Enjoy the fantasy of a V while you can

It is too early to project what the new world will look like after this, but the world will change. The Black Death of 1347 – 1351 brought about huge changes, including contributing to the breakdown of the system of serfdom. The ability for individual labourers to demand a higher level of payment (money and food) for working on the lord’s, or the neighbouring lord’s fields, was opposed by the nobility and even resulted in the “Statute of Labourers” making it illegal to pay more than pre-plague wages / amounts. The Statute ultimately failed, but was implemented in places. The depopulation of manors and loss of serfs made the reality on the ground, so to speak, the driver for having to attract labour through increased wages.

So what types of changes might we see, and why?

In summary, expect cascading failures and pull-backs from existing economic activity to become self-perpetuating. Business failures will increase unemployment and reduce disposable income across the business services and service industries. Reduced incomes will impact retail while staff returning to the office will be entering a new world, with fewer people in the office at any time, and ‘home working’ becoming common. Manufacturing with recover, slowly, but during that recovery excess capacity will act as a drag on capital expenditure. Financial institutions, regardless of the level of government support and bailouts, will suffer a rising wave of commercial and individual defaults and bankruptcies. There will be failures of financial institutions, especially local banks and financial institutions are not considered of national or international systemic importance. The dream of recovered stock markets will die along with the destruction of Price/Earnings ratios and revenue projections. Social unrest and backlash against an uneven bailout will grow further, and will eclipse the “Occupy Wall Street” movement. The real danger is that the failure of “Occupy Wall Street” to result in any meaningful change will drive more hard-line social unrest.

So let us enjoy this time of quarantine and fear, when we are being told and still believe that everything will somehow return to the status-quo-ante. Let us enjoy this moment of the fantasy of the coming “V” shaped economic recovery, before we realise that a Nike Swoosh is probably the best we can hope. Yes, there will be a powerful rebound, but that will not be sustainable, and full recovery from the underlying recession or depression will take a considerable time.

Although this article focuses on the economics and potential economic impact of the crisis, there will be massive social and cultural impacts. I'm not addressing those here, though the impact will be more significant than we expect.

Employment

One of the first things that I hope we have all learned is that our society, no, our civilisation, is held together by people paid minimum wages. That profit is the primary motivator of companies, even in this time of crisis. As horrible as it may sound, to many companies, people are a fungible resource.

When economies do stagger back to life, businesses will discover that they are extremely tight for resources and cash, and that labour is plentiful. Are hiring companies going to pay a "living wage" if they can hire at slave wages and serfdom conditions? Profit is still the only meaningful motivation, and it will stay that way.

Yes, even in the middle of this crisis, profit comes first. There have been stories of private-equity backed Healthcare providers cutting the salaries, time off, and retirement benefits of staff, citing lost revenue. Let me just say, there is a special place in hell for people who make decisions like this. Maybe there will be regulatory intervention, and personally, I hope so, but I am not hopeful that the kleptocracy that runs corporations has a soul (certainly there are some, but I admit that I'm speaking in generalities here), or that it has any god before money.

Expect that as workers return, they will be returning to a working world in which their benefits have been cut and their pay is less, and they will be reminded that they should be thankful that they have a job. This is in no small part because a lesson from this crisis is that machines and automation do not need safe working distances, do not get sick, and do not suffer from rising health insurance costs, where employers cannot get out of paying health insurance.

The Statute of Labourers failed because the shortage of labour changed the economic equation. This time, if there is a Statute it will be for safe workplaces to protect production, not people. There will be no need for the Statute to constrain the cost of labour, because automation, reduced economic activity, and reduced demand will further undermine labour, with more labour than will be required.

There will still be very good employers, and there will be companies for whom their internal society is terribly important, and their people truly matter to the owners and managers. Yet most of these will be the privately held companies, and for the listed companies that rely on the highly skilled and knowledge workers.

Tourism

The first area of fundamental change will be tourism. Let’s look at one example; why will tourism and annual migrations from the UK to Spain be a casualty? First, we need to see why it grew and became the reality that it is. We need to follow the chain.

