5 ms·

> it was a popular idea (especially among managers) to assume that a company can have a core competency of "management" rather than making products or services.

> it was a popular idea (especially among managers) to assume that a company can have a core competency of "management" rather than making products or services. No, that isn't the argument at all. A manager at an ice cream factory doesn't need to understand aircraft manufacturing tolerances. If a manager at an ice cream factory outsources the production of chocolate, and the chocolate that arrives as an input is slightly off-grade, it's not going to cause thousands of tons of aluminum and human flesh to come crashing out of the sky. Risk management has its similarities across disciplines, just as the principles of Lean Manufacturing are similar across disciplines. But you can't effectively outsource something you don't intimately understand, which (by the way) is why it's impossible to outsource research.

rsj_hn 7y ago
I guess I don't understand your point. First, you say "that's not the argument", but then you make the case that Ice Cream production is qualitatively different. Yes, exactly! You don't have the depth of the supply chain or the level of interconnectedness in the ice cream factory as you do when you are building a jet with pieces outsourced that are moving parts that need to work together. A slight flaw in the wing tip will change the stresses on the plane, the fuel efficiency, will require software updates, and will trigger changes throughout many other components. Now change that from "flaw" to unknown factor. In that environment, it's really impossible to specify what the tolerances on everything should be in full precision, you need a team of people with a common purpose and short communication paths who can collaborate on fixing these issues in a cooperative manner rather than in a contractual vendor/supplier relationship. E.g. if there is a problem discovered in the design, perhaps you need some changes in the wingtip design and in 1000 other parts, and everyone needs to work together to make that change. Now, what happens when these are 1000 different companies working to spec, with lots of lawyers poring over the details of what was required. It becomes an unworkable nightmare. Only a true coordination talent with heavy doses of prescience could try to solve that nightmare, Boeing thought they had this coordination talent, but they didn't because no one does. Such a talent is not a core competency of any firm. More importantly, such a manufacturing process is incompatible with innovation, where you have to be able to make lots of mistakes as you stumble towards a better design iteratively. It only works when everything is known to spec before the contracts are signed -- e.g. when you are not innovating. This type of design agility can't be extracted from the minds of conscientious engineers working together on a shared vision, and parceled out to for profit contractors looking to do spec work. Similarly risk management certainly adopts a common language, but the idea that you can actually manage risk in a quantitative way is not something borne out by experience. Rather, you can cover your a$$ and say you have sign off from you GRC people so that when stuff breaks down you can point the finger at someone. We just exited a massive financial crisis, and we see security breaches on a massive scale, most of which happen in firms with well funded GRC teams. Again, wishing that you can control these variables does not make it so. Putting together a bureaucracy to control something doesn't mean that it's controlled.
- solatic 7y ago
  > Such a talent is not a core competency of any firm No it's not, which is why agile processes have less risk than waterfall processes. You're not making the argument that Boeing should keep all of their manufacturing in-house, you're explaining why Shenzhen has become the hardware manufacturing capital of the world. Shenzhen isn't controlled by a single company, and the ability to quickly order parts from other manufacturers in the Shenzhen area allows hardware manufacturers to respond with the agility you describe. Who controls the individual manufacturing processes is less important than the speed of the feedback loops. > the idea that you can actually manage risk in a quantitative way is not something borne out by experience Well, Wall Street would disagree with you. > We just exited a massive financial crisis 2008 happened not because the underlying risk models were wrong but because people were sold high-risk instruments on the fraudulent premise that they had almost no risk at all, and the rating agencies which mislabeled the risk hid behind the First Amendment. If the high-risk instruments were honestly represented at sale, they wouldn't have been purchased by people seeking low-risk instruments, and the portfolios of most market players would've been well-diversified as planned and able to withstand those kinds of shocks. That the rating agencies were able to hide behind the First Amendment (risk assessments are not political speech) and that nobody went to jail for the fraudulent risk assessments remains a great injustice, in my opinion. > we see security breaches on a massive scale Because law and regulation do not set sufficient financial penalty for insufficient security practice and the market at large has shown not to care enough about security to punish players with poor security practice, so the financial risk of a breach is (in my opinion, unacceptably) too low to cause a change in corporate behavior. Again, not an issue with risk management, just people responding to systems as designed. > Putting together a bureaucracy to control something doesn't mean that it's controlled. Sadly I actually agree with you on this, which is why I wrote, and I quote, "competency at shifting numbers around on bean-counting accounting sheets is not the same thing as competency at outsourcing".

