winona was friendly after all.
“I have a couple of contacts in Mississauga who I’ll raise this with next
week. Can you get me a summary sketch of the area I should be looking
in by Tuesday?”
Marianne agreed and they chatted for a while about Easter plans. Andrew
was clearly not working today, so he must live locally. Where was his
family? She was suddenly curious to discover what his wife was like.
Feeling revived by the crepes and coffee, Marianne returned to her desk
and began afresh on the incident file. Her sketches and notes in airport
lounges, subway trains, and street cars were definitely taking shape and
she was finally drawing together something simple and coherent. The key
was indeed the reaction and the communication strategy. Everything else
was in its own way equally important, but these two things would define
whether the studio could self-recover. She had been right to fix on the
succession plan, only now she would be able to articulate why. She worked
through until mid-afternoon and packed up her notes and the map rolls
to take home. On her way out, she stopped by Scott’s desk to thank him
again for the maps and talk about Andrew’s request.
“I used the same scale for each trace, so you can transfer data using
tracing paper.”
“Oh.” Of course.Why didn’t I think of that? “Thanks, Scott.”
Marianne sighed. She’d rather hoped that Scott would offer to prepare the
trace himself, particularly as he had all the data on his computer. She didn’t
feel that she could ask, though.
She walked by her desk to pick up a roll of tracing paper and a couple of
Sharpie markers. She dropped by a tourist bookshop around the corner
from the studio and bought a folded Rand-McNally map of Toronto, then
caught the street car home. Once home, she rolled out the maps and began
tracing the areas in Etobicoke and Mississauga unaffected by natural events.
She transferred this composite to a trace over the Rand-McNally map,
finishing just as her mother returned home.
“Hi!” called her mother. “You’re home early.”
“Yes. It’s quieter here. Do you want a cup of coffee?”
“Prachtig!” replied her mother, as she climbed the stairs with her shopping
bags. “Pasen!”
DISCUSSION POINT: Would a resilience plan be more believable if it cost more?
Pasen, April 19-21
In which Marianne deliberates over how to present her
findings and recommendations to the board.
The Yonge subway was busier than ever as Marianne rode up to North
York Civic Centre with her mother. They were attending the Willowdale
Group of Artists annual art show.[1] It had become quite the event over
the years with prizes for different works, some of which would be on sale.
This was more her mother’s sort of thing, but Marianne loved the atmosphere of these events. They seemed so at odds with the big city feel and
yet entirely appropriate at the same time. Eschewing the subway at North
York, they walked down as far as Sheppard before riding it downtown and
continuing up to Dupont. They then walked along Dupont to Bathurst
and to the Annapurna[2] where Harry had already got a table.
“Where’s Sandra?” Marianne asked before Harry had a chance to say hello.
“She can’t make it. I didn’t think it worth changing the restaurant, though.”
Vegetarian wasn’t Marianne’s idea of fine dining and certainly not something that she would ordinarily pay for. However, this place was very
good at rabbit food and a favourite haunt of Sandra, hence the choice of
venue. Lunch was extremely lazy and Marianne could have easily forgotten that they were all grown up and working to earn their own way in
the world. Somehow, being at a restaurant with their mother, this could
have been fifteen, even twenty years ago. She even had to admit that
despite being an avowed carnivore, she had really enjoyed her meal. It
was all perfect.
As Marianne stared out of the streetcar window and her mother read
a magazine article next to her, her thoughts drifted to the project and
how she would present her findings and recommendations to the board.
She could reasonably expect three of the principals to support her, plus
Winona. However, if her Calgary visit was anything to go by, none of the
studio managing principals would be interested in doing anything towards
the incident file development. Even the costs would cause some to balk,
despite very clear justification. This question continued to trouble her for
the rest of the day. She would need a clear and simple strategy. She recalled
the old advice: Say three things, one message; Say the message three times;
and keep slides clean and simple with a maximum of twelve words on
the slide. Somewhere in her boxes, she had a zen book of presentations,
or something like that. The only title that came to mind was Zen and the
Art of Motorcycle Maintenance,[3] which it most certainly wasn’t. She could
picture it and the umbrella design on the front cover. In frustration, she
googled presentation and zen on her smartphone. Presentation Zen Design.
The next task was to find it. Since discovering the book last year, it had
been Marianne’s touchstone reference for important presentations and this
would definitely be such an occasion. Realising that it would be in her
boxes that she had kept sealed until she moved into her new apartment,
she quickly placed a hold on it at her local Toronto City Library. In fact,
it was available now and she decided to go directly to the library to pick
it up.
Her mother had continued directly home and Marianne now stood
patiently in the queue for the librarian. Behind her, a German or Austrian
was muttering away about how accepting Canadians are of poor service.
She looked round to discover that he was talking on his phone, sotto voce,
complaining about mobile telecom service. She couldn’t disagree with
his assessment, but felt irritated that he would be taking a phone call in
a library in the first place. Marianne checked out her book and walked
home. She pondered this idea of Canadians being so accepting of poor
service. Was it patience, tolerance of mediocrity, or simply apathy? Anyway,
Europeans always seemed so much more highly strung to her. They might
have beautiful cities and culture, but they get so excited about things. It
then occurred to her that she had read in her research for this project that
a spark plug manufacturer whose production facility was underwater in
the floods last year still had to deliver within a two hour window in order
to keep his contract with a car manufacturer. Conversely, the tolerance of
an interruption in Calgary had been measured in days, though she supposed that if Canada still had an auto industry it would have been the
same here. She also recalled comments in the Flynn book[5] and reports
on the Montreal ice storm[6] that during such global events the reliability
of first responders reporting for duty was noticeably less than for localised
events. It is human nature to look after your own first and Flynn’s US
Coastguard examples really stood out now. The perception of risk, locally,
corporately, and societally was the real issue. Whatever the reason that we
might be more tolerant of service interruption in Canada, that tolerance
is decreasing. 8 a.m. the following business day is increasingly seen as the
correct planning point. She would have to speak directly to the partners’
perception of risk in her presentation. Hitting them with statistics would
just shut their minds.
Marianne woke to a familiar smell of cooking. Poffertjes! Every nation
has their own version of fried dough coated in sugar and poffertjes are the
Dutch version. It was mid-morning Easter Sunday, with the sweet smell
of baked goodies and the house totally quiet. Her mother can’t have left
long ago for church. Traditional Dutch fare had never really settled well
with Marianne and Harry. They found it rather stodgy and tasteless. Her
father would agree with their opinion, but to her mother it was a reminder
of her own childhood. To be fair, they were about as far removed from
their Dutch heritage as one can get in a generation. Nonetheless, Dutch
cooking imposed itself on the family on certain days and Pasen was the
big one. Her lasting memory of Pasen each year of her childhood was
lots of chocolate, delicious deep apple cake with whipped cream for midafternoon coffee, or hot chocolate for the twins, and nonnenvotten. Also
fried dough, but sticky with syrup or honey and something to linger over.
A literal translation would be Nun’s Bottoms, but somehow that detracts
from the pleasure and nonnenvotten was one of the few Dutch words that
had remained part of the family lexicon. Less inspiring for her as a child
had been the zuurkoolstamppot, a sauerkraut dish that they would have
for lunch. Thankfully, her parents hadn’t offered it to the twins mashed
up with potatoes, as her oma had once offered her. They had trekked to
Europe for a round of family visits when the twins were nine. Marianne
still shuddered at the traditional offering of potato and sauerkraut mashed
together. It took all of her will power to force down enough so as not to
cause offence. Never again. Instead, the way her parents would prepare
zuurkoolstamppot was with boiled potatoes on the side and with lots of
meat cuts, like kassler, rookworst, eisbein and pork belly. She had visited some
French friends of her father one year and they had provided something
similar called choucroute garnie. Their version tasted better, but her family’s
version was familiar and after thirty years or so, why change?
Marianne walked into the kitchen, poured herself a large mug of coffee,
and sat down. She could smell the poffertjes, but where were they? Was this
an attempt by her mother to generate an Easter egg hunt? She found them
in the oven, helped herself to a few, and settled down in quiet contentment. Five minutes later, the doorbell rang and before she could respond, a
key was in the lock and her brother announced his arrival.
“You better not have eaten all of poffertjes. Is Mum home yet?” Of all the
people in the family, Marianne had the reputation for eating any amount
of baked goods, and poffertjes in particular.
“No and no,” she responded as Harry came up the stairs with Sandra close
behind him.
Marianne squealed at seeing her old school friend again and they hugged.
“Looking a bit skimpy there, Marianne.”
Marianne rounded on her brother and wrapped her dressing gown around
her. Harrumph. She took her coffee and went upstairs to dress.
Easter lunch was indeed zuurkoolstamppot, both slightly acidic from the
sauerkraut and rich from the cuts. Upon reflection, she did prefer the way
her mother made it. It was a lazy lunch with lots of excited chatting and
teasing interspersed with comfortable silences. She had missed this. It is
funny how people are instinctively drawn to what is comfortable.This meal
made sense when everyone laboured in the fields or on the ocean for eight
hours a day, but with our modern lifestyles, its sole outcome was to add
pounds and cellulite. The process of the meal itself, on the other hand…
“So, have you formed any opinions about your new job yet?” asked Harry.
Marianne described the characters in the firm and the studio. They all
laughed at her description of Winona as Boadicea. Marianne went on to
describe her project, though didn’t feel up to discussing the details.
Marianne went to bed that night with a certain satisfaction that only comes
from a joyous family gathering mixed with trepidation about presenting
her findings to the firm. She blamed the zuurkoolstampot, but really she
was feeling genuinely out of her depth. She was expected to brief her new
bosses on their own company’s deficiencies in an area that she was only
learning herself. Daunting didn’t come close to describing the prospect.
After a fitful night’s sleep, she lay in bed and gazed blankly at the ceiling.
A spider was in the process of crawling out of the corner towards the light
fixture. Marianne’s first thought was incredulity that a spider could possibly have survived her mother’s obsessive cleaning. This was one example
where her mother matched the national stereotype of being cleanliness
obsessed, or as Harry less kindly remarked, a clean freak. She briefly considered catching the spider and setting it free outside the window to avoid
the cleaning sweep that must surely follow soon. Instead, she just watched
it and thought about all sorts of Robert the Bruce stories that might
somehow be applied to her. The point is that she hadn’t failed. She had
actually attracted significant praise so far and she had learned an extraordinary amount, thanks in large part to the beard at the university. So why was
she anxious? A lack of confidence? Not really. The lack of a plan? Possibly,
though she could easily come up with something. Perhaps her depth of
knowledge and therefore the ability to answer questions was the problem?
More likely. Upon reflection, she decided that however good a brief she
provided, she was worried that her ability — or lack of it — to answer the
probing questions that must surely come would expose the shallowness
of her own understanding and so undermine the very measures that she
would recommend. Thinking about it logically, explaining to the audience some of the contextual issues and some of the fundamentals about
resilience planning would establish a common baseline level of knowledge
from which to construct her argument. It must be pithy and unequivocal.
Perhaps a total of five minutes of her allocated twenty.Yet, she knew from
experience and Graeme’s advice that if she doesn’t get the essence of what
she wanted to say across in the first five minutes, she’d have blown it. In
fact, Marianne suspected that she had forty seconds to hook the principals
and a further eighty seconds to sell the findings. She would have to present
her butt off. Speaking of which, that butt was in need of a good run before
she could come to grips with this presentation. Pasen was more about
family and eating than body shape.
Marianne returned from her run in High Park and contemplated how
to approach this presentation over coffee and cake. Her mother, finding
Marianne less communicative than usual, had retired to her study and left
her to push her cake around the plate. Marianne didn’t feel the slightest bit
anxious anymore. She was instead gripped by the task in hand. It was like
those all-consuming puzzles and mathematics problems that she had done
as a student. The real question was where to start.
She decided to start with the issue, her findings, and recommendation.
Each piece of that would require a priori understanding by the audience
plus some resilience theory. The issue was the vulnerability of the studios
and the firm as a whole to disruption. Her findings centre around the ad
hoc configuration and centralised administrative control with inadequate
communications, and her recommendations would be firm-wide and local.
In each case, the recommendations would include some cultural change
within the organisation and that would be the hardest aspect to address. In
fact, that was definitely going to be the problem and therefore all of her
presentation messaging had to focus on that. So perhaps a structure along
the lines of:
• A short introduction and explanation of what this is about. State
what the issue is.
• Present the findings and outline the recommendations.
• Explain the issue in some more detail.
• Explain the sequence of an incident and what we are trying
to achieve.
• Explain the interplay between organisation, infrastructure, and people
in enabling the operation and what that means.
• Explain the findings and what they mean.
• Draw the conclusions from the findings and how they can be
addressed, over what period, and at what cost.
• State the recommendations and provide the summarised investment
over time and the corresponding reduction in risk.
This seemed rather full with perhaps too much information for this briefing. It provided the hook and punchline. It stated the issue and recommendations three times to mentally reinforce them and she would orient
the central message around changing organisational culture, perhaps using
words like ‘risk’ would have an adverse effect. Popularly, people don’t
really understand risk and see it as wholly negative or, worse, something
that just means insurance. From her impressions so far, the architects are
the worst at understanding risk — and why should they? Perhaps using
words like ‘likelihood’ would be better, but she would still come across the
‘it won’t happen to us’ or ‘bad things don’t happen in Canada’ mentality.
Even the feel from the Vancouver studio, where everyone was briefed to
the nth degree on earthquake preparedness, didn’t really see a requirement
to be resilient. A curious contrast to San Francisco. She must use these
instincts to her advantage rather than try to argue against them. Above all,
she needed the audience to remain receptive. She’d condense the briefing
to Andrew’s advice of ten plus ten. That would mean five or six slides for a
ten minute briefing with questions at the end. The hook would be in the
first minute, the messages in the next minute, and the explanation in the
following three. The next three minutes would be about the findings and
how to address them, with the last two minutes covering a clear extraction of the recommendations and what they would mean for the firm and
studios. First, she would write this all out, outline the content for each
slide, and go from there. Before any of that, she had to find her library
edition of Presentation Zen Design by Reynolds. She needed serious advice.
The basics would not suffice. During her undergraduate studies, she’d been
told a basic set of presentation rules. As she had progressed her career, these
had proven quite effective and now she maintained them as a basic mantra.
“Say three things with one message; State the message three times; Use
images to reinforce spoken content; Use primary colours and shapes; Use
half as many slides as minutes; Depending on the syllables, use no more
than twelve or fifteen words per slide; and only use Helvetica font, not
bold.” With this audience, she would definitely require something more.
DISCUSSION POINT: “You can be the most technically brilliant
individual, but if you can’t communicate your ideas, you are
useless.” This is clearly an important presentation for Marianne.
What is essential for her to include to inform a decision? What
is the decision that Marianne wants?
The Grand Reveal, April 22-23
In which Marianne practices her presentation to the
local partners and amends the content, emotion, and
messaging for a successful presentation to all studios.
Travel time[1] is an interesting concept, Marianne mused as she stared out the
studio windows at the rain. It made the buildings around the studio look
even more drab than usual. She looked back at the book that the beard had
given her. Travel time is the time between a threat being detected and its
arrival at the target or asset. The key is to push the detection out as far as
possible and use a series of indicators to enhance readiness, trigger particular contingencies, or set in motion whatever response has been planned.
It also uses barriers to delay the threat and, balanced with the intercept or
mitigation response time, you know when to trigger the response to an
imminent threat. It is such a simple concept and so applicable across the
whole all-hazards spectrum that she was vaguely surprised that she was
only now reading this for the first time. Why hadn’t she covered this in risk
management? Pertinent to her interests was the need to collect the necessary information and how to verify it. There was a wealth of live feed data
to access on the internet, but how to relate it to the hazard travel time?
The answer, again according to the beard, was to have a surveillance trace
that you use to integrate all of the different measures and find resources.
Perhaps she would come back to that one.
For the presentation, Marianne had decided on a black and white theme.
She felt that it would look clean, crisp, and professional. What she lacked
was a good picture that just screamed the resilience message. She’d seen
a Reuters image of the Goldman Sachs building lit up with the rest of
Manhattan Island in darkness during Hurricane Sandy. She didn’t have
time to locate it and arrange for a license, but she needed something like
that. FEMA[2] and NOAA[3] provide lots of great images to the Creative
Commons and would likely have something similar. Then again, something in Calgary would make it particularly personal. She’d come back
to that. Irrespective of these prospective tweaks, she had eight slides and
a script. She had run through it twice and both times came in under ten
minutes, so things were at least in the right ballpark.
“Ready?” asked Graeme, as he leaned over Marianne’s partition.
“Oh.Yes, of course. Here it is. I’ve got it on a stick in case I can’t log in on
the conference room computer.”
“Breathe, Marianne,” smiled Graeme. “You’ve plenty of time and there is
no need to rush. We’re just doing a run through with Andrew to see what
you’ve got and how we are going to present this tomorrow.”
Marianne looked at Graeme and felt greatly relieved by the we in his statement. He looked more avuncular than ever. “Okay. Ready.”
“Splendid. Come along, then.”
Marianne had finished speaking and Andrew was completely silent as he
tapped his pencil against his pursed lips. Graeme’s face was a complete
blank. She’d stuck to her plan, kept it all within eight and half minutes, by
the conference room clock, and even explained the concepts.Yet no questions. Had she got it completely wrong? She felt drained and exhausted
and suddenly deflated.
“This is going to really challenge most of the audience,” Andrew began.
