Category: ERM, GRC

The Risk of Human Existence

Where Risk should be in the ‘first’ line of any defense, and subsequent lines are mere (subsumed …!) support, as in the line of reasoning where Risk or rather Uncertainty [don’t start me on the semantics pure kindergarten discussions per definitional differences] is essential to do business; nay is essential to any organisation’s ‘business’ even when as non-exposed to market conditions as e.g., government departments.
Which, and this is the title reference, of course hinges on: all human endeavour seeks to eliminate uncertainty as uncertainty in the state of bare survival that humankind still is (sic; on average, and in the near future thanks to global warming [no thanks, global warming!]), would mean deterioration i.e. extinction.

Against which we (well, I; uncertain about you dear reader) have developed these whimsy precious things called brains (i.e., including the prefrontal cortex) to enable us to not only cope with the most complex of things including paradoxes, infinity et al., but also with uncertainty. Through induction and Big Data-like pattern extraction, sometimes taken to the levels at which most current Big Data analysis stands (turning spurious correlations however weak, into causation theorillets and/or rites), sometimes actually achieving something — models that ‘work’ to sufficiently accurately predict some aspects of the future (i.e., behaviour of predators) to enhance survival by staying away from the most unsurvivable situations.
Now that a precious few (??) have managed to ward off the evils of existential threats, such death scare of death has turned into a death scare of anything that doesn’t go according to our plan of doing the least possible to do nothing but eat ourselves into obesity.

Meaning, not accepting that now all reasonable threats, uncertainty, has been reduced by extreme CYA everywhere, at the same time we (not I) accept less and less that bad things just happen, and will ever more fanatically look for someone(s) to blame.

Solve the latter by ‘solving’ the former. Fight CYA!

And:
20160805_134239
[What’s our love … but the Art of Glass; Blondie for no apparent reason, Dordrecht]

When it comes to Risk, Appetite is Tolerance

Previously, with many others I believed that Risk Appetite would have to be the starting point of discussion for anything Risk within organisatons. The appetite, following from discussions on Strategy being the choices of directions and subsequent steps that would need to be taken to achieve strategic objectives, i.e., where one sees the organisation ending up in the future. Very clearly elucidated here. Backtracking, one will find the risks associated with these possibly multiple directions and steps — in qualitative terms, as NO valid data exists (logically necessarily, since these concern the future and hence are determined by all information in the universe which, logically, cannot be captured in any model since then, the model would have to be part of itself, incurring circularities ad infinitum and already, the organisational actions will impact the context and vice versa, in as yet (for the same reason) unpredictable ways.
And then … This risk appetite, automatically equated with the risk tolerance by the Board for risks incurred bottom-up by the mundane actions of all the underlings (i.e., including ‘managers’, see yesterday’s post), then suddenly would have to be in quantitative terms… [Yes, bypassing tolerance-as-organisational-resilience-capacity]
As all that goes around in organisations, through the first 99.9% of Operational / Operations Risk, and then some 10% industry-specific risks (e.g., market- and credit- for the finanical industry), not measured but guesstimated by hitherto outstandingly some that have least clue and experience [otherwise, they would have been much better employed in the first line of business themselves… The picture changes favorably (!) where we see some organisations shift to first-line do-it-yourself risk management… finally!] with what the chance and impact figures would be. As if those were the two only quantities to be estimated per ‘event’… As if any data from anywhere would be sufficiently reliable benchmarking material — If you believe that nevertheless, you should be locked up in a treatment facility… Yes sometimes it’s taken to be this moronic… No need to flame bigger here, as that was already done here.

But wait where was I. Oh, yeah, with the bypassing of tolerance defined as what the organisation could bear. The bare fact being, that no-one can establish a reliable figure for that. What the Board can and want to bear … Considering that the Board would have to be all-in, i.e., not only all of their bonuses since ever under clawback threat, but also all of their earned income incl salaries and personal wealth — if any of the Board would not want to risk all they ever had and have, bugger off this is what you signed up to. Considering also that strategic decisions are about wagering the existence of the company on choosing right or else, this wagering the well-being and wealth of all employees however unable to bear loss by mere fact of never had the ability to create some reserves, the previous consideration isn’t exaggerated. You wager others’ very existence, you wager your own ‘first’.