rsj_hn 7y ago

I guess I don't understand your point. First, you say "that's not the argument", but then you make the case that Ice Cream production is qualitatively different. Yes, exactly! You don't have the depth of the supply chain or the level of interconnectedness in the ice cream factory as you do when you are building a jet with pieces outsourced that are moving parts that need to work together. A slight flaw in the wing tip will change the stresses on the plane, the fuel efficiency, will require software updates, and will trigger changes throughout many other components. Now change that from "flaw" to unknown factor. In that environment, it's really impossible to specify what the tolerances on everything should be in full precision, you need a team of people with a common purpose and short communication paths who can collaborate on fixing these issues in a cooperative manner rather than in a contractual vendor/supplier relationship. E.g. if there is a problem discovered in the design, perhaps you need some changes in the wingtip design and in 1000 other parts, and everyone needs to work together to make that change. Now, what happens when these are 1000 different companies working to spec, with lots of lawyers poring over the details of what was required. It becomes an unworkable nightmare. Only a true coordination talent with heavy doses of prescience could try to solve that nightmare, Boeing thought they had this coordination talent, but they didn't because no one does. Such a talent is not a core competency of any firm. More importantly, such a manufacturing process is incompatible with innovation, where you have to be able to make lots of mistakes as you stumble towards a better design iteratively. It only works when everything is known to spec before the contracts are signed -- e.g. when you are not innovating. This type of design agility can't be extracted from the minds of conscientious engineers working together on a shared vision, and parceled out to for profit contractors looking to do spec work. Similarly risk management certainly adopts a common language, but the idea that you can actually manage risk in a quantitative way is not something borne out by experience. Rather, you can cover your a$$ and say you have sign off from you GRC people so that when stuff breaks down you can point the finger at someone. We just exited a massive financial crisis, and we see security breaches on a massive scale, most of which happen in firms with well funded GRC teams. Again, wishing that you can control these variables does not make it so. Putting together a bureaucracy to control something doesn't mean that it's controlled.

solatic 7y ago
> Such a talent is not a core competency of any firm No it's not, which is why agile processes have less risk than waterfall processes. You're not making the argument that Boeing should keep all of their manufacturing in-house, you're explaining why Shenzhen has become the hardware manufacturing capital of the world. Shenzhen isn't controlled by a single company, and the ability to quickly order parts from other manufacturers in the Shenzhen area allows hardware manufacturers to respond with the agility you describe. Who controls the individual manufacturing processes is less important than the speed of the feedback loops. > the idea that you can actually manage risk in a quantitative way is not something borne out by experience Well, Wall Street would disagree with you. > We just exited a massive financial crisis 2008 happened not because the underlying risk models were wrong but because people were sold high-risk instruments on the fraudulent premise that they had almost no risk at all, and the rating agencies which mislabeled the risk hid behind the First Amendment. If the high-risk instruments were honestly represented at sale, they wouldn't have been purchased by people seeking low-risk instruments, and the portfolios of most market players would've been well-diversified as planned and able to withstand those kinds of shocks. That the rating agencies were able to hide behind the First Amendment (risk assessments are not political speech) and that nobody went to jail for the fraudulent risk assessments remains a great injustice, in my opinion. > we see security breaches on a massive scale Because law and regulation do not set sufficient financial penalty for insufficient security practice and the market at large has shown not to care enough about security to punish players with poor security practice, so the financial risk of a breach is (in my opinion, unacceptably) too low to cause a change in corporate behavior. Again, not an issue with risk management, just people responding to systems as designed. > Putting together a bureaucracy to control something doesn't mean that it's controlled. Sadly I actually agree with you on this, which is why I wrote, and I quote, "competency at shifting numbers around on bean-counting accounting sheets is not the same thing as competency at outsourcing".