“You’re telling them that they are vulnerable to events in ways that they
simply don’t comprehend. You have produced a thoroughly logical and
practical plan that simply won’t sell. We need to dumb it down. It’s too
technical. It’s also too long. Limit the concept bit to the incident sequence
and the operations focus. Everything else theoretical will be too much for
them. Package the measures. Present them in phases with attendant costs
and benefits. Start with a package that is virtually nil cost, then something
with a running cost, then something procedural and finally the stand-by
measures that will cost the firm to implement. Park the IT aspects to the
side for IT to present, not you. We need to make sure that head office
understands precisely what you are saying before tomorrow. They’re anticipating a teleconference today, so let’s confirm for 7 p.m. our time. I realise
that you are still working on the imagery, but that can wait until tomorrow.
Revise your slide content now and be ready for six. We’ll have a quick
run-through and discussion, then open the videoconference with Calgary.”
Marianne felt utterly deflated. She thought that she’d done well, but this felt
like a rebuke. She hadn’t responded to Andrew beyond a brief “Will do” before
leaving the conference room. She felt like she could cry. Once she thought
more clearly about what Andrew had said, the criticism was not of her work
or recommendations. If anything, it was more a comment on his fellow principals’ ability to absorb this brief and she had to reconfigure her presentation
accordingly. That was okay. She hid all the concept slides except the incident
sequence. That reduced the slides by a third. She then carefully crafted the
theory script around that slide. She also looked at the packaging of recommended measures. Sequencing them made a lot of sense now that she had
started to structure them as Andrew had directed. It would acclimatise the
audience to what was being presented and pushed the difficult stuff to the
horizon. It would most likely be given to the head office to implement.
By the time Marianne was done, she was down to five slides. They weren’t
pretty, but the essentials were there and she could at least brief to them
in the closed group. The costings had been surprisingly simple to estimate once the IT measures were removed. She was still waiting for the
evergreening off-set from Michael. Without that, the true cost of the IT
measures was little more than guess work bounded by doing nothing at nil
cost and full implementation at the full cost assuming no pre-existing IT
infrastructure. It was 6 p.m. It would have to do. She walked over to the
conference room.
Andrew and Graeme were already there with Jamie sitting at the head of
the table.
“Brief Jamie, Marianne,” said Andrew. “He’s agreed to be our test audience.”
Marianne looked at Jamie’s blank expression. At least he’s not dressed in black
like some grim reaper, she thought.
Marianne gave her brief. It flowed perfectly and came in at just under
five minutes. She knew that she had got it right, which was confirmed by
Andrew’s grin. Jamie, however, stared blankly at Marianne. He hadn’t got it.
“Marianne,” he began, “thank you for the presentation. It’s largely clear
to me and I get the recommendations and instinctively sense that they
are right and appropriate. I’m not sure that I understand why we need
to be functional by 8 a.m. the next business day. This could mean having
a flooded studio up and running within eight hours, which is impossible
without spending serious amounts of money on it. Will it reduce the costs
if we say noon the next business day? And does this mean that we need to
coordinate our holidays with the other studio and firm principals instead
of around our work. Who decides who gets Christmas? Besides, how likely
is it that Calgary is going flood again? Last year was a one in one hundred
years flood. Your reasoning and logic are compelling, but I’m struggling
with why.”
Marianne was taken aback by Jamie’s comments, but quickly recovered
and responded.
“Some coordination will be needed between principals, but this has more
to do with their accessibility to the studio in an emergency than whether
or not they are on holiday or on a project. The studio incident files will be
held by specific named individuals in each studio and provide the simplified guidance on what to do and how to activate a response under given
circumstances appropriate to each studio. Please do not perceive this as an
onerous requirement, but rather something that is administratively already
tracked by HR.[4] We’re simply bringing it to the fore for business continuity management purposes.”
Jamie nodded.
“The 8 a.m. the following business day has been taken on advice for the
nature of the firm’s practice and market expectations. It is about being able
to recover relatively normal production as quickly as possible, but more
specifically about preserving market confidence in our ability as a firm
to deal with such events. It is a demonstration that we understand the
market expectation and our clients’ needs. It says that we put our clients’
needs first and will continue to provide a comprehensive service irrespective of whether we have been flooded or not. This is quite pertinent given
our less than inspiring confidence following the last two times that studios
have been flooded. It appears that the firm has forgotten when the Calgary
studio was affected by the flooding in 2005,[5] apparently also a one in one
hundred year flood. Also, many of our projects require an alternate principal, named and assigned to the project. We rarely actually implement this
because we treat it as simply a proposal requirement rather than a project
requirement. In fact, if Andrew were to be removed from the studio by
a casket, will you or Graeme or Mark step into the hospital project with
scarcely a missed heartbeat? I suspect not. In fact, either of the associates
would run with it, but none of the other principals have any substantial
understanding of what’s involved.”
Jamie looked scolded. Marianne decided to soften her argument slightly.
“As to the likelihood of another serious event, the trend is most definitely up.”
Marianne brought up three slides that she’d prepared for the last iteration,
hoping for a suitable question.
“This data is taken from the Canadian Disaster Database.[6] You can see
for flooding, tornado, and wildfire, the trend over the last twenty years has
been of increasing frequency and severity. On this slide, you will see the
condition data for Southern Alberta for this year and last. The preconditions for a catastrophic flood of Calgary are greater this year than last, suggesting that the likelihood is greater this year. It will quite literally come
down to daily rainfall over the next month as to whether Calgary will
flood. This last slide shows the insurance loss data for the last four years.
Each year has been a $1Bn loss, which is unheard of. These losses also represent approximately 20% of the actual cost of loss.[8] I mentioned in the
presentation that 44% of businesses do not reopen following a catastrophic
event,[9] despite full insurance. Well, here is the firm’s percentage profit loss
resulting from each event over the last ten years. The investments that we
are talking about barely feature on the profit scale, but would significantly
reduce the percentage loss. I therefore suggest to you that the likelihood
of a serious event is increasing and for the cost and effort involved, can we
afford not to implement these recommended measures?”
The room fell absolutely silent. No one smiled and there were none of the
nods of approval that Graeme had previously been offering. In fact, everyone was curiously ashen. I’ve overplayed my cards, said Marianne to herself.
“That’ll do, Marianne. Anything else, Jamie?”
Jamie shook his head and Andrew resumed.
“Marianne, may I suggest that you do not change any content? Those
back-up slides were a fine touch. Smarten up the main briefing slides.
However, next time please keep the passion down. You are so well armed
with facts and figures that your answers are in danger of bludgeoning
the questioner and others will be reluctant to follow for fear of looking
foolish. That will push the discussion out of the meeting and you will lose.
We need an affirmation at the briefing tomorrow. It’s almost time for head
office. Get ready. Thank you, gentlemen.”
Marianne presented the brief to the head office with Andrew off camera
to her side. She did well. She kept the passion down and was rather gentler
than she had been with Jamie. A beaming Graeme provided a useful
confidence boost, also. Boadicea seemed content, as did the COO and
CEO. They asked similar questions to Jamie, but more as if they were just
feeling the waters than asking pointedly. Boadicea raised the question of
net present value forecast of risk reduction against investment. Marianne
didn’t have the answers to hand, but covered it well enough. The distinction between what she was proposing and the business continuity plan was
clear to all, so the questions that she had anticipated did not materialise.
In fact, it all went rather well and for what seemed like the first time that
afternoon, Marianne breathed. She could physically feel the fresh air flooding her body. When Andrew cut the videoconference link, she could have
happily collapsed into a chair. Instead, she stood there and looked at her
notes. She sensed that Andrew was going to say something, but there was
nothing. Eventually, he looked up, smiled, and simply said, “Well done. See
you tomorrow.” With that, he left her alone in the conference room. All
the lights in the studio had been turned off and she felt like she was a
museum exhibit. Now for those images, she thought to herself as she settled
at her desk and began work. It was going to be a long night.
The next morning Marianne sat to Andrew’s right at the conference table.
She looked every bit the professional and in control of her domain. Inside,
her stomach was quietly churning. After all, this was her big play. This was
going to be her fifteen minutes in the spotlight with her new company
and would likely define the rest of her employment with them. No pressure, then. When she had finally got home last night, she felt awful. She
didn’t like what she saw in the mirror and, not having eaten since breakfast, she likely didn’t smell too good either. Though she’d worked for a
straight twenty hours, she didn’t feel exhausted. Perhaps a little tired. This
morning she spent more time than usual on her appearance. She wanted to
look good and feel great about it. Feeling good about herself was what her
confidence needed. She wanted above all to be confident and in control;
she wanted to look and feel totally professional. She had succeeded wonderfully and there was no trace of her inner turmoil over this presentation.
Graeme, looking ever more avuncular, gave her a little nod that signified
approval and encouragement all at once.
“That brings us to the firm’s resilience assessment,” said Andrew suddenly.
“Marianne, from the Toronto studio, has been conducting this investigation and has come up with some findings and recommendations that we
should consider carefully.”
Marianne realised that she’d almost entirely blanked the preceding forty
minutes of the videoconference. It was her turn. She stood, smoothed her
skirt, and moved to the computer terminal to call up her slides and share
them with the other studios and head office.
“While Marianne is getting set up, I’d like to explain some of the context
and why we asked her to do this,” said the CEO. He then went on to
explain what happened to the New York studio during Sandy and then last
year in Calgary. Quite the warm-up act.
“Ladies and gentlemen, good morning. As has been explained, I was
asked to investigate how the studios and firm as a whole were affected by
Superstorm Sandy in New York and the Calgary floods. More importantly,
I have looked at how we could most efficiently contain locally the consequences of such events in the future and manage the risks more generally
across the Firm. I have completed the first stage of this investigation and
now recommend to you several measures to make the firm as a whole
more resilient in order that the studios can become resilient themselves.
These corporate measures can be implemented for $7,350 with an annual
maintenance cost of $1,750. They ensure that an event that affects one
or more studios will not affect the administration and production of the
firm as a whole, maintaining client and market confidence. In parallel, the
IT system is being reviewed to ensure that it too is resilient to external
events and enables the continued operation of the firm and the security
of our and our clients’ data. Michael will brief on this separately, though
implementation will be phased into the evergreening process. During
Superstorm Sandy, the New York studio was out of production for… “
Marianne had found her stride and she had everyone’s attention. She had
slipped the incident sequence to the questions slides after the presentation.
She explained everything clearly and concisely. The slides looked good.
They were striking and reinforced what she was saying.
“Thank you,” she concluded. “Are there any questions?”
The audience was silent, deep in thought.
“This all looks and sounds amazing, but is it really necessary?” asked the
managing principal from Chicago. Marianne responded with a less passionate version of her response the night before and called the appropriate
slides up.
“As I say, I will now go into each studio’s situation in more detail to ensure
that the respective incident file is adequate, relevant, and implementable.
We have already produced a series of traces that show the direct and indirect effects upon the studios arising from the worst case and most likely
events in the respective cities. This will allow us to identify where each
studio can look for alternative places to continue operation, either by
moving or sharing with another organisation.”
There was a general mutter of approval.
“When will this happen?” asked New York.
“We are pulling the final parts together for the Toronto studio incident
file. We are using this to iron out any quirks and make sure that we have
a robust and transferable standard framework. Once this is complete and
armed with the risk context reports for each studio, I hope to begin
towards the end of May with Calgary, then Vancouver, San Francisco,
Chicago, and New York. I estimate that it will take three weeks at each
studio. The IT implementation will be running in parallel and it is important that we coordinate the phasing. This may accelerate, or more likely
slow, the process.”
Another mutter of approval. Then it came.
“How do we know whether a measure is effective or not? How do we
know that this plan will work?” asked Vancouver. Marianne had rehearsed
and prepared for this and was inexplicably excited to be asked. Her voice
reflected the added energy and she had to remind herself to control the
passion in her answer. She called up the incident sequence slide.
“During normal operation, our level of performance is routine. However,
when something catastrophic occurs, that performance drops to zero or
very close to it. We need to react immediately to ensure that certain essential functions continue or are resumed as soon as possible. These essential
functions are the enablers of everything that our operation is. They define
our survivability. If they aren’t running, we can’t respond or recover. Once
they are running, we can respond to the incident. This is a deliberate phase
and whoever is leading at the studio will be making situation-specific
decisions to bring performance up to a minimum sustainable level of performance. At this level, we are not making money, but we are not losing
money either. We are effectively just ticking along and can do so for a protracted period. The recovery is then a strict sequence of actions that will
bring the overall performance at least up to the pre-existing routine level
and more likely higher. That minimum sustainable level of performance
is what we must reach by 8 a.m. the next business day. Based upon that,
we are able to work out what functions and actions need to be brought
on line by whom, when, and how they all relate and are enabled. There
are various tools that allow us to identify what measures are needed to
prevent a failure and contain the consequences of something not functioning. These have been consolidated at firm level to develop the package of
measures that I presented. If we know how we fail, we can determine how
to prevent it.”
Andrew nodded slightly and Marianne sat down again. In fact, a further
twenty minutes of questions followed, which Marianne stood for and
answered clearly and cleanly. Her big hurdle questions out of the way,
she relaxed into the role and gave an excellent performance. The chairman called the question and answer session to an end, as it had taken over
an hour of the teleconference time, but was only supposed to be thirty
minutes on the agenda.
“Shall we approve these initial recommendations or do we wish to discuss
this further out of committee?”
A low hubbub circulated for a few seconds and one by one each studio
simply said, “Agreed.”
“Excellent. We will implement Marianne’s recommendations for the firm
and she will proceed with the studio incident planning immediately. We’ll
skip Michael’s brief on the IT resilience, if that’s okay with you, Michael.
It is an update and he can circulate this to everyone out of committee. The
next order of business is… Winona, over to you.”
Marianne closed her presentation and sat down. She closed her eyes and
took a slow drink from her water glass. That was it? Somehow it felt like
a huge anticlimax and then the enormity of the task ahead came crashing down on her. Six studios and a head office by Christmas. Urgh. She’d
forgotten to program in her summer holiday. Still, she didn’t have any plans
anyway. She vaguely listened to the rest of the teleconference and got up
when it closed.
“Well done, Marianne. That was absolutely superb,” beamed Graeme. “You
really did us proud.”
“Yes. Well done, Marianne. That was really good. You really looked and
sounded the part and your plan is bombproof. Well done, indeed,” added
Andrew, smiling. “You’d better get started on the studio assessments and
begin implementing the firm measures. But first, get some lunch and take
it easy for the rest of the day. Winona can wait.”
Marianne felt pleased and wore her best Cheshire Cat grin as she sat down
at her desk. Her phone was blinking a voicemail from Winona. Definitely
time for lunch. She wasn’t really dressed for most of her favourite lunchtime haunts, so she decided to walk down to Wellington and across to
Yonge. She had nowhere specific in mind and was wearing heels – not the
best combination. Still, the air was cool with a slight breeze. Spring was
definitely in the air. Eventually, she dropped into Le Marché[10] and got
herself some roast chicken and a side salad. The first proper food in two
days. What was she doing to herself? She sat and contemplated all that had
passed.This project had totally consumed her, every waking moment. She’d
have to slow things down a bit. Perhaps she’d pushed it so hard because she
was somewhat out of her depth. Then again, she’d pulled it off.
Marianne was back at her desk for 3 p.m. and began working on the
implementation plan for the firm measures. Winona would be key to this
and she suddenly remembered that she had left a voicemail. She wanted to
know the implementation sequencing, resource allocation, and timelines.
Marianne finished her implementation plan in MS Project and sent the file
with a brief email to Winona, thanking her for her assistance. She closed
down the computer and walked out of the studio and east along Dundas.
It was 6 p.m. and a little early for dinner, but she’d enjoy a cocktail on her
own before her family arrived. Crossing University and Bay, she turned
north along Bay to Elm and then east again to the Queen & Beaver.[11] She
passed by Oro and was surprised that Harry hadn’t picked there. She really
liked Oro.[12]
“Hello, Darling. How’d it go?” asked her mother. She looked concerned
with her unusually wrinkled brow.
“It went really well. They approved everything that I recommended and
we are moving into the next phase. I think that they liked me, but too
early to say. We’ll see, I guess.”
Her mother smiled and reached out for a hug. “You look fantastic.”
Her mother had been perched at the bar when Marianne arrived. She was
a little surprised, not just that her mother should have got to a pub early,
but that she would perch on a bar stool. She was probably young once,
mused Marianne. They moved to their table and enjoyed their drinks with
some idle chat. It occurred to Marianne that her mother must have been
quite worried about her.
Marianne heard a familiar squeal and looked up to see a beaming Sandra.
“How’d it go? Gosh, you look amazing. Every bit the businesswoman.
Wow. Tell me. Tell me.”
Harry hovered behind as Sandra hugged Marianne and kissed his mother.
“You look happy and tired. It must’ve gone well, Marianne.”
“I think so. Thanks.”
“I always knew that you’d knock ’em dead. I’m proud of you, Marianne.
Dad would be too, I know. Let’s order, I’m starving and the food is amazing
British gastropub.”
“I’ve just texted him. He’s been pestering me all day and he’s not even in
the country,” said her mother, giggling.
Everyone had been worried for her. Marianne felt a little taken aback.
It felt so good to be here, now, with family. The atmosphere was cozy
with a fire in the grate, eclectic crockery, and kitchen tables. Everything
just felt right. Perfect, in fact. Yup, Harry really did know how to pick a
good restaurant.
