Much Ado About Nothing? - Brief Article

Internal Auditor, Feb, 2000

SINCE THE WORLD'S COMPUTERS ROLLED OVER TO 2000 ALMOST WITHOUT incident, the Y2K "scare" has left some people skeptical about whether or not all the hoopla was necessary. Media worldwide keeps asking the same question: "Was the threat of technology failure overstated, or did the hundreds of billions of dollars spent on our systems prevent a catastrophe?" Around the globe, government officials have felt obliged to defend their spending. "Things don't go right by accident," said Michael Granatt, a director of the British government's millennium center. "They go right through proper planning." White House Y2K guru John Koskinen agrees: "Had the effort not been made, we would be in a very different situation."

Denys Martin, Y2K consultant and project manager in Australia, predicted this development in "Down to the Wire" (Internal Auditor, December 1999). "Debate will rage after the first of January on what a tremendous waste of money Y2K has been," he said. "Internal auditors should prepare themselves for potential criticism over why so much money was spent on fixing Y2K when nothing happened."

Fallout of this sort--though maybe not of this magnitude--isn't new to risk managers. Several years ago, the makers of Perrier bottled water recalled 160 million bottles in 120 countries when traces of the carcinogen benzene were discovered in their product. Perrier president Jacques Vincent called it "a brutal crisis." Although consumers outside France were without Perrier for just 10 weeks, sales and reputation took a significant hit; and the company received criticism for its decision. "In a rational world, there would have been no Perrier recall," wrote Daniel Seligman in Fortune magazine, suggesting that the cancer risk to consumers was so miniscule that the company's reaction was overreaction.

I'm not so sure I agree. Perrier was right to sacrifice dollars for safety, any other choice could have placed consumers--and the company's future--at too great a risk.

I must admit to a bit of hypocrisy, though, when these types of risk-averse decisions have disrupted my life, Last year, with hurricane Floyd churning toward central Florida, The IIA's risk management team opted for mandatory closure of the Institute, shutting down my computer as I worked to produce the magazine. Fuming over potential missed deadlines and the certainty of overtime, I went home to wait out the storm that never came. The following week, when hurricane Gert took a similar path, I disregarded our storm center's warnings, as did most of my fellow residents. Although we got lucky again, images of the devastation in North Carolina reminded me of the fate I had tempted.

It would behoove all of us to remember--whether risks are infinitesimal or great--that just because nothing bad happened, doesn't mean it can't. Following Y2K's anticlimax, Gordon Anderson, mayor of Grants Pass, Oregon, reported that he worries that the absence of trouble will lull society into believing that preparation for unseen disaster isn't necessary. "Unless we have the self-reliance to prepare and be ready for emergencies, whatever they are, we are at the mercy of fate," Anderson said.

Truth be told, though it may prove time-consuming, tedious, or costly, I'd rather auditors and risk managers err on the side of caution when lives are at stake. The next time technology throws us a curve or a hurricane bears down, I wouldn't want our risk managers to allow potential grumbles from inconvenienced employees, customers, or management to hinder objective risk analysis or conviction in decision-making. And there will be a next time. At least that's my prediction.

LEAH MILLER, Managing Editor