Unknown unknowns: CIOs prep for the next major business disruption

If there’s one thing the pandemic has taught IT leaders, it’s that their business continuity plans were not as hardened as they thought.

And while no one can fault CIOs for not having anticipated the full extent of the COVID-19’s impact on business, now that they have experienced such an event, many CIOs are getting strategic about planning for future unknown scenarios that may come to pass.

Business continuity plans (BCPs) center in large part around possible known scenarios, such as a major disruption caused by a fire, flood, or malicious attack by cybercriminals. They outline procedures an organization must follow in the face of such disasters, but when the exact fallout of a business existential event cannot be fully anticipated, establishing an organization capable of riding through such a scenario may be just as — if not more important than — having explicit plans in place to marshal a response.

This topic was explored recently during a session at the MIT Sloan CIO Symposium. CIOs who participated in the session further fleshed out in subsequent interviews what they wish they had done differently before and during the pandemic, as well as the technologies and IT strategies they believe will be beneficial in weathering unknowns in the coming years.

Following is a roundup of the common themes these IT leaders see as essential to ensuring future organizational resilience, as gleaned from their experiences throughout the pandemic. Consider it a continuity strategy that goes beyond the traditional BCP, focusing just as much on agility and flexibility and on positioning their organizations as a place where people want to work.

Toward a more proactive IT

“No one had a playbook for COVID but taking time to integrate the lessons learned and exercise your plans will be worthwhile to prepare you for the next unknown,” says Mona Bates, CIO of Collins Aerospace.

The Charlotte, N.C.-based aerospace and defense company has utilized lessons learned from the pandemic to establish a foundational focus on being proactive rather than reactive, especially when it comes to cybersecurity, Bates says.

“We are taking proactive approaches to monitoring and measuring our critical [digital transformation] systems’ performance,’’ Bates says. This includes predicting system failure and performance trends, as well as monitoring the user experience and data-driven processes for continuous improvement across digital services and self-service, she says.

“From an architecture perspective, we reevaluated the ways in which we develop and bring to the business our support and applications, enhancing the business value and cost savings.” For example, Collins Aerospace is now taking a cloud-first approach and embracing the agile framework to design, develop, and deliver products faster, she says.

Now is the time to rethink business continuity plans, Bates adds. “Security and compliance [within] the enterprise is the ongoing, enduring work we’re doing to plan ahead,” she says. “It’s something that keeps me up at night.”

The good news is IT has good frameworks, practices, and talent in place, she says. But Bates still constantly asks herself whether the IT organization knows and understands its full architecture and whether they are doing enough tabletop exercises to be able to confidently respond and adjust.

Pushing what-if scenarios another step deeper

Given the nature of its business as a multinational electricity and gas utility company, National Grid is doubling down on business continuity and crisis management in the wake of COVID-19. Adriana Karaboutis, group chief information and digital officer at National Grid, says it’s of paramount importance for IT leaders to think deeply about the future and conduct what-ifs simulations.

It is expected that utility officials will think about what will happen if there is an event that brings the phone network down. But it’s not enough to say, “we’ll use wireless,’’ she says. “What if that goes down? We have to keep thinking about what-ifs and things you didn’t imagine, so what we are doing within my organization is doubling down on the what-ifs because did anyone expect a pandemic for real? No. So now we have to assume they’re real and let’s play them through with different scenarios.”

IT spends a lot of time building resiliency, security, safety, and measuring into its scenario planning, she says.

Change management as an organizational skill

Of course, you can never imagine all the things you need to account for in scenarios. That’s why it’s important to build muscle and plan for how to manage a crisis, says Karaboutis, who adds that this was among the top lessons she learned as an IT leader throughout the pandemic.

“We all think we’re good at it and whether something like a political or geopolitical [event] or weather hits, we want to be leaders,” she says, “but change management is such an overused phrase and so underappreciated. Change management internally is a skill’’ that includes technologies, processes, and the way in which people work.

