Sometimes in an effort to treat an issue, we generate a different risk or increase an existing one in the process. Many of us can relate to when the internal auditors come in, look at existing processes and weak controls and “strongly suggest” that management fix the problem. Quickly.
Management’s solution is often a series of manual processes and spreadsheet generated reports plus workarounds that mitigate the initial risk (but more importantly closes the outstanding audit point!) while creating countless more process waste and operational risks.
Here’s a real example from history from the book At Home by Bill Bryson – A Short History of Private Life (Chapter VI – The Fuse Box).
“In 1939…Great Britain introduced stringent blackout regulations to thwart any murderous ambitions by the Luftwaffe. For three months it was illegal to show any light at night, however faint.”
According to the author, one could be arrested for smoking in a doorway or holding up a match to read a sign. Drivers drove stealth: not even lights on the dashboard. They had no idea where they were going or how fast they were driving. Cars drove down the middle of the road and collided with cars doing the same thing coming from the other direction. Similarly, pedestrians walked into “lampposts, trees and furniture”. People were dying and getting hurt all in an effort to not die or get hurt in a yuckier and different way.
In the book Bryson notes, “During the first four months of the war a total of 4133 people were killed on Britain’s roads” – double the deaths from a year earlier. Three quarter of these deaths were to pedestrians. He explains that the Luftwaffe was killing hundred people a month without dropping a single bomb.
(Eventually some illumination was permitted and this craziness stopped.)
I guess the lesson to be learned is that we should think through our risk treatment strategies carefully while considering all downstream effects rather than implement some half-assed solution merely to check off a box on an audit report.