Higher incomes allowed people to travel to Spain every year. Cheap flights were possible because so many people could afford to travel, and the volume of flights and available seats that grew to meet that need drove down prices. The high level of available flights created the opportunity for the development of huge resorts, which once again become ‘cheap’ due to volume. Safe water and food removed concerns about health. Rising incomes in the UK led to more travel, which generated more airline seats, feeding more and larger resorts, building better destination infrastructure (including food and health), boosting local incomes, creating the economic capacity for outbound travel. And so a “virtuous” cycle continues.

Destroy any link in that chain, and that virtuous cycle collapses.

• Remove flights and seats, and the numbers of travellers plummet, resorts lose business and lay off workers, local incomes drop, impacting local infrastructure that services tourists.
• Remove perceptions that Spain is a ‘healthy’ destination, and the desire to travel falls, and with that fewer travellers, fewer flights, failing resorts, and carry on around the circle.
• Shut resorts (even for a short while) and local unemployment increases, reducing incomes, increasing pressures on infrastructure, and follow the circle. A high percentage of hotels are at risk of bankruptcy in tourist destination countries.
• Bankrupt hotels and resorts, and the property values of private residents will fall, making it difficult to sell those properties, creating a glut and resulting in property development projects failing and new projects being stopped. Properties go empty, jobs are lost, travel slows, and follow the circle.

How much will tourism change? I have no idea, but I do not expect tourism to ‘rebound’ any time soon. “Safe” destinations will be few, and capacity to carry tourists will be also limit any rebound. Even the perception of destination health will be impacted by reduced capacity due to loss of demand from reduced economic activity in the source countries. 2020 will be the “year without tourists”.

Greece, for example, is accepting already that there will be no meaningful tourist season this year. The economic damage will be significant, for a country that survives on tourism. There are large, high-end resorts on the island of Karpathos that are reliant almost entirely on tourism from Italy. That will not be happening this year. These high-end resorts will simply not open this year. But their debt will not disappear, nor will the need for basic maintenance, though that, of course, will be reduced by the reduced wear and tear from zero guests.

And yet tourism is only one sector.

Commercial property is another. There are two commercial property markets that will change. While we may not know exactly how “retail” or “business” will be impacted, we can guess. Each will be impacted differently, but for similar reasons.

Retail commercial property

In much of the developed world, in-store retail has been in decline with online retail taking a growing percentage of sales, though still small. In the UK, online grocery shopping has exploded, and may well become the norm. What will this mean? Supermarkets will shrink. Local grocery and ‘convenience’ store will remain, servicing smaller sales and local customers who do not move online. But I expect that in six months, possibly 50% of grocery sales will be online and delivery or collection.

Already a major supermarket chain in New Zealand has closed one of its large stores and converted it into a fulfilment centre for online orders. It is easier to fulfil from one location and provide central delivery management than to implement a store-picked and collect system in each store.

Grocery is only one area where this will become a new norm. Electronics, household, possibly even furniture will be bought online and delivered. Ikea, famous for their massive stores, may well find that much of their product moves online, and that foot traffic drops.

All is not lost. Expect shoe and clothing stores to, possibly, ‘survive’ because is it difficult to try on a pair of shoes, a shirt or jeans online. Browsing will also change, with some stores, clothing and other, already scheduling the booking time of patrons, or as in the case of Greece, limiting the number of shoppers to 1 shopper per “x” square metres or feet of retail space.

Commercial office property.

If we have learned one thing already, it is that we can work from home, and that people can be productive outside the office. Yes, some are not productive, but some were not productive in the office. “Video meetings of multiple people are not possible.” Well, actually, it has been possible for well over a decade, there just has not been "compelling reasons" to do so, when everyone was able and expected to come into the office, and business travel was inexpensive.

No more. There is now a compelling reason to not be in the office.

I’m guessing that once out the other side of this, total office floor space requirements will fall. While there will be a mandated increase in the floor space per person, the number of people in offices will drop dramatically.

For example, the number of people that actually need to be in the office has been falling for some time already. The General Medical Council in the UK has reduced floor space in London over the past years. Many jobs were moved to Manchester from London, and the London office was reduced to a single floor. Yet total employees in London began to rise again. As the numbers of people on the floor came close to reaching saturation, the order went out for all workers to work one day a week from home, and to hot-desk when in the office.

This worked, and it proved that people can work from home.

