online website builder



How to… Unknowingly take an excessive risk

Let's have some fun!

Risk is a funny thing, what one perceives as a risk another sees as an issue yet a third does not even consider. In this particular story we have collectively mitigated all risks before starting. There was a risk that sending replacement devices by courier would result in a data breach or loss of equipment, we mitigated this by having two people accompany the equipment to sites, personally driving, installing and decommissioning equipment. There was a risk we would get lost, so we had an A4 sized map of the UK to navigate from (as it turns out maps need to be more detailed than this).

In all we had a 3 day tour of the UK planned to do the task at hand and keep the equipment secure. The first two days have gone well, we have just completed the last equipment swap and are heading down the M6 towards Preston to teach a final training session when a bright idea pops into our heads. We are ahead of schedule and have a few hours to kill, why not go to Blackpool and have a go on the new big rollercoaster? What could go wrong with that idea?

Car parked on a side street and we’re off. Fun was had, rollercoasters ridden and fish and chips consumed. Back to the car for the final leg of the journey. This however is where the problem starts, the car is not there.

Now I don’t know if you have ever lost something of value. Ever had one of those occasions where your heart pops right up into your mouth? That was this. The car value was neither here nor there, it was after all a hire car. What was inside the car was of quite some interest to the right people. It was at minimum 5,000 logical keys to the door of our organisation, sitting on about £20k worth of equipment. In the boot. And the car was, as mentioned, neither here nor there.

How on earth were we going to legitimately explain losing the car and it’s contents? In Blackpool?

On the positive side, the type of person that steals a car is not likely to be connected to the people who would understand what this stuff was in the boot, let alone extract the valuable items from the data held on them. Yet the problem remained, the car was simply not there.

After half an hour or so, both of us feeling rather jittery, we head back towards the front to think about next steps. Clearly we would need to report this to the police first, inform our security teams, arrange a new hire car, delay this afternoon’s planned training, potentially find a hotel and deal with whatever we have now caused head on. It is at this point we both spot something. A car. Our car. Parked just a few spaces away from us. On a road which looks… Just like the one we parked on. In fact looking around we both realise that actually we are plain stupid and both walked the wrong way to a road that looked similar, in fact just like the one we are no on. Idiots.

Just to prove the point, yes the keys work, yeas our bags are still in the boot, as are the devices and presumably the data. Phew. We race over to Preston, complete the training and head back home for some well needed rest.

Learning point for everyone:

As risks go, losing the equipment and the car in Blackpool did not make it onto any risk register, it hadn’t been considered as a possibility in the planning phases. We often take risks, assessing them in our heads outside of more regimented planning. In fact as a general rule, risk registers in IT are often a little lacking in both quality and content and rarely have I seen real effort applied across all participants in a programme to really drive out the risks that truly lie within a migration, deployment, solution or design. Yet when I have driven these out, good business decisions are the outcome.

It seems a moot point at times to drive out risks proactively and then actively throughout a programme by all participants yet this is a great way of really understanding what you are exposing yourself and your customer to. Yes, registering a risk may cause additional work, but that is the point. If there is a risk then there is work to do to mitigate it or accept it. That work needs to be planned for either as a new work stream, as a tracked action or from contingency.

Business details

Registered company no. 11869849 
VAT number 317720513