Johannesburg, 17 Aug 2015
There is a distinct lack of maturity in Information Technology (IT) when it comes to crisis management, says Dee Smith and Associates. IT shops approach crisis management in a manner similar to the proverbial ostrich - head in the sand. All efforts are focused on preventing a major incident but when one happens, the process to deal with it is non-existent or poorly executed.
Regardless of the underlying process management and sophistication adopted by IT, it is not about if a major incident is going to happen but when!
Most industries, which have been around for far longer than IT, get this. This understanding has been around and common knowledge since 1931, nearly a decade before Turing and Flowers started creating computers during World War II at Bletchley Park in the United Kingdom.
In 1931, in his book, Industrial Accident Prevention, Herbert William Heinrich presented what became known as the Incident Pyramid. This states that in the workplace, for every one major injury accident there are 29 accidents that cause minor injuries and 300 accidents that cause no injuries (what are often termed "incidents"), roughly a 1-30-300 proportioning. This can be interpreted in two ways:
* After a major event, it is possible look back and find a range of minor incidents which had been ignored.
* A series of minor incidents will automatically lead to a major event (unless preventative action occurs)?
In 1969, the Insurance Company of North America conducted a subsequent study using more than 1.7 million incidents reported by nearly 300 companies in 21 industrial groups. That study revealed a similar pattern to Heinrich's, but with slight deviations in the ratios. For each serious injury, there were 10 minor injuries, 30 property-damage incidents and 600 near-miss incidents that resulted in no injury or property damage.
Using a sample of IT incidents and a suitable classification the following pyramid has been derived for IT by Dee Smith and Associates:
In IT, classification is based on the consequence of the incident and its business impact and as such, a major incident is one with a severe negative business consequence. In future articles the classification will be further clarified. Like other industries which have crisis management and safety protocols, IT needs to assimilate these and adopt them. In the case of the ITIL framework, this process is known as the Major Incident process.
In the film Forrest Gump, it is claimed that the Tom Hanks character invents the term 'SHIT HAPPENS'. In reality it has been known for close to 100 years as inevitably there will always be 'Significant Havoc in Technology'.
If we look at the job market for IT crisis management skills, it is glaringly obvious that the jobs being advertised are low level and low skilled. IT does not take crisis management seriously and the job market for major incident managers is close to non-existent. Even the associated positions of problem managers are often secondary service desk positions, with limited scope for advancement. The concepts of safety protocols with IT and in general, the maturity of crisis management needs to be advanced and specialised skills dedicated to the area as has been the case within other industries dealing with technology.
Dee Smith and Associates is in a position to provide training and consulting to those IT shops eager to increase their maturity in the area of the major incident process. Understanding the importance of this process and how it can benefit IT is crucial for the maturity of IT in general. Major incidents will happen and the process needs to be pre-determined and not created ad-hoc or on the fly. The latter results in chaos, inefficiencies and wasted resources. The process is one which borders on many framework implementations including aspects of ITIL, Cobit, ISMF and data centre operations. Instead of being a burden, an optimised and slick major incident process will serve as an input to many IT operational decisions as it will provide the foundation for informed decisions.
Share