“If I could give any advice, it would be study it, learn it, understand the cycles,’’ Karaboutis says of change management. “I’d make it a more formal discipline and [incorporate] capabilities that many companies don’t embrace.”

To do this, IT must also “build dexterity and bring in diversity of thought and experience to your teams.” CIOs must also stay on top of tech cycles, the news, and the business of their business, Karaboutis says.

“The best anticipators of change will be successful in the next unknown that comes to us,” she says.

Accelerating the transformation timetable

With so many organizations having to accelerate digital initiatives to survive the pandemic, IT leaders are also stressing the need to ensure their organizations are primed for continual transformation as a means for navigating future unknowns.

Used vehicle retailer CarMax, for example, was on a path to enable customers to fully buy and sell cars online with the goal of “empowering customers to do everything on their own,” says Shamim Mohammad, executive vice president and chief information and technology officer. In early 2020, the company had rolled out an omnichannel experience to half of the country, Mohammad says.

What went well for CarMax’s IT group when the pandemic hit was a focus on agility and nimbleness and preparing the company for rapid change, he says. What didn’t work well was focusing too heavily on “culture and adapting and mindset. We could have done a better job getting farther along in [our transformation] journey,” Mohammad says. But this has “challenged us to move quicker.”

During the session at the symposium, Mohammad said IT’s plan was to “refocus on building agility and resiliency. Then we’ll be fine. Unknowns don’t have to always be bad.”

To do this, Mohammad is hiring more engineers and investing more in technologies such as data science and AI to automate and increase the pace at which teams are innovating. More legacy systems are being moved to the cloud at an accelerated pace “because cloud gives you a lot more agility than on-premises [systems].”

This will empower CarMax’s associates and customers and give them “the option and flexibility to do the work they’d like to do where they can add the most value,’’ he says, adding that, when IT teams are empowered for transformation, unknowns can become opportunities.

“As the unknowns become more known and we can see more clearly what’s happening, our teams can really adapt and respond and create the type of experiences customers are expecting,’’ he says. “We can really take advantage of that market-changing or industry- or society-changing opportunities.”

Mohammad credits CarMax IT’s shift from being a traditional project-based organization to a product-based one as key to facilitating the company’s ability to adapt to change, he says.

Before, there were large numbers of tech professionals who worked individually. Now there are cross-functional and small, mission-driven teams that understand the company goals and customer needs and are empowered to test and learn to understand changing customer behaviors, Mohammad says.

Improving the people part of business continuity

IT leaders have also been rethinking the people part of business continuity in the wake of a pandemic that exposed several holes in their plans.

Due to the unprecedented nature of the pandemic, like many other companies, Collins Aerospace, for example, did not have a plan for almost 75% of the organization to work from home, says Bates.

“Our digital organization was running very lean when it came to spare computer hardware and peripherals,’’ she says. “We had to quickly shift our asset and hardware management practices to put hardware in the hands of employees quickly to enable their safety and productivity.” Today, the company is partnering and planning differently with key suppliers, Bates says.

Technology-wise, National Grid’s IT group was prepared to keep its 23,000 employees connected and productive during the pandemic with laptops, video, and other collaboration tools, Karaboutis says, but the group CIDO is looking to go further.

Now, “we’re setting the bar really high and knowing the persona for each [employee]’’ to have a deeper knowledge of each individual’s needs, she says. For example, IT learned about people’s struggles during the pandemic, whether it was employees who were experiencing loneliness because they had no one at home — or those with three kids who now had to be home-tutored and they had no space for an office and needed headsets as opposed to just a laptop with a camera and microphone.

“Knowing those personas and being even more prepared is something I would say we could have done better” during the pandemic, Karaboutis says.

Building in better automation

For many organizations, automation and AI have proved key technologies for navigating the workplace and marketplace disruptions brought about by the pandemic, and many CIOs see both as strategic tools for making their organizations better positioned to deal with future unknowns.