Summa summarum:
Risk Appetite is what the Board lets happen as Risk Tolerated Already.

Plus:
20160529_142237
[And away goes your grand hallway down the drain; [non-related] Haarzuilens, Utrecht]

Positive Performance Plans — Done That, part I

Regarding the latest spat on dumping personal performance plans, P-KPIs et al.

Which one shouldn’t. Even at the most negative end of What Gets Measured Gets Done, there is some truth like, some grains. Where no measurement and reward (sic I) for performance, may not entice too many to be worth their salt (sic II). In today’s total-information society, it’s the free riders, the freeloaders, that escape unharmed with their booty. ‘Hedge fund manager’ like. Possibly to be villified by history as the worst atrocities of humanity ever, but that remains to be seen as history commnly is written by the winners and forward-looking one is not (can not be) sure who that will be.

But change is in the wngs, and is needed indeed. Too many are still driven by assembly line (i.e., geriatric) target setting and (micro)management. Don’t get me started on the latter or I spam you into oblivion with bold 80 point [Expletive starting with an F] You’s.

From the Other Side, there’s renewed talk of personal development through not To Do lists but Have Done lists.

Now, can these be deployed to structure human activities’ objectives ..? Having biweekly open discussions about ‘production’ even when the employee is somewhat free to decide what to work on as long as it’s slightly related to a long-term organisational goal that everyone shares — the Original idea why people banded together in companies, taking that label from the military where already it denoted comradeship and protection towards a common achievement.
Even where proxies are needed, as e.g., project-style work with deliverables only after some time, at milestones and deadlines. Even where managers’ understanding needs to be raised through the (their) roof to capture the content innovation and disruption of the Knowledge Workers doing the creation of work/deliverables/-content and actually understanding how that ties into the total achievement – / required. Even when those ‘managers’ need to grasp the idea that much time is spent very maybe not being worth the salt, to in a blink of an eye arrive at some final nugget worth all the salary previously invested (‘thrown overboard on useless loafing’ which is required for the nugget to materialise). Enabling work at home for many; much more efficiently and with the very same productivity if not much more in the end (when all have become accustomed to the idea(s as here before)).

Yes, this leaves overall performance to ‘managers’, to integrate and achieve, and to report, and to translate downwards to personalised (individualised and adapted to individuals’ personal capabilities and development goals) general work directions. No more forty hours sitting in a cubicle — brains dying of boredom all around but “you don’t get paid for not being bodily present less than forty hours (plus/plusplus) even if you aren’t in the least productive overall”. Such is life. The organisation doesn’t give a [expletive starting with an s] about how you get [same] done, as long as your group delivers… Managers are of the work force, not above it ..!

I’ll work on this topic later, to develop the organisational structures to support this…
Oh, and:
20161027_152637
[Where Museum is splendid form and function; Teylers’ Haarlem]

Top 2000-and-counting of 2016, already

Because all sorts of hoi polloi pundits are out there, ‘polling’ (quod non, just repeating the meh mediocrity) for the Top 2000 of 2016 on the ray-the-ohw and elsewhere, herewith the real deal Top 2000.
Which of course isn’t; it’s the Top 2268 for one thing and Definitive is slightly understating it. If you hadn’t guessed, #14 is about me.
And yes, it is downloadable in plain Excel, for your own tinker and play, in this file; checked and clean (no subversive content).
Next, a few little notes (repeated from last year):