Many businesses are now discovering that all their staff can work from home. Internet speeds can be an issue, as can the availability of laptop computers for all staff. But computing capability and internet access in developed countries are ubiquitous, and companies are functioning.

Many businesses have discovered that they can work from home. Recently an Audit Committee met via video meeting from four locations, when historically all participants would have flown to the corporate headquarters. That was before the full work from the home requirement. Another meeting after complete lock-down brought together over a dozen company Directors for a working session, each via video from their home offices.

When this has passed and people are expected to return to the office, we probably will not have everyone in the office at any time. We may well divide our companies into Teams-A, B and C. Only one team would be in the office any given week. This would be to allow the socialisation aspects of work that are so important for company culture and giving people a sense of belonging, to allow training, and to provide the opportunity for face to face administrative activities (hiring, firings, reviews, etc). In such a scenario, even with each person requiring more space, the total floor space required by the company would drop by a third.

Reducing office space requirement by a third, even for a subset of companies, will depress significantly the total commercial office space required. It will also impact the supporting businesses that provide services, food and drink to workers, and the transport infrastructure required at peak times to move people to and from workplaces.

The fall in office space demand has started, and it will “fall off a cliff” through 2020 as companies change how they work, and of course, as existing companies go out of business in the recession/depression that is upon us, thus “freeing up” even more commercial office space.

The difference is that recovery will be slowed by the fundamental change in the way people work and in the way companies bring their people together for work.

Service industry

Considering the drop that we can expect in commercial office demand, the ripples from this will be catastrophic, or not, depending on your perspective. Possibly the only industry that will grow will be the professional cleaning services, who may find that the amount and detail of cleaning that will be required will shoot up and remain up, once businesses are able to reoccupy offices. The need to deep clean offices will remain, and pre-Covid cleaning was not enough.

But the CBD (Central Business District) coffee and sandwich shops, dry cleaners, document destruction services (printing could drop by 50% or more) and almost any business that supports offices will be returning to an environment in which much of client base has disappeared.

Public transport utilisation will drop. There will be fewer commuters, and there will be fewer miles driven (though people will use cars over public transport if at all possible). All services that rely on commuters and traffic will find their volumes have reduced and will take longer to recover than hoped. Public transport will continue to be the primary form of commuting in urban areas, but quite probably the ridership levels will decrease. Certainly, there will be a demand for higher levels of cleaning to continue.

Yet the rot will go far beyond services, and into production and manufacturing.

Manufacturing

Consider the Automobile industry. Shocked by supply chain shortages first originating from the shutdown of factories in China, automobile plants in Korea shut, and in the US factories have been shuttering temporarily. The collapse in the automobile industry was beginning before Covid, as a combination of market saturation and excessive debt was already manifest in reduced sales around the world. Covid has crushed not only demand but supply as well.

And with the economic depression that is coming, demand will remain low.

Demand will remain low across a range of products and services. Where there is demand today, that demand will be lower in the coming year or two, pushing small and medium manufacturing companies to the wall. For example, steel fabrication companies could be in trouble, if commercial and multi-residency property construction declines or fails.

Again, failures or contractions in one area of the economy will ripple through to other segments. Reduced personal and corporate incomes will reduce capital spending on higher value or cost items. This will result in lower production and lower incomes for manufacturing, resulting in failing companies and fewer workers, and so the cycle will continue.

As the companies fail or are so constrained in income and payment delays to survive, loans delinquencies will increase. And not just corporate loans.

Financial Services

This section might sound like "unfinished business" from the 2008 crisis, and the reason is that there indeed remains "unfinished business".

A new age of deleveraging is upon us. And unlike the 2008 crisis, this will not be short term. Of course, immediate deleveraging is not going to happen. The first thing that will happen will be massive stimulus to attempt to soften the blow and hopefully keep businesses open, or at least enable them to reopen after the lock-downs are lifted and people can circulate freely once again. But heaven help us after the end of the sugar rush – a rush as monsterous in size as it is becoming.

The age of massive consumer debt will come to a shuddering end. Without assets, there will be no credit, and leveraged assets are the first thing that is going to disappear. Leveraged assets include credit card debt and capacity, mortgage capacity, and the ability to borrow against the equity in high-value property or other assets. Consumer credit will increase in cost at the same time that consumer credit (credit cards, revolving loans, auto loans and student debt) will go into arrears, and default rates will climb. There simply will not be enough stimulus available to keep those loans from going bad.