DISCUSSION POINT: Having secured approval for the firm
resilience approach, should Marianne develop a standard templated solution for all studios or a framework approach that is
adapted differently by each location?
Integration, April 24-30
In which Marianne develops the implementation plan for the
agreed resilience strategy, and learns the difference between working
securely and security, risk thresholds, and systems integration.
Marianne arrived in the studio feeling remarkably good.There was even an
outside chance that spring was about to make an entrance and somehow
everything felt lighter and cleaner. Much of this was the intense relief of
delivering her scheme to the board yesterday, but through it all she actually
felt for the first time that she understood. She understood the organism
that is the firm; this living entity full of all the logical dependencies and
vulnerabilities of any system wrapped in the complex relationships and
contradictions that are the staff, clients, and stakeholders. She understood
how things connect and how different functions and actions influence
each other. She knew that her scheme would work and was proud of its
simplicity. It was wonderful how the final product of such complex analysis
can be something so simple and logical. Clean was about the only way she
could describe it. Winona’s demand would be easy to meet this morning.
However, the security piece needed drilling into and she scheduled an
office call with the beard.
The morning flew by and before she knew it, Marianne was sitting in the
too-familiar Skule[1] pit in the Galbraith Building[2] basement contemplating a bowl of curry[3] before her appointment at the CRCI. There was
something about eating out of a plastic bowl that she’d hoped was behind
her, but the curry tasted rather good. At precisely 2 p.m., she went up to
the CRCI office and knocked. She had barely had a chance to withdraw
her hand and the door was opened by a new face.
“Hello. Marianne, isn’t it?” he said beaming with his hand outstretched.
“Yes. Hello. I’m sorry … is err … ?” replied Marianne.
“Yes, we’re both here. He told me about your questions around resilience
in networks and balance of demand. Fascinating stuff and we’re thinking
of something related for SmartGeometry[4] in Hong Kong this summer.”
The beard was grinning from ear to ear and clearly far more relaxed than
when she’d last seen him. Maybe it wasn’t just her and there was something in the Toronto water that just made everyone happier today. “Yes,
that’s right,” he gushed. “We’ve come up with a hydraulic model. It’ll be a
mess and excellent fun.”
Marianne was surprised that two of the cleverest people she had ever met
were beaming over the messy fun that assembling a simple water model
would provide. Of course, it represented something highly complex.
Even so.
“Our industry partners confirmed today. So that’s good and we’ll have a
couple of US colleagues joining the team also. It’s very exciting.”
Marianne didn’t quite register who just spoke and she was struck, not for
the first time, how similar they sounded.
“So anyway. How can we help?”
Marianne explained what she had done and how things had gone. She
then explained how the issue for her now seemed to centre on response
and readiness for an incident, warning and, she suspected, culture. Both
smiled and looked thoughtful. Marianne tried a winning smile to break
the sudden silence but it didn’t work.
“Congratulations, first,” the beard began. “I think that it’s simply fabulous
that you’ve achieved what you have. Not many people are successful at
representing these concepts to a business audience, much less applying
them so cleanly.Yes, quite excellent.”
A little taken aback, Marianne beamed in the praise. The beard went on
to describe the idea of working securely versus working on security. It is
a matter of organisational culture and how that manifests itself in market
goodwill. Marianne stopped him and asked him to provide a step by step
explanation, which he did. Much of what he said resonated with what
Marianne had heard before from Mac or already deduced for herself.
Nonetheless, it was very useful to have it all connected together and the
gaps filled.
“Consultancies seek to achieve a trusted advisor[5] role with their clients.
This is the most personal of business relationships and says that the advisor
has the best interests of the client at heart; that the client comes first. A
substantial part of this trust is demonstrated by how a consultant treats
the client’s assets and interests. For planning, architecture, and engineering
consultancies this will often be in the form of large amounts of proprietary
data that defines processes and future capabilities for which infrastructure is
needed. The expectation is that the consultant will protect the client’s data
and treat it with sensitivity. It therefore follows that if the data is compromised while in the consultant’s possession, the trust relationship is dented
and could even be irrevocably lost. Design consultancies typically have a
creative culture that is open and relaxed. In some organisations, this can be
reflected in their approach to security and data. In fact, consultancies are
one of the best vehicles by which to target a specific client.
“Let’s suppose that we wish to steal or compromise some asset or operation in an industry competitor or a government department. A brief study
of internet traffic around that target organisation will reveal which consultancies are linked to them and which ones have current projects. We now
focus on the consultancies and identify how they do business. We send an
email to one of the staff with a subject matter that is likely to be referred
to a principal working with the target organisation. The principal opens
the email from the associate because she trusts him. The client opens the
email from the principal because he trusts her. Attached to the original
email is a virus, which attaches to any email going in the right direction.
Through slowly climbing the trust ladder in the consultancy, we eventually
get across into the target organisation. While the reality is not quite so
simple, the threat vectors concept holds. The security rating of firewalls can
be detuned in some organisations to allow open research and access, but
it also increases vulnerability. Consultants need to recognise that they are
threat vectors and behave accordingly to protect their client’s interests. It is
entirely a question of culture.”
Marianne stopped scribbling and now started to listen carefully. This was
getting more into the heart of the matter.
“When the consultancy has a culture that recognises the need for security and so habitually works securely, the risks of client data compromise
are reduced. When the culture does not recognise this need or the threat,
imposing stricter security controls results in a backlash and various measures and procedures being circumvented. Culture is key and it needs
to be led by example from the top and supported by education of all.
Some designers will rail against such measures as stifling their creativity,
but irrespective of how open the culture is, some form of business change
management will be needed to get to the right organisational and security
culture. Conversely, when working on a security project, the need to work
securely tends to be more implicitly understood.”
The beard paused and looked at Marianne. “All good?”
Marianne nodded. The beard looked at the ceiling fan for inspiration and
resumed his explanation.
“When planning a security scheme, it needs to be set within the wider
risk management plan. Since we are dealing with operational risk, rather
than pure financial or strategic risks, we are concerned primarily with the
function of the operation and securing these functions. Security is one
of several aspects of operational resilience. The operation is enabled by
personnel, the organisation, and infrastructure, and each of these components is inherently connected to the risk context. Consequently, we have
a complex mesh of networks and inter-relationships. The personnel aspect
of risk is represented by personnel security and personnel protection.
Personnel security is what we have human resources for. They ensure that
we recruit and select the right quality of individual particularly suited to
the role. Personnel protection is the business of physically protecting our
people from harm or compromise and a rapidly evolving branch of risk
management. The organisational aspect of risk is represented by IT security and ECM – Electronic Counter-Measures. It is the connective tissue
of organisations and the operation. It enables communication of information, supervision, and coordination. It needs to be protected and secured.
Finally, the infrastructure aspect is represented by physical protection and
physical security. Physical protection is what you incorporate into the built
environment to protect the infrastructure assets that enable the operation,
directly or indirectly. Typically, these involve robustness and adaptability.
Physical security is all of the security systems that we see installed around a
site, from CCTV cameras to intruder detection systems (IDS) to perimeter
lighting. Once you have a resilience plan, namely how you can safeguard
the survival of the operation, you are in a position to develop incident
response plans, revise the business continuity plan, and review the disaster
recovery plan and the security integration scheme.
“The security integration scheme assigns the different requirements to
the six branches of security, supporting the three operation components.
The key driver in this is the first principle of Critical Infrastructure
Protection – Do No Harm.[7] Specifically, no security measure may
impede normal operating efficiency or that of another security measure.
It also means that we cannot adversely change the risk exposure of third
parties through our actions. For example, if we put flood protection around
our patch of paradise and it causes our neighbour to be flooded where he
would not ordinarily have been flooded, we will have contravened the first
principle, as well as exposing ourselves to a potential nuisance or negligence claim. The other principles are that no protection is absolute[8] and
everything will change.[9]
“When we come to the master planning stage of the project, we are in a
position to incorporate most of our protection measures into the fabric
of the site and so reduce project and through-life costs. Some planners
have reported as much as 60% or even 70% savings overall, though this
will have included the savings arising out of risk reduction. There are a
variety of tools and models that you can use at the master planning and
technical integration levels, such as the MI5 Operational Requirement of
Security Measures,[10] which has become the de facto international standard
for perimeter security. Irrespective of the integration model or framework
used, it is always worth ascertaining whether the underlying assumptions
are appropriate to the situation in hand. Estimates on the misapplication
of standard processes, such as CARVER 2,[11] would suggest 40% or more
of the situations/sites that it is applied to were not compatible with the
model assumptions. In truth, this is difficult to really know for sure, but
what is clear is that an awful lot of protection money is being wasted.”
The beard glanced over at Marianne, who had resumed scribbling. “Am I
going too fast for you?”
“No, not at all. Thanks. Please … err,” mumbled Marianne without
looking up.
“CARVER and similar models are part of the suite of threat and risk
assessment tools. In Canada, the RCMP’s Harmonised Threat & Risk
Assessment[12] protocol would appear to be the commonly understood
framework across government and industry throughout the country. There
are variations by industry, such as the Security Vulnerability Assessment[13]
protocols produced by the American Petroleum Institute or a regulated
protocol such as the US DHS Transport Security Administration’s Pipeline
Security Guidelines.[14] The key is to understand the thought and analysis
process of operation – context – hazards – risk analysis – resilience plan
– security integration scheme – security integration. The two documents
that will stay with this process from beginning to end are the Calculation
Plan[15] and the Surveillance Trace.”[16]
Marianne coughed. Her hand ached from note taking and she wasn’t quite
sure if she’d got past the mental image of Winona haranguing the chairman
when the beard spoke about the importance of HR. The beard paused.
“There’s an awful lot in that and I sense that we are getting into a completely new field somehow.”
“In a manner of speaking, we are. You see, when you look at the operations at a particular site, you are looking at that site as part of a network or
system. Operational survival is far more than ensuring that you can recover,
it is also about securing some assets, duplicating others, and protecting yet
others.You need to understand your vulnerability.”
“Okay, I get that. But what I’m interested in is a studio.”
“Absolutely. But in order to develop a resilience plan for that studio – to
know what is required during routine, reaction, response, and recovery —
you need to know how the operation is affected and the changing risk
profile throughout the incident sequence. For example, the loss exposure
of the operation changes when protection measures and components are
damaged and it needs to rebalance. It therefore comes down to a question
of risk thresholds. How much risk is the organisation willing to accept, and
by extension how much disruption to the operation.”
Marianne was expressionless. Somewhere, she had lost the thread.
“Risk thresholds?”
Marianne’s expression hadn’t changed and the room fell silent. The beard
looked at his colleague, as if pleading with him to answer.
“Okay. Every organisation has risk criteria.[17] This is an articulation of the
risks they face and how they affect the organisation and the operations.
Included in these criteria are clear graduations of how much risk is acceptable, also known as optimum risk.”[18]
“Oh yes, the risk treatment progression where we treat the likelihood and
severity of the inherent risk to attain residual risk and then further treat to
get towards optimum risk.”
“Exactly right.”The beard nodded approval. “In having identified the levels
of risk that the organisation will accept or tolerate, it has also articulated
what amount of disruption to the operation it can reasonably absorb. We
need to protect against that background level of risk – the frequent low
impact events that would nevertheless cause a disruption if not dealt with.
However, the cost effectiveness of protection reduces as the risk severity
increases and the likelihood reduces. Eventually, it is better to invest in
being able to recover when the protection fails than trying to build ever
greater protection. In fact, there is a tipping point in the investment profile
where increasing protection actually impedes the operation, causing the
very thing that it is there to prevent. The trick is to find out where that
tipping point is – where the optimum level of protection is, Фβ.”
She just knew it. Whenever people started talking mathematics, Greek
symbols start to appear and it all goes south. “Фβ. If there’s a Фβ, I’m supposing that there’s a Фα. What is it?”
More enthusiastic nods. “Exactly. You see, when you have been able to
optimise Фβ, you are in a position to see what compliance measures can be
aligned towards that Фβ level of protection. Those compliance measures are
known as Фα. Once you’ve been able to align wherever you can, you can
calculate the actual cost of protection, Фβ minus Фα. What the CRCI has
been working on for some time now is determining the optimum balance
of investment between protection and resilience for a given operation in a
given context. Cool, huh?”
It made sense. It’s one thing to optimise the balance of protection – resilience investment for major capital projects — but for a simple studio the
concept holds true even if a prolonged optimisation analysis doesn’t make
sense. She would need a balance between treating the hazard risk directly
– protection and security measures – and operational recovery measures.
Key to this would be the prioritisation of essential functions that she’d read
about. The pieces were coming together and she could see how it all fit
together. Awesome, she thought. “So, could you just explain how essential
functions fit into this?”
“Of course. They are the key to everything. When you analysed the operation, you identified certain essential functions that define the absolute
irreducible minimum functionality, below which any response or recovery
would be impossible.[19] The essential functions will have very fine tolerances and are the focus of your protection, as are the infrastructure and
services that they rely upon. Restoring essential functionality is the reaction phase of the incident sequence. The other functions of the operation
are similarly prioritised by threshold tolerance of interruption. All of the
non-essential functions are then sequenced on the basis that if they have all
ceased, how would we bring them back on line. This functional recovery
sequence is strictly defined. When an incident happens and we successfully
react, the response phase is specific to the situation and will involve restoring functions necessary to achieve a sustainable level of operations. These
functions restored during the response phase will not reflect the recovery
sequence. Therefore, when we are ready to begin recovery, it is necessary
to work through the recovery sequence deliberately. Where a function
has been restored, this simply means that the step is no longer needed for
recovery. However, what often happens is that during the response phase,
restored functions are only partially restored and supplementary work is
required through the recovery phase.”
It finally made sense. Marianne knew that they were still only scratching
the surface of this particular discipline, but it made sense to her. She glanced
at her watch and stifled a minor yelp. “I’m so sorry, I’ve really got to rush.
Can I come back for an explanation of the surveillance trace tomorrow?”
“Friday,” said the beard. “Thursdays aren’t good for me.”
“Okay, great. Thanks so much. I can’t tell you how much your help means
to me. Thank you. I’m so sorry, but I really must dash.” And with that she
left the office, pulling her coat on as she went.
“Christ! I’m supposed to speak with Andrew in ten minutes. Arrrgggh.”
Though said to no- one in particular, it made her feel marginally better
to voice her mild, though rising panic. She pulled out her mobile and
dialled Andrew’s number. Engaged. She called Susan. This was going to
be an international call and expensive. She really must get a local number.
“Pick up!”
Susan picked up the phone and Marianne apologised profusely and asked
if she could be given an alternative appointment later or tomorrow.
“8 o’clock tomorrow?”
What to do now? Marianne decided to lay this new understanding out
over what she understood of the Calgary and Toronto studios. She stopped
rushing and looked again at her watch. It was 4:30 p.m., it could wait.
Time to regain some semblance of normal work routine. She went back
to the studio and arranged her notes, answered a couple of emails, and shut
down. 5:30 p.m.
At her meeting with Andrew, she suggested using the Calgary studio as
a template for the other studios to follow. He agreed with the idea of
providing a standard example for the other studios to see, but insisted that
she do Toronto first. He had also found a potential alternate site in Mimico
/ Alderwood close to the new Toronto Detention Facility.[20] Marianne
assembled the incident file and broke down all of the essential studio functions and their dependencies. She compared these with the operational
tolerances and was able to say what needed to be protected or duplicated
or altered. She sat for a while with Scott to refine the location risk analysis
maps and focussed carefully on the industrial complex Andrew had told
her about.
It was 9:30 on a cool crisp Friday morning. Marianne stepped off the
15 bus and looked about her. A groundhog was ambling through the old
Psychiatric Hospital Cemetery and Marianne watched as it passed by
the rows of flowers. “Poor souls,” she said to herself and turned south to
walk towards the industrial units. The premises turned out to be far larger
than she imagined looking from the outside. The partner was a landscape
company that had once included a full capability design team, but no
longer. The old design team facilities were near perfect, if a little tight.
She measured the space and recorded numbers of phone drops and power
outlets.There appeared to be plenty of power, though internet access could
be an issue. She would need to return next week with the IT guy and their
practice manager. She looked outside. There was plenty of parking and the
TTC wasn’t too far away. No kitchen, but other amenities were available.
She asked the receptionist about whether there was any furniture. It had
apparently been sold when the design practice was closed and the office
mothballed. A sandwich truck visited the complex at 11 a.m. and 4 p.m.
each day, which seemed okay to Marianne. It’s not Spadina, but it’ll do in
an emergency.
She returned to the studio and spoke with the practice manager and IT
guy. At thirty, Marianne didn’t think of herself as old, but she certainly
felt her years when she looked at IT. It turned out that David was actually twenty-seven, but Marianne would have bet money that he was no
more than eighteen. She sketched the layout of the site and explained what
they needed to do on Monday. Sharon said nothing and nodded as she
made copious notes. When Marianne had finished her description, she
asked if there were any questions or comments. Sharon walked up to the
whiteboard and, selecting a different colour, sketched in the arrangement
for twenty-four workstations, six with layout tables.
“This should work,” she said and looked at David. “Do we have the spares
to set up a server frame and the trunk loom? Marianne, do you think that
we can keep some basic IT infrastructure on site, perhaps even a few desks
and chairs?”
David nodded slowly.
“I don’t know, I’ll ask,” said Marianne cautiously.The project had just taken
an unexpected turn.