CarMax’s Mohammad is one such IT leader. Mohammad’s plans for AI include automating more capabilities that humans don’t need to be involved with. For example, when global supply chain issues arose during the pandemic and demand for cars skyrocketed, within a few weeks, the company rolled out an AI-based capability through its omnichannel experience called Instant Offer, which gives customers the ability to quickly offer a car for sale without having to talk to anyone, by using the CarMax website or mobile app.

Customers answer a few questions and are given an offer within minutes without any human involvement, Mohammad says, adding that this will help ensure CarMax staff are free to tackle whatever comes next. “If my team can focus on where they can have the most value then I think they’ll be much more open, much more able to change things happening.”

Taking stock of AI

Still, further reliance on AI can also bring about greater risk of the very business existential unknowns for which IT leaders are now bracing their organizations.

While many IT leaders say that cybersecurity keeps them up at night, privacy, risk, compliance, and ethics should be responsibilities that also worry them, Karaboutis says.

As she sees it, AI and machine learning are critical for an intelligent, connected utility, but “there has to be an envelope of ethics, compliance, and security, otherwise, anything good can turn out poorly.”

Even with the constructs and guardrails regulators and policymakers have put in place, organizations need “more belts and suspenders and policies that are commensurate with the data we’re trying to pull together,” Karaboutis says.

For example, smart meters have become somewhat mainstream. Reading them at someone’s home can tell a field worker “whether the toaster or hairdryer is running because all [devices] have a different electrical pull” and a fingerprint, Karaboutis says. But individuals may not want their utility knowing this information and their privacy has to be respected.

“You have to give consent to the ethical portion of this,’’ she says. “That’s why we as technologists as we continue to really leverage for good, frontier technologies like AI, ML, blockchain, and others, we also need to have a view of ethics, responsibility, citizenship, responsible charters and make sure we’re living within the auspices of policy and creating policy as well.”

This requires thinking “360-degrees around the good and the potential risk for harm [with] technologies that are emerging,” she says. Otherwise, organizations open themselves up to potential fallout down the line.

The most daunting challenge: Talent

Industry-wide, IT leaders say there remains a high attrition trend among IT professionals — and not enough people entering the workforce to fill the gaps. The CIOs we talked to all agree that a big part of planning for future unknowns requires talent.

“We are focusing on pleasing the innovator innovating,’’ says Mohammad. “The talent shortage is the biggest uncertainty we all have to face.”

Similarly, the other big challenge at CarMax is making sure the company culture continues to be a place where people will want to work. “That is something we cannot take for granted and we need to focus more and more on that,’’ Mohammad says.

“Without exceptional talent, digital transformation cannot happen and readiness to tackle unknowns will be hindered,’’ says Bates. “We are focused on creative new ways to attract, develop, retain, and engage our employees to remain a preferred employer of choice and a place where people can work, grow, and belong.”

There is no one-size approach to work that will fit all needs, she notes. A hybrid work environment is here to stay at Collins Aerospace, which has defined three personas for employees based on their roles: remote, hybrid, and on-site. Managers work with their employees to decide the best persona fit.

The power, Bates says, is with the employee. So Collins Aerospace is “keenly focused on employee engagement in this new normal, ensuring our employees have a tie to our purpose and mission as a company and fully understand the impact they make on the mission,” she says.

Lowering the barrier to entry will help with the dearth of staff, Bates adds. “Going forward, we have to think differently about how we attract people and take the opportunity to develop them where there are gaps. AI could be a powerful technology to complement humans.” This will require learning how to work in a human-machine world to supplement the workforce, she says.

As they plan for the next unknowns, the silver lining is the culture change brought about by the pandemic and the fact that companies now know people can work from anywhere, anytime, and be productive and safe, Bates says.

“While we learned a lot and it was hard on many of us there’s always the nuggets. Let’s learn from them and apply them to whatever the next unknown is,’’ she said during the CIO consortium. “Know where your critical assets are — not just products, but people — and how you create more resiliency around them” in meaningful ways to keep businesses going.

Business Continuity, IT Leadership