In April of 1912, Captain E.J. Smith said, “Never in all history have we harnessed such
formidable technology. Every scientific advancement known to man has been incorporated into
its design. The operational controls are sound and foolproof!” This quote went on to become
synonymous with one of history’s greatest failures to adequately assess risk: the sinking of the
Titanic. A contemporary example of a poorly documented risk assessment process is the
current water crisis in Cape Town, South Africa. With conversations into the longevity of Cape
Town’s water beginning from as early as 2012, how is it possible that Cape Town has become
the first city in the world to run out of water? The simple answer to an incredibly complex
problem is this: The strategy to prevent such a crisis was insufficient and poorly documented.
According to Warren Green, a GRC Expert at CURA Software Solutions, the importance of
diligence in your risk control strategy cannot be understated. “Risk assessments are done to
calculate or understand the probability of a risk materialising and the potential impact it may
have. This is not just a once-off process: as your project develops and adapts, so should your
assessment of potential risk and documentation of the applicable controls. Failure to do so
could have catastrophic consequences.” In the case of the Cape Town water crisis, inadequate
assessment of risk was multi-level: assessments failed to project increases in human water
demands due to changing lifestyles and a growing population, to project changes in
hydro-climatic conditions and to effectively monitor the variables in probability and impact. Most
importantly, they failed to detail which steps and mitigating controls needed to be put in place
should such risks materialise.
This natural disaster acts as a cautionary tale for a detailed and properly documented risk
assessments: airtight mitigation plans and ongoing assessments could prevent massive
economic loss, reputational damage, organisational hazards or stakeholder risks.
Another recent example of inadequately documented risk assessments was the 2012 cyber
attack on Saudi Aramco, one of the world’s largest oil companies. In a matter of hours, 35,000
computers were partially wiped or totally destroyed. It is believed that one of the organisation’s
computer technicians on their information technology team opened a scam email and clicked on
a bad link. This saw an oil conglomerate brought to its knees and plunged into 1970s
technology, all because of an insufficient strategy to mitigate the risk.
Green believes that forewarned is forearmed. “The implementation of risk management software
within your organisation revolutionises your risk documentation to mitigate the potential crisis of
any incident. To create a holistic view of potential risk, a fragmented and siloed approach simply
will not do. We are living in 2018, shouldn’t our GRC solutions, too? You need a single source of
the truth.”