“Good. Well, here’s what we’ll do.” Sharon went on to outline a detailed
plan with resource allocation and a shopping list of long lead items.
Marianne was floored. She had been so wrapped up in her own issues with
the resilience assessments that she had not only been unable to meet many
of the studio staff, but hadn’t imagined that others would have the skills to
support her. Her perception had been entirely fixed by her own journey
of discovery. She started to relax, relieved that she could clearly leave this
alternate facility arrangement to the Toronto studio practice manager,
Sharon.When the meeting finished and everyone knew what needed to be
done over the next week, Marianne nudged Sharon and asked “You were
great in there. How did you become such a good organiser and planner?
Your spatial arrangement was amazing.”
“I was a signals officer in the army. We used to set up mobile command
posts and this isn‘t much different, except it has a washroom.”
“Wow. What made you leave?”
“I didn’t really. When I had my children, I decided to transfer to the
reserves. My husband still serves and he’s always overseas, so at least this way
we can remain stable. I’m looking forward to this little project. Reminds
me of old times, on exercise in Alberta.”
Marianne was blown away. “Wow. Well, I’m so happy that you are on the
team. Thanks.”
They chatted a while longer. When Marianne returned to her desk, it
occurred to her for the umpteenth time that she really needed to get to
know the studio staff. It’s been the best part of month and I still don’t know more
than a handful of people. Marianne collected her coat and bag and set off for
lunch and her appointment at the CRCI.
Marianne was sitting in a chair tucked between the hat stand and the
filing cabinet. It gave her a sense of detachment. She remembered, as a
child, standing concealed between the heavy winter coats and watching
her mother getting Harry ready for school and calling to her to get ready.
She looked at the bare walls of the CRCI office, painted with an institutional light blue and not in the least uplifting. How do they work here? She
wondered. The beard was collecting his thoughts for what seemed like an
eternity, looked at Marianne and resumed his explanation.
“Think of the earth. We start at the centre and look at each aspect of
the site as we ascend through the centre of the site and up to the stars.
It’s easier to think of it that way than reeling off geology, hydrology, soils,
hydrography, geography & topography, meteorology, and cosmology.[21] We
then return to the centre of the site and petal out and back a full 360o
around the site to understand the physical environment. Of course, it is
important to have an idea of what your area of operations and area of
influence are, but this process will help you work out your area of interest.
The area of operations is where you have control over what is done in
that space. It may or may not be defined by the boundaries of your land
ownership. The area of influence is where you can influence activity and
infrastructure decisions. The area of interest is the area around your site in
which actions can affect your site. For example, the rainfall catchment area
would be an area of interest. Areas of interest will vary by the hazard that
the site is exposed to, whether directly or indirectly. Make sense?”
Marianne had been scribbling furiously for a couple of hours by this
point. The beard had gone through the concept of travel time[22] from
first principles and explained how each hazard will have its own travel
time evaluation, though many will align with each other. These are laid
on the site tableau so that coincidences of detection areas can be used to
determine sensor and confirmation requirements, as well as inform the
response periods and delay requirements. Marianne had asked how one
might narrow down the possibilities and the beard described Intelligence
Preparation of the Operating Environment (IPOE)[23] and various other
tools. Eventually, he resorted to a first principles description and Marianne
was again fully tuned in.
“So if I understand you correctly, you are analysing the physical context
of the site, from transport infrastructure networks to flood catchments to
utilities infrastructure, soils, solar flares and so on.”
“Okay.We use this understanding to determine the likely approach avenues
and so the detection and indicator points — and this is the essence of the
surveillance trace, which we use to integrate all the security systems at the
master planning stage.”
“So explain to me once more what a tableau is. Have I missed something?”
“Not at all. The tableau is simply the physical environment in which
our operation exists and which we base our planning on. It is simply a
construct defined by our understanding of the physical world, specifically
what our operation needs of the context. When we talk about dispersed
networks, you’ll see that we can project the tableau for a given operation.
Do you recall when we spoke about community resilience being enabled
by operational resilience?”[24]
“Well that community exists as it does because of the land on which it
finds itself, the infrastructure that enables the community functions and
stimulates certain community behaviours. Jane Jacobs,[25] Joseph Aicher,[26]
et al?”[27]
Marianne felt on somewhat firmer ground again. “So it’s just a model that
we take as the baseline for our planning and analysis.”
“Exactly!” the beard beamed. “Like the green mat that you use for
Lego creations. Hmm, that’s rather good. I think I’ll use the green mat
analogy again.”
That’s clear. Why couldn’t he say that to begin with and save us twenty minutes?
This resilience malarkey wasn’t so bad. Once you get passed the system of systems
complexities, the practice isn’t that bad. At least it’s logical and can still be done from
first principles. “Perhaps there’s scope to automate this?”[28]
“Oh, yes. We’re working on that now.”
They continued for another hour, then the beard introduced a new idea
that threw Marianne a little.
“We’ve been looking at the dependency cluster piece in more detail and
have identified a series of coincidences between community failure and
high-rise high-density living and food deserts. Many of the high-rise
developments are planned in two dimensions. No account has been taken
for the forty-eighth storey dweller who still has to get to food when there
is a power failure and the elevator is inoperable. We need to plan in threedimensions and position our community facilities and amenities for equity
of access. Furthermore, the received wisdom that densification leads to
reduced infrastructure burdens is incorrect. The heights that we need to
pump water for much of this high-rise development means that we need
high pressure mains, electric water pumps, and a fire hydrant system that
needs to be adequately charged that a fire tender can still pump water up
a wet riser without the standpipe cavitating. These things require more
stand-bys and safeguards and need to be installed and maintained to a
higher standard. Also, this concentration of value represents a greater loss
exposure. The consequences of loss are far more than they were. The other
curiosity is that when we reviewed the failed communities, in virtually
every case the catalyst area was also a food desert, irrespective of whether
the area was wealthy or poor. Vulnerability is not exclusively related to
wealth. What do you think?”
Marianne was fascinated. This was an aspect of urban design and planning that interested her and much of what the beard was saying challenged many of the simplified mantras that she had been taught and heard
even now in the city. It felt good to be contributing to the discussion, as
opposed to being a student again. She came away at 6 p.m. with a feeling
of exhaustion and a minor twinge of concern that she had just agreed to
be part of a research project. “I can’t volunteer for this. As it is, I’m chasing
my tail.” Even as she said those words, she knew that she was hooked and
would join the research team.
Marianne went straight home from the university. There was so much
going on in her head now that she regretted allowing herself to become
distracted from her main project. She changed into her sweats, made
herself some supper, and settled back down to work. She spread out the
Toronto maps and all the notes on the dining room table. She then laid out
the incident file sections and began reviewing for firm measures, studio
preparations, and studio actions during an incident. Assuming all of the
firm measures were adopted, the essential administrative functions could
continue, if the studio remained functional. Therefore, if the studio is hit
by an event that effectively isolates it from the rest of the firm, it can function administratively alone. The issue becomes whether it can continue
production and that depends upon the server, which depends upon the
infrastructure. This means that the studio needs its own safeguards to continue production. If they need to relocate production to the alternative site
in South Etobicoke, they still need to be able to back-up and restore data
so that it can be physically transferred.
Marianne felt confident that Sharon would deliver and so had fewer concerns about the alternative site than about what the landlord would allow
them to do at the studio itself. When she had finished, it was past midnight.
She had a clear list of tasks and confirmations. With a sense of again being
back in control of her project, she retired to bed and was soon asleep.
By the end of April, Marianne had a workable studio resilience plan. The
board had agreed to the firm IT measures, to be implemented over three
years as part of the evergreening process. Sharon had planned the alternate site refit to the last detail, including furniture, water fountains, circuit
prioritisation, stand-by generators, and even the cable lengths for each
workspace from the server. She had spoken with their telephone provider
and received estimates for a data connection. She also had quotes for the
electrical refit of the space. She was clearly relishing the opportunity and
it occurred to Marianne that Andrew might wish to offer Sharon to the
other studios to assist them. Then again, if she had settled in Toronto and
retired from the army because of their children, it was unlikely that she
would welcome spending the next six months on the road. Her discussions
with the landlord had been entirely underwhelming. He really didn’t care
and though he nodded enthusiastically, he didn’t understand what she was
asking. They could rationalise their power demand in an emergency, but
the cost of a stand-by generator promised to be prohibitive. It was looking
like being prepared to relocate quickly to the alternate facility would
be cheaper, including the fit out costs and ongoing rental, than having a
stand-by power supply arranged in the downtown off Spadina. She had
double-checked that there was negligible risk correlation between Spadina
and South Etobicoke. There were no examples of both being affected at
the same time over a forty-year record. However, it was clear that both
are linked to Manby Station. The main customers in that area are Lantec
Sugar, the Detention Centre, VIA Rail, TTC Bus Depot, and GOTrain.
Other industrial customers like Campbell’s round out the demand picture.
In all likelihood, each would have their own emergency power supply, but
the sorts of neighbours around the alternate facility gave her an illusion
of assurance. She had presented her cost forecast to Andrew with NPV
calculations incorporating the benefits of risk reduction. The business case
was clear and, she felt, compelling. Andrew understood this, but would the
board approve this sort of risk management expense when many clung
to the belief that bad things don’t happen in Canada? Besides, Jamie had
metaphorically waved the Grosvenor report[29] at her when she was asking
about risk management costs. All she could do now is wait. Time to read
into those projects again.
DISCUSSION POINT: How would you influence a creative
culture to work securely?
Resilience Plan, May 1-2
In which Marianne begins planning the alternative operating
site for the studio and takes over her new apartment.
Thursday. May Day. Aren’t we supposed to be on holiday, dancing around Maypoles
and generally making merry? thought Marianne. It felt cold and miserable
with a thick fog clinging around her parents’ neighbourhood. So much for
spring.This passes for winter in Vancouver.
Marianne harrumphed as she sat at her desk and glowered at the computer.
The turn in the weather had really got her down and she began to wonder
whether she really wanted to be back in Toronto.
“Hi. How’s it going?” Scott interrupted her misery with irrepressible happiness. It was infectious.
“Oh, hi,” Marianne smiled back. “Just readjusting to the studio after a
weekend relaxing.”
“I don’t believe that. You must’ve been working over the weekend. You
have worked non-stop since you arrived and silly hours. We were wondering where you get your energy from.”
Marianne grinned again. “Oh, you know. I did absolutely nothing all
weekend and it was glorious. Really.”
Scott was clearly unconvinced. “Well, I’ve finalised the Toronto and
Calgary maps – everything checked and cross referenced, so you can reference them as, err, auditable. That’s how you described them, isn’t it?”
“Absolutely, Scott.You’re wonderful. Thank you.” Marianne beamed as she
accepted the drawings and immediately unrolled them on her layout table.
They were immaculate, with each hazard effect reference and linked. Scott
had clearly outdone himself. Meanwhile, Scott sauntered off, obviously
very happy. Marianne called up the draft incident file on her computer
and looked at the links between map annotation and report. All perfect.
This complete set would be ready to go for Toronto as soon as Andrew
got approval for her proposal. “Thank God for Scott and Sharon,” she said
aloud, just as Graeme walked round the corner.
“Andrew has approved your proposal. Time to implement, but I suggest
that you get all the contracts sorted out with the landscaping firm first.”
Graeme didn’t even bother to stop or linger and continued walking. He
too was grinning. It’s a conspiracy of joy, thought Marianne. She went off to
find Sharon, before going once more to South Etobicoke.
As Marianne was finalising the details with the landscapers, Sharon and
David turned up with a couple more people armed with millboards
and tapes.
“What’s going on?” asked Marianne.
“You said that we should get started. Well, we are doing the final measure
up and will see if we can sort out the furniture cheaper round the corner
at IKEA.[1] I figure that as long as we stay within the budget, we’re fine.”
Marianne wasn’t so sure, but it sounded reasonable. She agreed.
Marianne made it to the university for 1 o’clock and just caught her new
landlord in time to collect the keys.
“Cutting it a bit fine, Marianne,” he said. “I’m just closing up my office to
leave for Europe.”
“I’m sure that you’ll have a lovely time,” smiled Marianne and went on to
thank him profusely for trusting her to look after his condo. She continued
to the studio and went over her project notes once more. Sharon has the
bit between her teeth and would provide within budget and most likely
ahead of schedule. The question was how to turn this into a template for
the other studios. The latter stages of this project had been quite disorganised and she realised now that many of the decision processes had been
more by the seat of her pants than actually deliberate. She spent the rest
of the afternoon working out every stage of the planning process. She
would get Sharon to review it and ideally take ownership of building the
template. By the time she finished, the sky outside was heavily overcast and
getting dark. She couldn’t shake the feeling that she was missing something
fundamental. She cleared her desk and put on her coat as she stifled a yawn.
As she stared out the window of the streetcar at the Queen Street shopfronts, it occurred to her how diverse the Toronto neighbourhoods are.
The city is such a melting pot of race and culture. It epitomises tolerance
in all it is. “That’s it,” she said aloud. No one paid her any attention. The
weak link in the whole studio resilience plan was culture, specifically the
organisational culture of the studio. Andrew and Graeme get it; Jamie does
a little, but not really. The clones will get whatever Andrew gets. But what
about the associates? Sharon gets it and will influence the administrative
and finance staff. It’s the architectural and planning associates. In a burst of
clarity, Marianne realised that this was like the business change management project they had done on her MBA, strategizing how to influence
the culture shift within the company in order to support a new capability.
The studio example was no different. That’s what was missing. The final
act in the project. She would need to come up with a strategy as soon
as possible and start it immediately, while the other work was going on
in parallel.
The next day, her mother drove her to her new digs. They would move
her things tomorrow, but for now, Marianne just wanted to stake her claim,
make the bed, and put some basic provisions in the fridge and cupboards.
She walked on to the studio feeling good. She was once again an independent woman and she knew how to make her wonderful plan a lasting
success. The morning flew by. At noon, she met Sharon and they walked to
Caplansky’s[2] for a long lunch before walking back to the studio. Marianne
detoured via a post office to arrange a mail redirection to her new address.
Over lunch, they had put the finishing touches to the template version of
the Toronto incident file for the others to imitate. Sharon also had some
excellent ideas about how to convince the key influencers in the studio.
They both felt quite conspiratorial at the end of it. Marianne had also
asked Sharon if she would mind going to the other studios to help lead the
local resilience plan development. Sharon appeared quite excited by the
idea, but said that she would need to discuss it with her husband before
committing to anything just yet. Somehow, Marianne just knew that it
would now all come together. Sharon driving the incident file development and Scott supporting with the local location risk assessments and
those extraordinarily good risk context reports “What a team,” she said to
no one in particular as she waited in the queue for the post office counter.
DISCUSSION POINT: Presented with the same project, how
would you now plan your approach? Does it need to be separate firm and studio resilience plans? Is there scope to integrate
the schemes more? How much do you need to understand
about the operation, organisation, and context in order to
be successful?
How does equity of access to transit influence the ability of a
community to self-recovery?
Is a WHO ‘healthy community’ a resilient community, and why
or why not?
Was Jane Jacobs right, and why? Was Peter Ustinov?
Who has the greatest influence on whether an organisation will
invest in an operational resilience strategy and why? Who or
what are the other influences?
You own and manage a major commercial development in
mid-town Toronto. How do changes in the local community
influence your operational resilience and how do your actions
influence the community resilience?
How does an infirm elderly person living alone on the twentyfourth floor of an interstitial community high rise building feed
and warm herself during a prolonged winter power outage?
A basic principle of governance is that the beneficiary pays.
How would you design a governance structure to address the
financing and administration of resilience measures against
flooding that crosses multiple jurisdictional boundaries?
We use framework models because they can be adapted to the
culture and structure of the organisation and so aid adaptation.
What else can we do to address an unreceptive or risk averse
organisational culture?
Can the ‘electrical city’ be a Resilient City?
Safe to Fail or Fail Safe; should our codes of practice be changed
to reflect resilience thinking? Provide arguments for and against.
Understanding is the key to developing an effective resilience
strategy. What can we achieve when we don’t adequately
understand the operation in its context?
What are the defining characteristics of organisations that will
actively manage risk and adopt a resilience strategy? How
great an influence does society’s attitude to risk have in this?
What criteria would you consider in deciding whether or not to
undertake a resilience assessment?
Much of resilience assessment practice revolves around the idea
of assurance. How would this influence your decision to invest
or divest assets in a particular municipality or location, and what
tools might you use?
Can we ever achieve a resilient solution?
As an interested denizen, do you perceive your city as resilient
and why or why not? Is this influenced by your confidence in
the local, regional, and provincial leadership?
The story is a fusion of twelve different projects taken over an eight year
period with tidbits and illustrations from another dozen. Marianne’s
employer, MTW, is an amalgam of seven different companies with the issues
exaggerated to highlight the learning points as Marianne reasons her way
through the problem. I therefore intended for MTW to be something of
an enigma where the issues that Marianne unearths would ordinarily cause
any normal company significant vulnerabilities and operating problems. I
have represented some of MTW’s quirks in, I hope, a lighthearted way and
I dare say that a few readers will recognise some of the traits. Furthermore,
the nuances of each of the issues that Marianne unearths should provide
interesting discussion around the organisational culture, how it varies across
the different studios, and how it influences local risk perception. Of course,
the story timescale has been compressed considerably, though the time and
effort represented for a location risk analysis and similar methods is broadly
accurate. It is worth noting that even though Marianne is on a voyage
of discovery, she has brought considerable learning and real life business
experience with her. A student’s voyage of discovery is not usually so fast.