  • “That’s odd! The usual numbers 1 to 50 aren’t where they’re ‘supposed’ to be by common standards!” Correct. Because I‘m ‘Rekt. The list is mine; why put the Mehhh songs high up there? They’re in there somewhere, but its my list, my preferences..! yes I do like some almost-forgotten songs better, sometimes much, much better, than the expired old hands.
  • Especially.. see the notes, when the clip (much) enhances the song(s). Wouldn’t that mean the song in itself isn’t fully complete ..? No, it means in (since) the age of video, songs with clips (‘integrated’) can much surpass mere songs by themselves, for a cubed sensory experience.
  • There’s more than 2000 yes. Because, already after the first 500 or so, determining the relative rankings becomes awkward. Hence, the cut-off would be random …! (why not 2048, that would make more sense in this digital (i.e., binary) age). The result is quite random in the end, too, indeed; some of the last songs ‘should’ be up much higher…
  • If you would still have some (preferably wacky) songs you miss, please do comment them to me. I’ll see whether I’d want to include them still, or not. Hey, it’s my list so I decide, geddid?
  • The actual end result order is far from definitive (sic). It depends heavily on one’s momentary temper and the memories that spring to mind like Proustian madeleines. And on one’s ability to hear quality. Such is life.
  • When dabbling with the Excel file yourself, feel free to play around with the ranking mechanism. What worked for me, was to first split the songs into bins of about 250 size (designate some song to be in the first bin that will end up being ranks 1-250, another song to bin 5, which is around the 1000-1250 mark, etc.), then sizing down bin 1 etc. to 8 smaller bins. Then, numbers 1-50 get a personal treatment one by one to their end rank, the rest gets (got) a random allocation within their bracket. After this, sort and re-apply number 1-whatever. Through this, actual intermediate bin sizes aren’t too important.

Then, as a long, very long list. With a Moar tag otherwise it would be ridiculous… [i.e., for the complete list in the post, follow the link:]

1 Hustle Vann McCoy Yes, the original
2 Easy Livin’ Uriah Heep To power it up
3 Heart Of Gold Neil Young Hits the heart
4 Hide and Seek Howard Jones Same, if you listen well
5 Peter Gunn Emerson Lake & Palmer Just for the intro alone
6 She Elvis Costello Personal nostaliga
7 White Room Cream Nicely powerful, doesn’t wear out too easily
8 74-’75 (+Video) Connells The video sublimates the message
9 Windowlicker (+Video) Aphex Twins Incomplete, as a work of art, without the video
10 Nice ‘n Slow Jesse Green Calm down again
11 One Of These Days Pink Floyd Hidden pearl
12 Smoke On The Water Deep Purple Of course
13 The Man With One Red Shoe (+Video) Laurent Garnier Incomplete, as a work of art, without the video
14 You’re So Vain Carly Simon I think this song is about me!
15 Dancing Barefoot Patti Smith Hidden treasure
16 Right Here Right Now Fatboy Slim Oft forgotten, defined an era
17 The Great Gig In The Sky Pink Floyd Appealing complexity
18 All I Need Air Mindfulness in musical form
19 Dream On Aerosmith Heartburn
20 You Got To Fight For Your Right to Party Beastie Boys Appealing. Simply that.

More below, like #21-#2268

Commoditised exploits

What was first; the exploits or the use of them ..?
When now, we have this kind of reasoning, aptly, there already was this, too.

So, … What now ..?

20161025_163321
[This being the state of (the best of … ;-[ ) Duts design nowadays. Yes the rest is worse, much worse. Law of handicap of head start; Zuid-As]

Reverse-Logic

Not reverse logic (“Bring your umbrella so it will not rain”) being mere (non-existent! you ontological dimwit) causation inversion, but time-inversed thinking. Like this article (shall we stop calling blog posts or long reads anything else than the thing they were before ARPAnet ..?) which has it the wrong way around from this one. Snicker smuck.