Many of these concepts are in abstract and not always clear at first reading.
Once you can see and understand how resilience planning relates to risk
management, whether traditional or enterprise-wide, the public realm and
urban design, security and protection planning and design, and sustainability and energy management, you suddenly discover that you are thinking about these problems holistically and in context. I sincerely hope that
this story stimulates the reader’s interest to investigate the subject further.
While every effort has been made to present an objective and unbiased
view of operational and community resilience in practice, there will always
be different views about policies and events. Armed with an understanding
of the principles and concepts, the reader will be able to make a better
interpretation of those perspectives.
I have been asked about the main characters. Each is very much based
upon a real person in equivalent positions represented in the story. While I
have the greatest respect and admiration for them in real life, I have taken
the liberty of exaggerating some of their characteristics and in a few cases
combining two or more personalities into one character.
This story is set in Toronto and I’ve included a broad taste of local pubs
and restaurants to provide an anchor in time and place. Places change and
this would certainly not provide any sort of good food guide, but they are
places that my principal character and I have enjoyed. In fact, this story
could have been set in any of the six cities that feature in the story where
the employer has a studio. I had originally set it in Seattle, which is a
delightful city in which to live and work; for the story, the perpetual earthquake hazard was a very real driver to think about resilience. I decided
to set it in Toronto simply because this book is written primarily for my
students at the University of Toronto. I would like to say, though, that
Toronto has a truly marvellous restaurant scene.You have everything from
fine dining to outstanding pubs and gastro-pubs to wonderful and wholesome traditional diners and everything in between. I remain ever hopeful
that the Toronto transit system will gradually improve and make more and
more of these delightful places accessible to visitors. It is a delightful city
to visit, live, and work. For my part, I think that Peter Ustinov might have
been a little harsh in his comments.
All references (with the possible exception of Winnie-the-Pooh) and readings reflect part of the syllabus of the APS1024 Infrastructure Resilience
Planning Course at University of Toronto. My thanks to my students,
family, and colleagues, without whom this book would not have been
possible. I sincerely hope that it achieves the aim of making a complex
and somewhat esoteric subject more accessible. I recognised early that the
original textbook was too dry, even though it was apparently the perfect
exam primer. My students and a couple of faculty colleagues had been
even quicker to point that out. I sincerely hope that you have enjoyed
reading it and that it has stimulated your interest in the subject. I would
like to think that you have reflected upon some of the discussion topics
that are included after the story. Did they give you pause for thought?
Some of these will be explored in class and are really intended to stimulate
the reader’s wider consideration of the subject matter and its application.
Perhaps I will see you in class, one day.
Causal Chain. The causal chain is cumulative consequence of an event
on an operation. Using the operation / function dependency map, one is
able to trace back through the dependencies to capture the consequence
of an event at each dependency link. This allows one to capture the full
operational impact of an event, as well as a cumulative market impact and
the direct financial cost of loss / compromise.
Cluster. Sometimes called ‘resource clusters’ or ‘demand clusters’, clusters
are groups with a common resource demand. Clusters are of particular
value when the common resource is obtained from a single source. This
would denote a dependency cluster.When this dependency cluster involves
an essential function, the dependency cluster can be considered critical.
Community Resilience. Community resilience is the ability of a community to absorb the effects of shocks and stresses and to recover rapidly
to a better condition than previously. The internal dynamics are complex,
though community resilience as a whole is enabled in part by operational
resilience of the infrastructure systems that enable the community to exist.
Emergency Management. The practice of risk management for life
safety during catastrophic events. Public Safety Canada defines it as the ‘the
prevention and mitigation of, preparedness for, response to and recovery
from emergencies (EMA).’
Essential Function. Essential functions are those component functions of
an operation that define the absolute minimum level of performance for
the operation to survive and recover.
Critical Function. Critical functions are those otherwise non-essential
functions that essential functions depend upon. They may be external to
the organisation and operation.
Critical Infrastructure Protection. The protection of all infrastructure
systems and services essential to the health, safety, security, or economic
well-being of Canadians and the essential functioning of government. It
encompasses a combination of pure protection (hardening & adaptation)
and recovery measures, balanced according to the nature of the operation
that the critical infrastructure system enables.
Incident Management. Incident management is the planning, direction
and coordination of the organisation’s reaction and response to an incident.
Operational Resilience. Operational resilience is ‘that essential ability of
an operation to respond to and absorb the effects of shocks and stresses and
to recover as rapidly as possible normal capacity and efficiency.’ University
of Toronto Centre for Resilience of Critical Infrastructure.
Reaction. The immediate restoration of essential functions following an
incident, irrespective of the nature of that incident.
Recovery. A strictly sequenced restoration of the enabling functions of
an operation to at least the operating efficiency of the operation prior to
the incident.
Recovery Performance Objective. The Recovery Performance
Objective (RPerfO) is the minimum sustainable performance of the operation. Generally expressed as a percentage of Routine performance.
Recovery Point Objective. The Recovery Point Objective (RPO) is the
point in time prior to the incident at which data and processes are restored.
Generally only used with computer and information systems, it is used to
refer to the back-up frequency, recognising the potential loss of data and
correspondence over an acceptable period. Generally expressed in seconds.
Recovery Time Objective. The Recovery Time Objective (RTO) is
the maximum time following an incident by which minimum sustainable
performance is to be restored. Generally expressed in seconds for information systems and hours for operations.
Resilience. In its most general sense (Holling 1973), resilience is about
the persistence of a system. It is the ability to absorb and adapt to the variabilities in the environment and persist. When applied to operational and
community systems, this is most commonly deconstructed to include the
restoration of functionality and self-recovery. Resilience is applied only to
animate objects, as it implies a decision-making capability to respond to an
incident and self-recover.
Response. Response is the deliberate and situation-specific restoration of
functionality following an incident. This would typically follow on from
the immediate reaction to the incident, though some sources include
reaction as part of the response. The purpose of the response is to restore
functionality to a minimum sustainable level of performance in order for
recovery to commence.
Risk Context. The risk context is the complete context in which the
operation exists. It comprises the all-hazards context, the operating environment (the systems that will continue fundamentally unchanged irrespective of whether the operation exists or not), and the operating context
(the neighbouring operations and systems that are affected by the subject
operation and its enabling components). The Risk Context is used to
define the [internal] enterprise-wide risks to an operation.
Robust[ness]. Robustness is a characteristic of inanimate objects and refers
to the general capacity to withstand or limit damage or injury in an incident.
Routine. Normal level of performance where applied stresses remain
below the threshold of protection.
Routine Function. Routine functions are those functions that are most
closely associated with routine performance. They are all those functions
that are not essential for the survival of the operation (essential functions)
or required for the sustainability of the operation (sustaining functions).
They may include critical functions.
Sustaining Function. Sustaining functions are those functions supplementary to the essential functions that must be restored in order for the
operation to attain a sustainable level of performance.
MTW – Mann, Twiss & Walker is a fictitious multi-disciplinary planning, architecture, and engineering firm named after three successive [British] Chief Royal Engineers in the Americas. William Twiss
1745-1827, Gother Mann 1747-1830, and Elias Durnford Walker
University of Toronto Centre for Resilience of Critical Infrastructure
(CRCI) has a professional forum, the Sandford Fleming Forum, which
engages the public and profession on current and emerging practice
and thought on infrastructure resilience. The Resilient Cities series of
three meeting were very successful. www.crci.utoronto.ca/sff.
Complete Streets is a general urban transportation policy and approach
to the planning, design, operation & maintenance of safe, convenient
and comfortable travel and access for all road users. First implemented
as a policy in Oregan, 1971, it was seen as a response to increasingly
unsustainable car dependency. Since then it has grown as both an
accepted mainstream urban design philosophy and a movement.
4. Abundant Access is a term coined by Jarrett Walker, a transit consultant, which is ‘that the underlying geometry of transit requires communities
to make a series of choices, each of which is a trade-off between two things
that are popular.’ www.humantransit.org. His book is a valuable read
Human Transit: How Clear Thinking about Public Transit Can Enrich Our
Communities and Our Lives. Island Press 2011
5. Healthy Communities is a feature of the 1948 World Health
Organisation health promotion approach ‘a state of complete physical,
mental, and social wellbeing and not merely the absence of disease or
infirmity’ and further developed as a concept in 1986. Its origins are
often attributed to Dr. John Snow who traced a cholera outbreak to a
water pump in Soho, London, in 1858. A useful and practical guide is
Joseph Aicher’s Designing Healthy Cities, Krieger 1998.
6. Jane Jacobs Death & Life of Great American Cities,Vintage 1992. A core
reference for students and practitioners of urban design, this book was
originally published in 1961 and has been republished and reprinted
by multiple publishers since.
Business Continuity Planning (BCP), as described in Elliot, D.; Swartz,
E.; Herbane, B. 1999 Just waiting for the next big bang: business continuity planning in the UK finance sector. Journal of Applied Management
Studies, Vol. 8, No, pp. 43–60 ‘identifies an organisation’s exposure
to internal and external threats and synthesizes hard and soft assets
to provide effective prevention and recovery for the organisation,
while maintaining competitive advantage and value system integrity.
The standard reference for BCP by the British Standards Institute
BS ISO 22301:2012 Business Continuity Management with a useful
guide developed with the UK Cabinet Office, Business Continuity for
Dummies, Wiley 2012. Increasingly, business continuity planning is
evolving into Business Continuity and Resilience Planning (BCRP)
as it evolves and incorporates the broader risk context and dependencies mapping.
Operational Continuity is often confused with Business Continuity
Planning and sometimes called Disaster Recovery. Its definition is
not universal, but generally concerns itself with the [US] Federal
Emergency Management Agency (FEMA)’s ‘Plan, Prepare and
Mitigate’. It is rooted in Emergency Management, the primary focus
of which is the preservation of human life and the operations needed
to support that. This focus is different to Resilience Planning, which
is focused on the overall survival of the operations that support
sustainable development of organisations and communities. There is
overlap, as with Business Continuity Planning, and much of the same
source data is used for each. However, the questions are fundamentally different.
9. CityAge ‘New American City’ Philadelphia 13/14 November 2013
10. Deluge rain flooded parts of Toronto 8 July 2013 causing more than
$850,000,000 in damage (Insurance Bureau of Canada). Note that
insured losses are often far lower than actual losses.
11. An ice storm hit Toronto 22/23 December 2013 with after effects to
27 December. 250,000 residents were without electricity, which was
only restored to the last home two weeks after the initial storm hit.
The storm caused an estimated $200,000,000 in damage (Insurance
Bureau of Canada), pushing the total severe weather losses for 2013
to a record $3,200,000,000 (Insurance Bureau of Canada). Note that
insured losses are often far lower than actual losses.
12. Calgary, AB, flooded 21 June 2013 with an estimated $500,000,000 in
losses. The Alberta premier estimated the total cost to the province at
$5,000,000,000. Despite the extensive damage to bridges and infrastructure with much of the downtown flooded, Calgary was able to
continue with the Calgary Stampede 5 – 14 July 2013. The Calgary
Flood is seen as a case study in ‘confidence in leadership’ being the
driving force behind the effective response and subsequent recovery.
13. High River, AB, flooded 23 June 2013 with over half of the population displaced. The case has become an exemplar of the perils of
flood plain development.
14. 18 Tornadoes hit Southern Ontario 20 August 2009 with two F2
tornadoes tearing into the City of Vaughan, North of Toronto.
15. The North East of North America has experienced extensive blackouts in 1965 and 1977, but the Blackout on 14 August 2003 exposed
the fragility of the electricity network. Due to a software bug in the
control room alarm system at First Energy Corporation, Ohio, a
minor localised event quickly cascaded into a system failure across
Ontario and four US States. It is believed to have been the World’s
second most widespread blackout in history.
16. [UN] Intergovernmental Panel on Climate Change (IPCC)
Working Group II Annual Report 5 Climate Change 2014: Impacts,
Adaptation, and Vulnerability 31 March 2014. The reader may also be
interested in viewing the UN and Climate Change website http://
17. Post Tropical Storm Sandy struck the New Jersey / New York coast
29 October 2012 causing $18,000,000,000 losses in New York alone.
See also US Department of Commerce Economic Impact of Hurricane
Sandy: Potential Economic Activity Lost and Gained in New Jersey and
New York September 2013.
18. Hurricane Donna struck the US 10 September 1960 causing a 13
feet storm surge [above normal] over the Florida Keys and between
5 feet and 10 feet along the New England coast. As the tide was
low when it hit New York, the storm surge was between 10 feet and
11 feet. [US] National Oceanic and Atmospheric Administration
(NOAA) Storm Surge and Coastal Inundation Event History. http://
19. [US] National Oceanic and Atmospheric Administration (NOAA)
recorded a 13.8 feet storm surge at The Battery, New York.
20. Civil Engineering is … the art of directing the great sources of power in
nature for the use and convenience of man, 1828 Royal Charter of the
Institution of Civil Engineers.
21. Chapter VIII In Which Christopher Robin Leads an Expotition to the
North Pole. A. A. Milne The Complete Tales of Winnie-the-Pooh.
Dutton-Juvenile 2001.
22. Kingston’s annual FebFest is a 4 day celebration of all things winter
with concerts, ice hockey games and parties. http://www.febfestkingston.com/
23. This demographic trend has been growing since 2007 with the
condo construction boom in downtown Toronto. Definitive statistics were not available from City Hall when requested, though it is
generally accepted that the number of pre-school families living in
downtown condos has increased substantially. An issue highlighted by
Philip Preville Stuck in Condoland Toronto Life 11 June 2014.
One of the stated policies of [then] candidate Rob Ford during the
election for Mayor of Toronto was to remove some of the bike lanes
that were annoying motorists. He did exactly what he promised
when he was elected, much to the consternation of many.
The $34M refurbishment of the Toronto Reference Library, 789
Yonge Street, was completed in 2012.
3. www.crci.utoronto.ca
4. The simple Business Strategy 5-step process is: 1. Determine where
you are; 2. Identify what’s important; 3. Define what you want to
achieve; 4. Determine who’s accountable; and 5. Review. There are
variations, depending upon the author and school.
5. Ghemawat, Pankaj, ‘Commitment. The Dynamic of Strategy.’ 1991
Simon & Schuster ISBN 978-1439106174
6. CityAge events are focussed on 21st Century city-building.
These events move periodically to a different city and in this case
Philadelphia, PA, 13/14 November 2013. Each speaker is filmed and
the videos posted on the internet at CityAgeTV. Antonio GomezPalacio’s bio is at http://cityage.tv/philadelphia/2013/09/24/
antonio-gomez-palacio/ and a copy of his presentation can be seen at
‘It is that essential ability of an operation to respond to and absorb
the effects of shocks and stresses and to recover as rapidly as possible
normal capacity and efficiency.’ Operational Resilience, CRCI.
With a ridership of approximately 65 million passengers a year, GO
Transit is a regional public transit a division of Metrolinx serving
the Greater Toronto and Hamilton Area and communities across the
Golden Horseshoe.
9. Café 059 is located in the Daniels Faculty of Architecture, Landscape
and Design at 230 College Street, Toronto. The café is inside the
Huron Street entrance.
10. The Faculty Club of the University of Toronto, [St George Campus]
41 Willcocks Street, Toronto.
11. The Resilient City: planning Resilient Communities. http://www.
12. Jim Rosenbluth, Analytic Risk Solutions. http://www.analytic-risk.
13. The perception of risk is a feature of culture and self-identity among
other things. When the general perception is that bad things do not
happen, evidence to the contrary is often dismissed. The perception that all is fine is reinforced at each life stage, as people seek out
affirmation of their self-concept. The associated cognitive dissonance
is widely discussed and certainly not peculiar to Ontario, Canada
or North America. The perception of risk has been investigated in
Norway and Denmark, both in conjunction with a safety culture and
in a wider societal security context. SAMRISK 2011 Report ‘What
we know about societal security.’ The Research Council of Norway.
14. Nick Martyn, RiskLogik, http://www.crci.utoronto.ca/sff/speakers/
15. RiskOutLook is a risk engine software by RiskLogik http://www.
risklogik.com/, based upon programming developed for the Y2K
risk assessment. In its modern form, it incorporates dependency and
consequence analysis models developed with the CRCI. O’Neill,
Philip ‘Protecting Critical Infrastructure by Identifying Pathways
of Exposure to Risk’ Technology Innovation Management Review
August 2013 pp34-40.
16. The City of Toronto Environment Department conducted an
Infrastructure Resilience Study of the City’s complete operation,
in conjunction with the CRCI. This project identified the essential
functions of the city and all infrastructure and services upon which
those functions depend. This was repeated to the 3rd order of dependency. It was the first time that a large scale complex operation had
been successfully ‘mapped’ in this way and the processes and modeling were subsequently used to develop multiple lines of research.
Bristow, David N., 2015 ‘Asset system of systems resilience planning:
the Toronto case.’ Institution of Civil Engineers Infrastructure Asset
Management Paper 14.00044.
17. Antonio Gomez-Palacio, http://www.crci.utoronto.ca/sff/speakers/antonio-gomez-palacio and at http://www.dialogdesign.ca/
18. Drawing upon the successful urban plan and design of the Moncton
downtown core, the DIALOG Resilient Community Framework
incorporates much of the resilient communities research from
the CRCI Hay, A.H. Surviving Catastrophic Events: Stimulating
Community Resilience. Institution of Engineering and Technology
Special Publication Infrastructure Risk and Resilience:Transportation
2013. pp41-46. It is described in full in the conference paper Hay,
AH; Gomez-Palacio, A; Martyn, N. Planning Resilient Communities.
Proceedings of The Infrastructure Security Partnership, Critical
Infrastructure Symposium. Colorado Springs, April 7-9, 2014
The Corned Beef House, 270 Adelaide Street West #300, Toronto.
(416) 977-2333. http://cornedbeefhouse.com/
Canadian ecologist C. S. Holling introduced the term resilience to
describe the persistence of natural systems in the face of changes
to the ecosystem, whether from natural or human causes. His 1973
paper influenced a steady change in thinking across many disciplines,
aided by the shift towards systems thinking around infrastructure and
the early 2000s thinking of cities as behaving like ecosystems. While
the practice of resilience planning had been part of strategic planning since at least Cyrus the Great, ‘resilience’ as a tangible concept
came to represent these many practices. In some cases, it was also
used as a convenient way of legitimising failing policies and practices,
though these have generally all been rectified. Holling, C.S. 1973
‘Resilience and stability of ecological systems’ Annual Review of
Ecology and Systematics 4: 1-23. See also how Cyrus II of Persia (aka
Cyrus the Great) laid out the Achaemenid Empire. A strategically
planned empire with a centralised administration and government at
Pasargadae that respected the self-identifying subject regions, which
were controlled through satraps, reflect many of the core findings of
a study to determine the characteristics of communities that survive
catastrophic events. This study is discussed later.
3. Walker, Brian and Salt, David ‘Resilience Thinking. Sustaining
Ecosystems and People in a Changing World.’ 2006 Island Press ISBN
4. Park, J.; Seager, T.P.; Rao, P.S.; Convertino, M.; Linkov, I. ‘Integrating
risk and resilience approaches to catastrophe management in engineering systems.’ Risk Analysis 2013 March 33(3): 356-67. This paper
critically argues that resilience is an emergent property of what an
engineering system does, rather than a static property the system has.
This paper is often cited as influencing the convergence of resilience
thinking in infrastructure networks, making the earlier work of Lewis
and Macaulay more tangible. Both of these are discussed later in the
5. Frédéric Petit is the Principal Infrastructure Analyst at the Argonne
National Laboratory department of Decision and Information
6. The Institution of Engineering and Technology Special Interest
Publication ‘Infrastructure Risk and Resilience: Transportation.’ 2013
ISSN 2041-5923
Hay, A.H. ‘Surviving catastrophic events: stimulating community resilience.’The Institution of Engineering and Technology Special Interest
Publication ‘Infrastructure Risk and Resilience: Transportation.’ 2013
Jane Jacobs (1916-2006) Canadian-American author and activist
most noted for her book ‘The Death and Life of Great American
Cities’, published in 1961. Her arguments were based on critical
observation of communities and what made communities vibrant and
wholesome. She was a noted activist, challenging the grand development schemes of Robert Moses in New York and the impersonal
and car-dependent new American suburbia. She went on to publish
further books, including ‘Systems of Survival’ in 1992 and ‘Dark Age
Ahead’ in 2004. Though her work does not appear to have ever been
recognised in the municipal approach to planning in either the US
or Canada, her observations align very closely with work on resilient
communities and city infrastructure systems. In many ways ahead of
her time, we still have much to learn from her work.
9. The World Health Organisation 1986 Ottawa Charter for Health
Promotion built on the 1948 definition ‘a state of complete physical,
mental and social wellbeing and not merely the absence of disease
or infirmity’ and identified pre-requisites for health: peace, shelter,
education, food, income, a stable eco-system, sustainable resources,
and social justice and equity. This has since grown into an international movement ‘Healthy Communities’. http://www.who.int/
healthpromotion/. One of the most useful articulations of these concepts applied to the built environment is by Joseph Aicher ‘Designing
Healthy Cities. Prescriptions, Principles, and Practice’ Kreiger 1998
ISBN 089464-9272.
10. Detroit filed for bankruptcy 18 July 2013. This was the culmination
of years of poor financial management that compounded to make
the City vulnerable to a large stress or shock. The stresses came
during the 2008 credit crisis with the near failure of General Motors
and Chrysler, which were subsequently bailed out by the Federal
Government. The sudden loss of jobs, increasing mortgage foreclosure and the accompanying loss of tax receipts meant that Detroit’s
already fragile condition quickly deteriorated. In 2012, the City
Council negotiated Michigan State involvement in city management.
By February 2013, the financial investigation was damning enough
that the State announced that it would step in and take over the City
financial management. Kevyn Orr was appointed financial manager
and by May had identified that Detroit’s problems were an accumulation of mismanagement and the issue was bigger than what the
Governor, Rick Snyder, had termed a ‘haircut’. Over 47% of property
owners had defaulted on their property taxes, one third of the budget
was being paid to retirees and that even after significant liquidations
of city assets there would be a significant negative cashflow. In an
effort to prevent pension renegotiation, the two main municipal
pension funds filed suit to prevent any cut to retiree benefits. Detroit
filed for bankruptcy two days later.
11. On 11 September 2001, the terrorist group al-Qaeda orchestrated
successful suicide attacks in New York and Washington DC, killing
2,996 people and causing in excess of $10,000,000,000 in property
damage. Two planes crashed into the ‘twin towers’ of the World Trade
Centre complex in New York, collapsing the 110 storey towers and
causing irreparable damage to other towers in the complex. A third
plane crashed into the Pentagon outside Washington DC, while a
fourth Washington DC bound flight crashed in Shanksville after the
passengers overcame the hijackers.
12. The attacks has a significant and lasting effect upon the US psyche.
This was the first attack on the US mainland in living memory, shocking a population that had believed themselves removed from such
events. In New York, much of the City was paralysed for weeks after
the attacks as commuters feared subsequent attacks. The climate of fear
was accentuated by the shock of the event. In Washington DC, the
shock was translated into a vow that never again would such an event
be possible and the Department of Transportation quickly introduced a
series of measures that influence travel security around the World. The
Transportation Security Administration was established and included
within its mandate the transmission of resources, including the security
of oil and gas transmission pipelines. The Department of Homeland
Security was also established, drawing together various security and
enforcement agencies under a single umbrella, with a huge increase in
both funding and manpower. The attacks also resulted in the invasion
of Afghanistan in 2001, where al-Qaeda had trained and enjoyed sanctuary, followed ultimately by the invasion of Iraq in 2003. The effects
of these 11 September 2001 attacks effectively sent the US to war and
challenged the US sense of security.
13. The 4th meeting of the G20 heads of government was held in
Toronto, 26/27 June 2010. Amid security concerns, the state conference was the most expensive in Canadian history with an estimated
cost of $858,000,000 (including the related G8 meeting in nearby
Hunstville). The protest riots resulted in an often heavy police reaction, attracting much criticism internationally in the media. How
much the protective measures influence protester behaviour and vice
versa is a continuing debate, particularly within liberal democracies. It is interesting to note that in US, UK, Canada, Europe and
Israel, police riot tactics have gradually evolved, largely as a result of
experience, in balance with the expectations of the time or zeitgeist.
Even recognising this, the Toronto G20 security action remains seen
domestically as excessive. However, most notable about the G20 riots
was the role of Twitter and other social media. See the Star Insight
article by Antonia Zerbisias 11 July 2010 and similar.
14. On 7 July 2005, British Islamist terrorists inspired by the group alQaeda, orchestrated an attack on the London Underground system
in UK. One device detonated on the Circle Line between Liverpool
Street and Aldgate East stations. The second device was detonated
between Edgware Rod and Paddington stations and the third detonated between Kings Cross and Russell Square. A fourth device was
detonated on board a bus in Tavistock Square. Though these attacks
caused shock and confusion, normal service quickly resumed in all
oether parts of the London Transport networks and a near normalcy
returned to the City’s pattern of life by the following morning.Whether
through the experience of Northern Irish terrorism over the years or
because the events were not as dramatic in the media, this first known
suicide attack in the UK did not shock the national psyche. Though
the scale of attack can in no way be compared with the 11 September
2001 attacks in the US, how a nation perceives and responds to such
attacks reflect national culture and identity. US, UK, Israel, France and
Germany have very different perceptions of terrorist attacks and how
they respond, whether at home or overseas. This is similarly reflected
within organisations facing risks and malicious shocks.
15. The perception of leadership is a difficult dimension to measure, since
perspectives change or are reinforced after the event. However, this
influence is recognised, SAMRISK 2011 Report ‘What we know
about societal security.’ The Research Council of Norway, and can be
seen in the behaviour of a population during an incident. For example
Calgary during the 2013 floods generally demonstrated confidence in
the mayoral leadership and that of some councillors. Studies into leadership during catastrophes similarly identify this dynamic. Boin, Arjen
et al ‘The Politics of Crisis Management: Public Leadership Under
Pressure’ Cambridge University Press, 2006. ISBN 978-0521607339.
16. Jacobs, Jane ‘The Death and Life of Great American Cities’ Vintage
1992 revision ISBN 978-0679741954.
Joseph Aicher ‘Designing Healthy Cities. Prescriptions, Principles,
and Practice’ Kreiger 1998 ISBN 089464-9272.
17. Ostrom, Elinor ‘Governing the Commons: The Evolution of
Institutions for Collective Action’ Cambridge University Press 1990.
ISBN 978-0521405997.
18. Infrastructure enables cities and economic development. As cities change
and develop, the requirement for the infrastructure changes, incurring
stresses on the infrastructure. This will include any limitations in the
revenue required to maintain and develop infrastructure to meet current
and future requirements. Infrastructure and cities are therefore an a balanced relationship, known as equilibrium. If the balance shifts one or both
will suffer. Infrastructure suffers shocks – a transmission line that is blown
down in a storm represents a sudden loss of power, a shock. That same
storm cases damage to the city, it doesn’t stop the function of the city, but
it does stress it. Therefore, the infrastructure suffers shocks, while the city
suffers stresses. These manifest themselves in the resilience of the infrastructure and so city functionality and the resilience of the community
that is enabled by city function. The nature of that relationship between
municipality and regional infrastructure needs to be informed, suggesting
that the catalyst is common access to this dependency information.
Figure illustrating the Equilibrium concept in a provincial
infrastructure relationship with a municipality.
See also ReNew Canada Blog ‘Not Understanding Context Impedes
Benefits of District Energy’ 9 February 2015.
19. The argument presented in the text was a consistent theme at the
Canadian Society of Landscape Architects congress in Ottawa,
31 May 2014. http://www.csla-aapc.ca/sites/csla-aapc.ca/files/
Much of this think resonates with Jane Jacobs’ thinking, as well as
reflecting how many European countries are returning to traditional
urban design approaches.
20. When land taxes are low but property taxes high, the financial incentive to build retail parks with extensive car-parking is greater than
when the opposite is true. While taxation can be a blunt instrument,
it does influence investment decisions. When taxation is aligned with
planning and development policy, there is more likelihood that a
policy will positively change socio-economic behaviour. Zoning can
have similar influences.
21. Economist Alfred Marshall (1842 – 1924) introduced Cluster Theory
in his 1890 book Principles of Economics. While this referred to
the concentration of specialised industries in particular localities, it
did focus the issue on the concentrated dependency on a critical
resource. When applied to resilience planning, cluster theory applies
precisely to the concentration of vulnerabilities, evident in the layout
and arrangement of communities. For example, concentrating large
numbers of a single dependency group into the same area means
that the collected group can form a critical dependency and demand
priority assistance in a catastrophe that mixed groupings typically do
not experience because the demand is dispersed among the population. This is particularly evident with social housing, prompting many
European municipalities to disperse community and assisted housing
through the population rather than on concentrated sites. In each
case, the ability of the municipality to manage and recover from a
catastrophe is included among the justifications. Examples include
the Tyrol in Austria, Manchester, UK, where Passive House is one of
the design principles being applied. http://www.wchg.org.uk/
22. This question is taken from the 2010 Final Exam of the CIV1198
Infrastructure Resilience Planning course (now designated APS1024).
23. Pay As You Go (PAYG) phone SIM cards.
24. UNESCO: United Nations Educational, Scientific and Cultural
Organisation http://en.unesco.org/
25. OCAD University, formerly the Ontario College of Art and Design,
is at 100 McCaul Street, Toronto.
26. During the Great Depression, US President Franklin Roosevelt
initiated a massive public-works program to improve the national
infrastructure and put people back to work. Established as the Public
Works Administration in 1933, it was a keystone of the ‘New Deal.’
Both the legacy and efficacy of this initiative are still discussed. On
the one hand, the initiative did allow many thousands of families to
have some income to live by. Conversely, many feel that it prolonged
the depression by denying industry the available manpower and
27. Mirza, Saeed 2007 ‘Danger Ahead: The Coming Collapse of Canada’s
Municipal Infrastructure’ a report by Federation of Canadian
Municipalities. ISBN 978-1897150207
28. Ibid. The actual deficit at 2015 is estimated to be anywhere between
$130Bn and $200Bn, though difficult to ascertain without a similar
study to that reported in 2007. Further information from FCM at
29. The Chaco War 1932 – 1935 was fought between Paraguay and
Bolivia over the Chaco region thought to be rich in oil reserves.
Standard Oil supported Bolivia, which was the wealthier country
with a better equipped army, and Royal Dutch Shell supported
Paraguay. At its conclusion, Paraguay secured two thirds of the disputed region and no oil reserves were found anywhere in the region.
30. The need for a subway to facilitate public transit in and around
Toronto was recognised in 1912, though work only started in 1921.
31. KRI – Key Risk Indicator is used to warn of an impending asset degradation or approaching hazard in Operational Risk Management.
When it is leading it means that it is indicates the approach of a
hazard, which can be addressed. When it is lagging it means that the
indicator is only recognised after the hazard has arrived at the asset
in question. KRIs typically refer to the Strategy level of planning,
whereas Risk Indicators and Hazard Indicators refer to the technical
level of planning. This latter aspect is discussed more in conjunction
with travel time and surveillance traces.
32. Capability Based Planning is described in its simplest form by the
US Department of Defence as: 1. What do we want to enable? 2.
Develop general statements of time, distance, effects and obstacles;
and 3. Capability must reflect the lifecycle. When the capability-based
approach is applied to infrastructure planning to meet a strategic
(vision-based) goal, the steps are:
Define the vision.
Identify the through-life Risk Context.
Determine stage objectives and responsibility.
Key Performance Indictors.
Key Risk Indicators.
Resource Allocation.
The function and relationship with the changing context of the life
of the infrastructure will define its capability over time.
Business Continuity Planning (BCP) is planning to continue business when the place of business is affected by a shock or stress. It
is typically follows an iterative cycle of Risk Assessment, Business
Impact Analysis, Strategy Selection, Plan Development, Train/Test/
Maintain and back to Risk Assessment. This cycle is also referred to
as: Identify, Analyse, Design, Execute, and Measure. There are various
excellent guides to BCP produced by the UK Cabinet Office,
Public Safety Canada, [US] Department of Homeland Security, [AS]
Attorney General’s Office. The core elements common to all of these
approaches are described in ISO22301:2012 Business Continuity
In 2012, the University of Toronto Centre for Resilience of Critical
infrastructure mapped the City of Toronto operation in a collaborative project with the [then] Environment Department of City Hall.
This was the first time that a large scale complex operation had been
successfully mapped through its enabling functions down to the 3rd
and 4th order of infrastructure and service dependencies. Though this
work was not published at the time, it was the basis for an extensive
range of research that followed and our current day understanding
of systems interdependency. A critical review of the project was conducted in 2014 and published in the Institution of Civil Engineers
Proceedings – Journal of Infrastructure Asset Management.
Bristow, David, 2015 Asset system of systems resilience planning: the
Toronto case. Paper 14.00044.
3. When looking at an operation holistically, there will be a Planning
Point, denoting a minimum level of performance that must be
attained by a certain time. This is known as the Minimum Sustainable
Capability, which is also known as the Recovery Performance
Objective (RPerfO). The time in which this level of performance
must be restored by is the Recovery Time Objective (RTO). These
are not to be confused with the RTO and RPO used in Information
Systems management. In that case, the Recovery Point Objective
(aka RPO) is the point in time prior to the incident when the data
is reset to and the RTO is the time elapsed after the incident when
this recovery must have happened. When we are concerned with an
operation, the Planning Point is the point by which the Recovery
phase must have begun. When we consider an operation comprising
multiple enabling functions, each function will have a planning point,
which if not achieved will adversely impact the operation. If we rank
the enabling functions by tolerance of interruption with the least at
the top and the greatest at the bottom, the functions that are essential
to the survival of the operation and which if absent the operation
could not recover, are known as essential functions.
Figure illustrating the prioritization of
enabling functions by tolerance.
Together, these constitute the Minimum Operating Capability and
have such a low tolerance of interruption that their restoration will
be a matter of immediate reaction, irrespective of the situation. The
space between the Minimum Operating Capability and the Planning
Point is the Response phase and a deliberate period of activity peculiar to the incident and situation.
When we look at each of these functions and what they each depend
upon, we will find that there are other functions or infrastructures
that are entirely out with our operation, but which are critical to
the restoration of the enabling function in question. The otherwise
ordinary function or infrastructure that an essential function depends
upon for its restoration is known as a critical function and would
typically be included in the functional prioritisation chart, despite
not being a part of the operation
4. The Pie Commission, 935 The Queensway, Toronto. (416) 848-7424.
The Grenadier Restaurant, 200 Parkside Drive, Toronto. (416) 7699870. Located in the centre of High Park.