Oh, and:
20161025_150026
[The Truth? It’s all cocktail pestles …! Stedelijk Amsterdam]

Fuzzy Vocabulary (Cross-)Boundaries

When discussing Risk …
There will always at some stage turn up a discussion (or multiple, if you’re Lucky; not) about the meaning of certain key words. Which is a pity, because … no, not because it distracts. Though it does, the main issue is that the secondary, meta, discussion about vocabularies is never / rarely resolved.
At strategic levels, talk is about risk appetite and risk tolerance, and foremost about business opportunities (of which the exitement is) spoiled by “risk managers” that point out the world might not be perfect and hence one is all but certain not to achieve the objectives. Smart business leaders push forward anyway, at best keeping the risks in the back of their heads while sanding off the rough edges of progress at that goes along all quite well. When strategies turn out to fail: Well, such is life as it has been since the dawn of humanity.
At tactical levels, talk is about risk portfolios and … not much, really; mostly project and program risks. Of the Boy Cried Wolf kind.
At operational levels, quasi-(sic!) quants do their stuff and come with all sorts of fabulous fables of formulas that wouldn’t stand scrutiny at the most basic of math levels. What idi.t would translate ‘High’ to ‘5’ and then multiply it with some other ‘4.5’ to arrive at a ‘22.5’ “risk” ..!? Heat maps are the reflection of the own moronic brain functioning onto what are supposed to be Managers’ levels of understanding. Though the outcome is correct, the origin of the reflection should be kept in mind instead of forgotten.

And all talk about ‘risk’ (‘operational risk’, even worse), ‘impact’, ‘High’, as though these were somewhat the same thing for all involved, disregarding most of time- and situation-variance or rather completely -determination. Right. Wrong. Just regurgitating definitions from ISO standards demonstrates to not understand the nature of the problem…

Any theoretical science logical-AND linguistics specialists that can help? And:
20161025_1442361
[Tinguley in a picture is quite different from the message of it …; Stedelijk Amsterdam]

The legacy of TDoS

So, we have the first little probes of TDoS attacks (DoS-by-IoT). ‘Refrigereddon’.
As if that wasn’t predictable, very much predictable, and predicted.
[Edited to add: And analysed correctly, as here.]

Predicted it was. What now? Because if we don’t change course, we’ll achieve ever worse infra. Yes, security can be baked into new products — that will be somewhat even more expensive so will not swarm the market — but for backward compatibility in all the chains out there already, cannot be relied upon plus there’s tons of legacy equipment out there already (see: Healthcare, and: Utilities). Even when introducing new, fully securable stuff, we’re heading into a future where the Legacy issue will grow for a long time and much worse than it already is, before (need to be) huge pressure will bring the problem down.

So… What to do ..? Well, at least get the fundamentals right, which so far we haven’t. Like this, and this and this and here plus here (after the intermission) and there…

Would anyone have an idea how to get this right, starting today, and all-in all-out..?

Plus:
20150323_213334
[IRL art will Always trump online stuff… (?); at home]

Bring on the Future; it belongs to ME

Some say self-driving cars / autonomous vehicles will take over driving as if they will take over all driving. But the intermediate phase [where autonomous persons and autonomous masters with slave (!) persons] will see ‘driving’ turn into a pastime, a hobby, of thrill seeker persons. Yes, even with Insurance rates getting somewhat higher. Not much higher, let alone skyrocketing, because the lone drivers that hold out, will find more and more very defensively behaving autonomous tin cans opposite them, scaring the latter (to steer) off the road…! Hence, aggressive drivers will not (provably) cause many accidents, autonomous vehicles will in all their panic. Hence, autonomous humans will not have staggering Insurance rates

and will keep on driving because of the fun of it, the feeling of independence and self-control, the thrill sought and found…

After human chess players could no longer win against ‘computers’, humans still play chess. After humans were outpaced by cars of all kinds, humans still try to win gold medals at the very event. After humans lost Jeopardy against Watson, humans still compete on ‘intelligence’ everywhere; opportunistically retreating ever further on the definition of ‘intelligence’.
Hence, humans will not drive ‘cars’ en masse, in the near+ future. But they will upgrade the purpose of driving, and will drive.

I sure will, for fun. With so many ‘lectric autonomous thingies on the road moving the sheeple, I’ll have or get myself all the road space I need… The road will belong to ME ME ME ..!

And
20150109_144728
[One perfect artist does NOT outdo others; Gemeentemuseum Den Haag]

Maverisk / Étoiles du Nord