Copacabana, 230 Adelaide Street West, Toronto. (647) 748-3211.
3. Civil Engineering Special Issue: Infrastructure Resilience, ICE
Proceedings 165(CE6) November 2012. ISSN 0965089X
4. Ibid; Hudson, S., Cormie, D., Tufton, E., Inglis, S. Engineering
Resilient Infrastructure pp 5-12.
5. RiskLogik is a development of the directed path risk analysis software
program RiskOutLook. It is produced by Deep Logik Solutions.
Incorporating the findings from various CRCI research, the software
is now geo-enabled. www.risklogik.com.
6. The Planning Point or functional RTO/RPerfO is typically
described as a percentage of ‘routine’ performance within a specific
time period. The percentage is an objective measure of productivity
or cash flow – whatever base unit the organisation uses to define its
The Consequence domains are mission, financial and political. The
mission domain is a direct measure of the effect upon performance,
typically measured as a percentage. A quantity is allocated to each
individual consequence and summed through a causal chain. It is
usually accompanied by a qualitative descriptor that refers to any
reduced recovery capability associated with this specific consequence.
The financial consequences are the direct financial cost of loss or
compromise of the specific function or asset. It does not refer to the
loss of cash flow or net operational change in cash flow. Political consequence is entirely qualitative and is an assessment of good will or
brand perception arising from this individual consequence.
See Chapter 4 Note 2.
9. Further to Chapter 3 Note 21: While Alfred Marshall had identified several advantages to clustering, including lower competition,
higher profits and a steady customer presence, there is also the risk
that they become dependent upon a single source of supply. Applied
to resilience planning, a cluster is more generically considered to
be a concentration of similar resource demand. When this resource
comes from a single source of supply, it is known as a dependency
cluster. For example, a community might depend upon a single
power transmission line to bring electricity. If that particular resource
single source of supply enables essential functions, it is thought of as
a critical dependency cluster. Critical dependency clusters have been
shown in a catastrophe to soak up central resources for the most basic
survival that a municipality or region might otherwise have used to
self-recover. This can be seen in case studies of communities in New
Jersey during Superstorm Sandy and New Orleans during Hurricane
Katrina, for example. Some municipalities have recognised this inherent vulnerability and have seen that significant cost savings are available through simple provisions. The Tyrol region of Austria elected to
build community housing and facilities using Passive House, a form
of super-insulated house construction. It meant that during a winter
storm power outage, the residents would be able to keep warm for
several days without electricity and access, freeing up community
staff and resources to focus on self-recovery. This approach requires a
collective view of municipal finance and risk.
10. Ibid.
11. See Chapter 3 Note 10.
12. Chapter 3 Note 21 and Chapter 5 Note 9 refer.
13. ARUP, a worldwide firm of consulting engineers has, in conjunction
with the Rockefeller Foundation, progressed our understanding of
urban resilience. In the process, they published a series of case studies
including one on Concepción, Chile, following the devastating 8.8
earthquake and tsunami that hit the metropolitan area 27 February
2010. ‘Understanding Urban Resilience, Part II Concepción.’ April
14. See Chapter 3 Note 17.
15. Chapter 2 Note 6 refers. Anontio Gomez-Palacio and colleagues at
DIALOG, developed the Resilient Communities Framework, which
involves full community engagement in a strategy based creative and
collaborative process to identify what the community wants and
needs, how to get there and how to ensure that with each successive
development and investment resilience is woven into the fabric of the
municipal plan.
16. See Chapter 3 Notes 27 & 28.
King’s Noodle, 296 Spadina Ave, Toronto (416) 598-1817.
Several consulting firms located along Water and Front streets suffered during Superstorm Sandy with many suffering catastrophic
loss of data and capability due to flooding. www.huduser.org/maps/
map_sandy_blockgroup.html. In several cases, following the reaction
to the 11 September 2001 bombings, many server units and standby generators had been placed in the basements and these were lost.
The experience of New York over the period 2000 – 2014 illustrates
clearly why it is important to consider all-hazards and not artificially
elevate one particular threat/hazard above all others, let alone treat
any one in isolation. The irony, perhaps, is that several of the consultancies affected specialised in security and risk consulting
3. While the BCP will not provide the answers to a resilience or security question, much of the initial analysis is based upon the same data.
Therefore, picking over the BCP is generally the best way to understand what is important to the organisation and its operation/s.
4. See Chapter 4 Note 2.
5. Enmax is a vertically integrated utility generating, transmitting and
distributing electricity and gas. They are the local electricity provider
in Calgary. When the Calgary downtown began to flood, Enmax
took the precaution of shutting down the substations in the anticipated surface flooding areas. The result was that the area affected by
the power disruption far exceeded the actually flood area.
6. It is generally considered better that functionality and culture of an
organisation align. This is all the more important when applying a
functional scheme or process to an existing culture and structure. It
is the basis of business change management. However, for resilience
planning purposes it is generally accepted that in times of stress,
people revert back to what is instinctive / cultural. If the administrative systems are aligned with the culture of the Firm, emergency
processes can be followed. At the very least, when organisational
function and culture are not aligned, deeper and more careful analysis
is needed to identify where the friction or conflict points are, where
the steps necessary to restore functionality conflict with the organisational culture or demands. A typical example is where finance might
resist any action unless provided with direction from a superior, even
if direct communication has been cut off. The consequences of this
can compromise operating efficiency at that particular location.
An operation comprises three enabling components: infrastructure,
organisation, and personnel. Each exists because of the operation,
which is considered the unifying purpose. However, each of these
components is also part of the Risk Context. The personnel are also
part of the community and their families, friends and relations have
a market perception and relationship with the organisation and the
operation as well as through the individual. Similarly, the organisation is representative in the Risk Context with relationships with the
media, politicians, trade and professional associations, business groups
and a host of Corporate Social Responsibilities. Its shareholders may
well also be part of the community. The infrastructure component
is similarly part of the Risk Context, in that it is connected to the
surrounding infrastructure, shares hazards and threats, is used by the
community and organisation according to the needs and perception
of the users and maintainers at the time. All three are dynamic. The
Risk Context comprises three parts: All-Hazards, Operating Context,
and operating Environment. The All-Hazards is a broad range of possible hazards and threats to the operation and typically categorised as
Deliberate, Accidental, and Natural. The Operating Context includes
neighbouring operations that are influenced / affected by the presence of the subject operation. The Operating Environment is everything that unaffected, irrespective of whether the subject operation
exists or not, though can affect it. The operation is itself enabled by
functions. Chapter 4 Note 3 refers.
PJO’Brien Irish Pub & Restaurant, 39 Colbourne Street, Toronto.
(416) 815-7562.
Public Safety Canada: National Strategy for Critical Infrastructure
ISBN: 978-1-100112480
Public Safety Canada: Critical Infrastructure http://www.publicsafety.gc.ca/cnt/ntnl-scrt/crtcl-nfrstrctr/index-eng.aspx
Public Safety Canada: Action Plan for Critical infrastructure (20142017) ISBN: 978-1-100232911
Canadian Security Intelligence Service: Cybersecurity and Critical
Infrastructure Protection
Ontario Critical Infrastructure Assurance Program 2011
Ontario MCS&CS: Critical Infrastructure
h t t p : / / w w w. e m e r g e n c y m a n a g e m e n t o n t a r i o. c a / e n g l i s h /
Ontario MCS&CS: Hazard Identification & Risk Assessment
Ontario Ministry of the Attorney General: The Emergency
Management Program
3. US President: Presidential Policy Directive-21(2013) - Critical
Infrastructure Security and Resilience
US Department of Homeland Security: National Infrastructure
Protection Plan – Partnering for Critical Infrastructure Security and
Resilience 2013
US Department of Homeland Security: Critical Infrastructure
4. Australian Attorney General’s
Resilience Strategy 2010
Office: Critical
ISBN: 978-1-921725258 http://www.tisn.gov.au/documents/australian+government+s+critical+infrastructure+resilience+strategy.pdf
5. 6 July 2013, a 74-car freight train carrying Brakken Crude Oil
derailed in the Lac Mégantic township resulting in an explosion and
subsequent fire that killed 42 people with a further 5 missing. Much
of the downtown was destroyed. It was the most devastating rail accident in Canada since confederation in 1867.
6. 10 August 2008, the Sunrise Propane gas plant in Downsview,
Toronto, exploded causing two deaths and an estimated $1.8M in
Edward Joseph Snowdon leaked classified US National Security
Agency information to the media in June 2013 while a contractor at
the Agency. He subsequently sought asylum from US prosecution in
Jeffrey Paul Delisle, a Sub Lt in the Royal Canadian Navy, passed
classified ‘Stone Ghost’ 5-Eyes (US-UK-Canada-Australia and New
Zealand) information to Russian Intelligence (GRU) between 2007
and 2012. He was convicted in 2013.
9. Wiebo Ludwig (1941 – 2012) led the Trickle Creek Christian community in Alberta. He was convicted in 2000 for sabotaging oil and
gas wells, including several pipeline bombings in Northern British
Columbia and Alberta, in his long-running dispute with the oil & gas
industry over alleged poisoning of his farm.
10. An al-Qaeda inspired group of 18 were arrested in 2006 for the
attempted bombing and targeting of various establishment symbols,
including the Prime Minister, the Toronto Stock Exchange, Canadian
Broadcasting Centre and CSIS Headquarters. Known as the Toronto
18, they were convicted on 6 counts in 2010. The Toronto 18 was
famously infiltrated by the RCMP as early as 2005, resulting in the
successful interception of the group before they could cause actual
injury, and in the overwhelming and conclusive evidence produced
at the trial.
11. There has been a history of post-match riots in Montreal and
Vancouver, as well as other Canadian cities, usually around Stanley
Cup play-offs, most notably 2011, 2010, 2008, 2006, 1994, 1993, 1986
and 1955. Generally limited to public order, damage, and looting.
12. In the most expense police security operation in Canadian history,
estimated at over $1Bn, the downtown core of Toronto was cordoned
off and guarded for the G20 summit in 2010. Heavy action by the
police, including excessive force and attempted cover-ups of police
brutality around the riots, estimated damage to property is in excess
of $750,000, not including police cruisers and equipment. Reliable
data surrounding the security costs and property damage remain
difficult to accurately capture, with no real estimate of the cost of lost
business and interruption in the downtown core.
13. Public Safety Canada’s Canadian Disaster Database (CDD) contains
information on disasters across Canada since 1900.
The Simon Fraser University’s Canadian Incident Database (CIDB)
contains information on terrorist and severe criminal acts in Canada
since 1960.
14. The RCMP Canadian Bomb Data Centre provides statistics by type,
province and method on domestic bombings (actual and interrupted)
in Canada
15. The UN Office on Drugs and Crime maintains an annual record of
intentional homicide per thousand people. As of 2012, Canada ranked
170 out of 218, with 1.6/000. Honduras had the highest murder rate
with 90.4/000, the US is 111 out of 218 with 4.7/000 and the UK is
190 out of 218 with 1/000. The lowest murder rates in the World are
Liechtenstein and Monaco with no murders recorded in 2012.
16. The UN Environment Program is at http://www.unep.org/
17. SENES Consultants Ltd ‘Toronto’s Future Weather & Climate Driver
Study: Outcomes Report’ 30 October 2012. Commissioned by the
Toronto Environment Office.
18. See HIRA Note 2.
19. Flood plain information in Ontario is available from the respective watershed conservation authorities. The Toronto & Region
Conservation Authority (TRCA) is at http://www.trca.on.ca/
20. Environment Canada has general information on flooding and flood
events in archive. There is some information available from Public
Safety Canada, though this responsibility is increasingly with the provincial environment ministries.
21. Geographic / Geospatial Information System (GIS).
22. Room 132, 35 St George Street, Toronto. (416) 978-7262.
23. See Action Plan Note 1.
24. The Cascadia Subduction Zone is a 1000km dipping fault that
stretches from the top of Vancouver Island (BC) to Cape Mendocino
(California). For many communities along the Pacific seaboard
of Canada-US, the Cascadia Subduction Zone poses an existential
threat. For more information, refer to the US Geological Survey
Flynn, Stephen ‘The Edge of Disaster: Rebuilding a Resilient Nation’
Random House, 2007. ISBN 978-1400065516
Grosvenor ‘Resilient Cities: A Grosvenor Research report’ 2014
3. See Chapter 3 Note 18.
4. UNISDR [The UN Special Representative of the Secretary-General
for Disaster Risk reduction] ‘Proposed Elements for Consideration
in the Post-2015 Framework for Disaster Risk Reduction’ dated 17
December 2013.
5. When we consider the drivers for resilience, we see it as an enabler
of sustainable economic development. When a municipality is thought
of as resilient, it can attract the best quality individuals and businesses.
Similarly, resilience informs how the municipality can most efficiently
respond to and recover from a catastrophic event, engendering confidence and so reducing / preventing depopulation. Sustainable economic development remains the carrot, while depopulation is the stick.
Figure illustrating the drivers of resilience.
6. Ostrom, Elinor ‘Governing the Commons: The Evolution of
Institutions for Collective Action’ Cambridge University Press 1990.
ISBN 978-0521405997.
See Chapter 3 Note 18.
See Chapter 4 Note 3, Incident Sequence.
Figure illustrating Incident Sequence with RTO and RPO.
9. In Information Technology, RPO is the Recovery Point Objective,
which is the point in time prior to the event that the data is restored
to. It might be the last back up, for example. The RTO is the
Recovery Time Objective and denotes how long before functionality is restored using the data set from the RPO. Superficially, there
is the potential for confusion between the infrastructure resilience
and the IT systems versions of these abbreviations. In practice, they
are represented differently. Presented with ‘80% performance with 8
hours’, it would be reasonable to assume that a resilience Planning
Requirement is being described. Conversely, ’10 secs within 2 mins’
would clearly be an IT data restoration requirement.
10. The sketch at Note 8 refers.The process of recovery is a strict sequence
of function restoration from the Minimum Operating Capability.
The essential functions need to be in place to enable recovery. Some
functions will have been partially or completely restored during
the Response phase to achieve a Minimum Sustainable Capability.
Irrespective of the functions restored during the Response phase, the
strict sequence of recovery begins.Where a function is in full working
order, we simply move on to the next function in the sequence. In
rationally restoring each function in turn during the Recovery phase,
the final Routine level of performance is almost inevitably at a higher
performance than pre-event. This is because lessons from the event
are learned and incorporated into the functionality, efficiencies in
resource allocation have been made and efficiencies in most aspects
is achieved. Also, inherent vulnerabilities are often addressed during
the Recovery phase, learned from the experience of the event, and
this will reduce the susceptibility to minor events that fall far short of
disruption but otherwise impede continued operating efficiency.
11. Chadwicks, 203 Strand Street, Alexandria,VA 22314. (703) 836-4442
12. Torpedo Factory Art Centre, 105 North Union Street, Alexandria,
VA2234. (703) 838-4565
13. Copacabana, 230 Adelaide Street West, Toronto. (647) 748-3210.
See Chapter 4 Note 3.
The essential [and critical] functions define the survival of the operation and specifically its ability to recover. As a general rule of thumb,
the essential functions consume approximately 20% of the total
resource take for the operation. Therefore, the resource supply to the
essential functions will need to be both demand and dependency
managed. That means: demand management in terms of reducing
the critical requirement for minimum acceptable performance of the
essential functions in order to most efficiently dependency manage
the resource demand of the functions through diversification, redundancy and dispersion of supply.
Figure illustrating the typical resource demand for the essential
[and critical] functions of the operation.
The Gabardine, 372 Bay Street, Toronto. (647) 352-3211.
3. An oil-filled breaker failed at the Manby West electricity station at
15:40 EDT, 5 July 2010, causing an explosion and subsequent fire.
The ensuing power loss was balanced across the US/CA grid. Within
Toronto, the Leaside station, was able to compensate in part, though a
significant portion of Western Toronto lost power. Power was restored
to most areas 3 hours later. 5 July 2010 was the hottest day of the year
with an ambient temperature of 34oC. The consequences for many
were exaggerated, particularly for cool storage of medicines and food
during the 2 – 8 hour power outage. At the time, few had reliable
stand-by power supplies adequate for more than 15 mins to 2 hours.
IESO Report 0670 ‘Manby H1L15 Breaker Incident – July 5, 2010’
dated 20 October 2010.
The Rex, 194 Queen Street west, Toronto, (416) 598-2475.
Lee Garden, 331 Spadina Avenue, Toronto, (416) 593-9524.
3. NPV, Net Present Value. An NPV calculation is most commonly used
to demonstrate the viability of a CIP measure against the associated
risk reduction as part of a cash-flow analysis.
4. Evergreening is the process of upgrading technology as part of a
routine maintenance program.
5. SWOT is an acronym for Strengths, Weaknesses, Opportunities, and
Threats. It is a useful tool for the team analysis of a proposed project
or situation. The strengths and weaknesses are considerations internal
to the organisation, while the opportunities and threats are external
to the organisation. This process should conclude with a simple GO/
The Oxley Public House, 121 Yorkville Avenue, Toronto, (647)
One of the most severe North Sea floods happened 31 January /
1 February 1953 causing the loss of almost 10% of farmland in the
Netherlands and an estimated 2,551 deaths in the countries affected.
The property losses remain an estimate, but in excess of 30,000 livestock were lost and 10,000 buildings, as well as substantial damage and
disruption to utilities, transportation and infrastructure generally. The
experience led to substantial flood protection works along the North
Sea coasts of UK, Germany, the Netherlands, and Belgium with the
last of these being completed in the 1980s (the Thames Barrage).
More recently, the approach to flood protection has shifted towards
resilience, from fail-safe to safe-to-fail. The principal dykes of the
Netherlands are now being reconstructed so that they are not washed
away by a catastrophic flood and will continue to serve their purpose
post catastrophe. The question of how to deal with the aftermath of a
catastrophe continues to exercise the minds of the four most effected
countries. These hard flood defences are then a containment to flood
waters where once they would have simply receded. The issue of selfrecovery and how to enable that remains a constant area of research
and development in the Netherlands, as it copes with catastrophic
riverine flooding risks as well. Flood concern is heightened by the
anticipated sea level rise due to Climate Change.
3. Posticino, 755 The Queensway, Toronto, (416) 253-9207.
4. Le Germain Hotel Calgary, 899 Centre Street South West, Calgary,
(403) 264-8990.
5. Charcut Roast House, 899 Centre Street South West #101, Calgary,
(403) 984-2180.
Discipline-specific, Critical Thinking is the practice of challenging assumptions and bias in the extraction and consideration of
information. There are many different explanations. One of the
more entertaining can be found at https://www.youtube.com/
watch?v=6OLPL5p0fMg and speaks to our ability to contemplate
complexity and uncertainty through critical thinking. Though provided as a guide for journalists, Rudyard Kipling’s ‘6 Wise Men’ also
serves as a useful reminder when we search of information: who,
what, where, when, why and how. When we look at information that
we will base any subsequent analysis on and rely upon it to inform
decision making, we must critically evaluate it for relevance, soundness and validity. Generally speaking, the CIP descriptions of critical
thinking practice are founded in the Socratic method and specifically
follows a sequence of: clarify goals, examine assumptions, evaluate
evidence and assess outcomes.
Deductive Reasoning, sometimes referred to a top-down logic, is the
process of reasoning from one or more general statements towards a
conclusion. In its most simple form, we apply the Law of Detachment,
where given a conditional statement (if A, then B); an hypothesis
is stated (A), from which we deduce a conclusion (B). The Law of
Syllogism takes this further by deducing a conclusion from two (or
more) conditional statements (If A, then B; if B, then C; therefore C
is deduced from A). Applying these laws directly will result in a valid
conclusion, but it must be evaluated for soundness. The counterpart
to deductive reasoning is inductive reasoning, or bottom-up logic,
where a conclusion is derived from specific examples. The Khan
Academy produces an excellent series of short lessons in deductive
and inductive reasoning.
3. FreeMind is a commonly used [free] mind-mapping software application written in Java.
4. James Joyce Irish Pub & Restaurant, 114 8th Avenue South West,
Calgary, (403) 262-0708.
5. Facilitated workshops are an extremely powerful way of getting to
the issues that you can then analyse. However, they need to be very
carefully conducted and designed appropriate to the nature and scale
of the issue problem, and the organisational culture. Badly facilitated, the attendees can quickly conclude that it is a waste of their
time and easily be distracted by other work or their various devices.
Facilitation must demonstrate purpose and efficiency of action. In
short, the facilitator must be a leader to be successful. Workshops are
also expensive in human resource terms, particularly as the expertise
and duration requirement goes up. The most expensive of these is
HAZOP, whereas the cheapest is the simple ‘toolbox talk’. Prepare
well, design it carefully, select the tools you wish to use with care
and prepare again. Many seasoned facilitators find a rehearsal useful
to identify supplementary facilitation or support requirements. There
is a useful brief explanation in The Institutes ‘Risk Management
Principles and Practices’ 1st Edition by Michael W. Elliott. ISBN:
Federal Finance Minister, Jim Flaherty, died of a heart attack on
Thursday 10 April 2014. His State Funeral was held in Toronto on
Wednesday 16 April 2014. A widely respected politician and champion for the disabled, he was one of the few political personalities
that transcended party politics.
The Grind House, 281 Augusta Avenue, Toronto, (647) 330-0617.
(This fine coffee shop has sadly closed since going to press)
3. The Eyjafjallajökull volcano eruption on Iceland in April 2010 sent
a huge plume of volcanic ash into the atmosphere that disrupted air
travel across northern Europe for several months.
4. King Noodle Restaurant, 296 Spadina Avenue, Toronto, (416)
5. Python for ArcGIS is an open-source programming language, though
not actually GIS software itself. It is used for analysis routines of GIS
6. AGO – Art Gallery of Ontario, 317 Dundas Street West, Toronto.
Frank, 317 Dundas Street West, Toronto, (416) 979-6688. Located
within the AGO.
Founded in 1947, The Willowdale Group of Artists is based in North
York and meets weekly. Every Spring it holds a Juried Art Show,
which has become a firm event in the Toronto calendar. http://www.
Annapurna Vegetarian Restaurant, 1085 Bathurst Street, Toronto,
(416) 537-8513.
3. Robert M. Pirsig ‘Zen and the Art of Motorcycle Maintenance:
An Inquiry into Values’ 1974, Reprint 2006 Harper. ISBN:
4. Garr Reynolds ‘Presentation Zen Design: Simple Design Principles
and Techniques to Enhance Your Presentations’ 2nd Edition 2013.
ISBN: 978-0-321934154.
5. Stephen Flynn ‘The Edge of Disaster: Rebuilding a Resilient Nation’
2007 Random House. ISBN: 978-1-400065516.
6. The North American Ice Storm of 1998, known more usually as the
Montreal Ice Storm, struck a narrow front from Nova Scotia & New
Brunswick, through Southern Quebec, to Eastern Ontario between
4 January 1998 and 10 January 1998.. Parts of New York and Maine
were also affected. It deposited approximately 130mm of freezing
rain, bring down electricity transmission lines and making roads and
other transport links impassable. An estimated 4 million people were
directly affected. Estimates for the cost of damage vary, though would
appear to centre around the C$10Bn – mostly uninsured.
Travel Time is the duration from first detection for the hazard to
reach the target. This time can be increased using delay measures
and canalisation. The approach of a hazard is rarely confirmed until
its behaviour has been observed for some time and its direction
and severity established. Therefore, from the point of first detection,
the hazard approach is monitored to establish whether it is indeed
approaching the target using predefined indicators. The likelihood of
a hazard approach is generally determined by preconditions, such as
a late thaw in the mountains catchment for the river that runs by
your site. This likelihood can be increased by high rainfall, though
only until a hazard indicator is activated can we say that a hazard is
approaching. In this case, the first detection may well be high river
levels in a town upstream. This does not yet mean that we will be
flooded, only that it has become a real possibility. We would change
our readiness and preposition critical resources so that we can respond
in a timely manner. Eventually, the indicators provide a reasonable
level of certainty that we will be flooded and this is referred to as
the ‘trigger’, activating our Response to the hazard. This may involve
sandbagging and relocating critical functions that would otherwise
be vulnerable to the approaching flood. We then intercept the hazard
so that it can be stopped or spent a safe distance from the target.
Less of an issue with natural events like floods and more applicable
to vehicle bombs or other hostile intent. We would Respond at the
trigger and then intercept the approaching hazard so that even if it
activates (the vehicle bomb detonates, for example) it remains a safe
distance from the target. This safe distance is determined by the distance away that an activated hazard will not affect the operation /
essential or critical function. It does not necessarily refer to physical
damage. When the Hazard Travel Time is completed for each hazard
and overlaid on the Areas of Interest, Influence and Operations, it is
known as a Surveillance Trace and provides information of what type
of detection/delay is required where and what it coordinates with.
The Surveillance Trace is the basis of all security integration.
Figure illustrating Hazard Travel Time from precondition,
first detection and indicators to the target against the security
actions sequence of readiness, delay and canalization, to
response and intercept a safe distance from the target.
FEMA: Federal Emergency Management Agency. www.fema.gov
Look also at Creative Commons https://search.creativecommons.org
3. NOAA: National Oceanic and Atmospheric Administration. www.
4. HR: Human Resources, the personnel administration functions of
the organisation and often grouped under the collective title ‘HR’.
5. Calgary experienced a ‘1 in 100’ year flood 19/20 June 2005. Little
appears to have been learned from the experience.
6. The Canadian Disaster Database (CDD) is maintained by Public
Safety Canada.
Institute for Catastrophic loss Reduction (ICLR) frequently report
on insurance losses and provide advice on reducing loss. http://www.
iclr.org/home.html Much of their data comes from the reinsurance
industry, as well as insurers. Note also the Insurance Bureau of Canada
(www.ibc.ca), SwissRe (www.swissre.com), ZurichRe (www.zurich.
com) and Lloyds (www.lloyds.com) as suitable sources of data on
insurance risk and loss.
There is some debate about exactly how much risk is insurable. The
received wisdom among Enterprise-wide Risk Management practitioners is 20% to 30%. However, it is clear that as the value of operations concentrates in specific locations, the consequences of loss far
exceed the direct loss of the property and the proportion of whole
risk that can be insured will reduce further.
9. The 44% figure is received wisdom and very difficult to prove.
Estimates for this range between 20% and 70%. Continuity Central
(www.continuity central.com feature0660.html) has investigated the
various quoted statistics, all of which are particularly nuanced.
10. Le Marché, Brookfield Place, 181 Bay Street,Toronto, (647) 342-8411.
11. The Queen & Beaver Public House, 35 Elm Street, Toronto, (647)
12. ORO, 45 Elm Street, Toronto, (416) 597-0155.
Skule is the University of Toronto Engineering Society, established
in 1885, representing over 5000 full and part-time undergraduate
engineering students.
The Galbraith Building – Department of Civil Engineering – is at 35
St George Street, Toronto.
3. Veda Curry, located in the shared basement of the Galbraith Building
(see Note 2) and the Sandford Fleming Building. (416) 961-9797.
4. SmartGeometry is a global community of practitioners, researchers
and academics interested in the built environment. Sg2014 in Hong
Kong, 14-19 July 2014.
5. David H. Maister, Charles H. Green, Robert M. Galford ‘The Trusted
Advisor’ 2001 Free Press. ISBN: 978-0-743212342.
6. The six branches of critical infrastructure protection / security are:
physical protection, physical security, personnel protection, personnel
security, cyber security and electronic counter measures. The three
components of an operation are: organisation, personnel and infrastructure. These components exist within a risk context, of which
they are also part. The Risk Context comprises all-hazards, operating
context, and operating environment. The relationship between the
components of the operation and their context is the purpose of the
operation. This purpose remains, even if components are compromised during a catastrophe. Consequently, the aim of all resilience
planning is to protect the continued delivery of that unifying purpose.
Neatly summed up by one professor at CRCI, ‘just because the retail
park is flooded, it doesn’t mean that the requirement to secure stock
has gone away.’ It means that the system dynamics of the infrastructure demand an holistic understanding defined by six dimensions: the
three Cartesian dimensions, temporal, human and cyber.
The Principles of Critical infrastructure Protection (CIP) are Do No
Harm; Everything Will Change; and No Protection is Absolute. Do
No Harm is explained in the text and centres on the fundamental
requirement that protection ceases to be effective if it impedes the
very thing that it is protecting. When extended to our neighbours,
this is more than simply being neighbourly. It refers to the management of nuisance liability, most eloquently described by Pat Koval
and colleagues at Torys LLP. When applied to climate change weather
events, see Torys LLP ‘Examination for the National Roundtable on
the Environment and Economy’ published April 2008. A practical
extension of the Do No Harm principle is known as the ‘Fire Door
Principle’. Simply stated, if we put a fire door between two offices
with constant traffic between them, we will soon find the fire door
propped open by the nearest fire extinguisher. It reflects the influence
of both the conduct of the operation, as well as the culture of the
organisation. Resilience schemes are only ever frameworks that are
adapted and applied to the organisational culture.
No Protection is Absolute refers to the fact that in selecting a level
of protection, we have consciously decided on a level of risk that we
will match. Implicit in this is that there remains a residual risk that
the selected level of protection will be exceeded, irrespective of the
hazard we face. There are two aspects to this, in an all-hazards environment, the protection against one hazard can actually impede our
protection against another. The other is what happens when the protection is exceeded? The next time New York is flooded by a storm
surge, the protection measures may have held back the initial effects,
but will they fail catastrophically or simply remain intact. If the latter,
will this prolong the emergency by containing the flood waters.
Having lost power, water and sanitation, how does the city feed itself
after the flood? Was the food terminal in New Jersey afforded any
protection against the same event? It is also worth noting that as
we raise our levels of protection we will reach a point where each
enhancement actually impedes the operation and we need to balance
resilience and protection. This balance has been determined as a
function of the operation and context in order to optimise investment decision making. See the report by CRCI http://www.crci.
Finally, it should be noted that Protection in this instance is equally
applicable to any adaptation measures pursued in isolation, such as
LEED and similar programs. As a generality, approach each operation
as holistically as possible.
9. Everything will Change reflects the complex nature of operational
systems generally and infrastructure specifically. Every change we
make, whether organisational, risk mitigation measure, protection etc,
affects the risk context in which we operate. In effect, we change the
problem with every solution. Also, things change with time, whether
it is the market perception of the operation and its components or
the serviceability of the infrastructure or the changing technological
use and application of our systems. A set plan that isn’t based upon a
robust framework will be increasingly out of date with each passing
day. Plans / frameworks need to be adaptable to changes – recognising
changes and what they mean for the protection / security scheme.
10. MI5 Operational Requirement of Security Measures (ORSM) 2006.
This has become the de facto standard for perimeter security measures
11. Criticality Accessibility recoverability Vulnerability Espyability
Redundancy – Version 2 (CARVER2), developed by the NI2 Centre
for Infrastructure Expertise, uses a Failure Mode Effects Analysis
engine to rank infrastructure elements and widely used to compare
and prioritised between differing requirements and sites. It remains
a valuable tool, but prone to misuse due to the subjective nature of
the scoring system. Practitioners and managers must be absolutely
familiar with the underlying assumptions to effectively use this tool.
12. The Royal Canadian mounted Police (RCMP) Harmonised Threat
and Risk Assessment (HTRA) protocol was established in 2007.
While still the de jure standard used by all Canadian Government
departments, it is in practice mostly used as a handrail by practitioners to guide their assessment. Many of the IT / Cyber aspects
quickly became dated and its procedural approach and standard forms
simply doesn’t allow intelligent application across the full spectrum of
application. A critical evaluation was conducted by William Dziadyk
of BD Pro Inc in 2011 (Harmonised TRA (HTRA) Methodology
– Limitations dated 13 September 2011) and while publicly available and widely endorsed, has not prompted a revision of the 2007
13. American Petroleum Institute (API) ‘Security Vulnerability
Assessment Methodology for the Petroleum and Petrochemical
Industries’ dated May 2003.
14. US Transportation Security Administration (TSA) ‘Pipeline Security
Guidelines’ April 2011.
15. The Calculation Plan is record of research and analysis that provides
planner and designer with necessary parameters, supporting analysis
and source references. It also provides a means to evaluate whether a
change in the operation or risk context affects the planning parameters or design criteria. It is increasingly used as an audit trail to
evaluate assurance and evidence when required that a subject was
adequately and professionally considered.
16. The Surveillance Trace is the primary planning tool for security integration planning and implementation. See Chapter 15 Note 1.
17. Risk Criteria
18. Optimum Risk
19. See Chapter 4 Note 3.
20. Toronto South Detention Centre, 160 Horner Avenue, Toronto.
21. Cosmology is the study of the universe, its origin and evolution. For
the purposes of CIP, we are specifically interested in mass coronal
ejections or sun flares. They are generally represented on Earth as the
aurora borealis and aurora australis. More damaging effects are pitting
in pipelines and when a solar storm directly collides with the Earth,
such 1 September 1859, it can cause massive electrical charges in
communication wires. The 1859 event, known also as the Carrington
Event is reported to have set telegraph cables alight and electrocuted
telegraph operators.
22. See Chapter 15 Note 1.
23. The practice of IPOE for CIP is based upon US Joint Publication
2-01.3 Joint Intelligence Preparation of the Operational Environment
dated 16 June 2009. However, instead of providing a decision support
overlay and analysis of the enemy actions, the CIP application considers a much longer timescale, more appropriate to the life of the
infrastructure. Consequently all-hazards is more developed and considered as part of a complete risk context.
24. The construct of operational resilience enabling community resilience
is the basis of the DIALOG Resilient Communities Framework, a
development of the Community Development Framework as most
successfully applied to Moncton, New Brunswick.
25. See Chapter 1 Note 6.
26. See Chapter 3 Note 9.
27. Consider a green Lego mat. We use them to build our Lego edifices
on. They hold our structures together and in a fixed spatial alignment.
They are like the infrastructure of a city that enables us to live in
far greater density than would otherwise be possible or sustainable.
Similarly, that green Lego mat represents operational resilience that
enables the community resilience. The operational resilience refers
to all the municipal corporation functions that enable the economic
development of the community. By being resilient, it enables the sustainable economic development of the community.
28. The CRCI research into the operational resilience of infrastructure
systems has been incorporated into the risk analysis software application RiskOutlook. www.risklogik.com
29. See Chapter 8 Note 2.
IKEA, 1475 The Queensway, Toronto. (866) 866-4532.
Caplansky’s Deli, 356 College Street, Toronto, (416) 500-3852.