It won’t happen overnight, but it will happen within months, not years.

Mortgages, rental and utility payments will not be forgiven, even if there is a moratorium on evictions of foreclosures. All that will happen is that the pain will be pushed out by a period of months, because rental property owners, individuals and small or large businesses are themselves leveraged, with their own mortgages or other loan facilities payments due.

Take away the incomes from a population that already lives pay-cheque to pay-cheque and stimulus will not keep them in their homes (rented or mortgaged) and will not pay utility bills. What will give first?

Moving now to corporate debt. Bond purchases by national governments can only carry on for so long. Eventually, the only bonds left to buy (or issue) will be junk, and governments will know that they are purchasing assets in the form of bonds that will default, because the underlying businesses will not be able to survive. We will see bonds being issues to pay operating costs and not for capital investment or other productivity creating an investment.

And be clear, with or without bans on share buybacks, clever CFOs around the world will be finding ways to shuffle bailout monies to the shareholders. These CFOs know full well that the defaults will rest only on the companies, employees and counterparties and ultimately of the government agencies that have purchased their debt. Yes, the shareholders will “lose everything”. But that “everything” lost will be lost after every last penny that could have been sent their way has been. Managerial bonuses will be paid, but not as bonuses. Advances on projected income; personal loan forgiveness, contractual obligations to forward pay multi-year benefits, and stuffed personal pension funds will ensure management gets the pie.

Yet all that will come at a cost to the financial sector as loans default, collateral is rendered valueless, and bonds default. Non-Performing Loans are going to grow at a scary rate in the coming year, and eventually, we should expect the creation of one or more national “bad banks” to hold the non-performing debt, while more money is pumped into zombie corporations that are “systemically important”. Of course, the money will not be pumped into the original failed companies, but into the companies that will be required, via central bank mandated shotgun weddings, to purchase the assets of the failed companies, including their outstanding debt.

Ultimately that newly created debt will need to be paid, and there are two options only; greater productivity that grows at a pace faster than the debt, or through inflation. And inflation will need to be at a pace, ultimately, that is faster than the growth of the debt.

So who has confidence that their government will be able to manage that and not turn all our countries into later day Zimbabwes?

Going shopping in the days of Covid-19

After a full week-plus inside, and with fresh food beginning to run a bit low, I did go out to shop, as I promised myself. The weather contributed just as I had hoped, it is cold (well, cool) and raining, cloudy and a bit of wind. Exactly the right weather to go out in, as everyone else is staying home.

Prepared myself. Glove ready, face mask ready. Shopping list. Everything ready to put my clothes into the washing machine on my return (except for my leather jacket and boots). Sent SMS to say I was going out, and received the SMS response saying ‘go out’. So all the rubbish that I had collected for the past week and a half was ready, and out I went, all gloved and masked.

Here in Greece, if you want to go out of your house, you are required to complete a form and take it with you, or send an SMS to 13033 with the reason code, your name and address, and you will receive a response saying "go out". Without one of these, you can be fined. I really like this system. We each need to consider why we are going out, and prepare, and this also helps authorities to manage volumes.

The pharmacy downstairs did not have a queue, but the money transfer shop a few doors down did. I’m guessing people receiving government income or remittances from family outside Greece. (Queues today mean people standing around in a big semi-circle, very one knowing who is next, so there is no "standing in a line", something that Greeks cannot do in the best of times.) Had a quick chat with the pharmacists. She is a hero as far as I’m concerned, doing her job through all of this, with a smile for everyone. She let me know that everyone in the building received their masks and are very happy and thankful.

Then it was a walk to the shop, which Google tells me is 800 meters away. A nice easy and comfortable was, with very few people out; mostly only people walking their dogs or those obviously shopping.

Entering the supermarket I was greeted by an employee (face masked) who squirted sanitiser on my gloves, and then on the handle of the shopping basket. She then put a plastic sealed number in my basket. I suspect that they are only allowing a limited number of people in at any time, though having picked my time, there were reasonably few people, with plenty of room for distancing.

the store was well stocked, including toilet paper.

So I am now stocked up again.

Arriving home the process was reversed. Jacket and boots at the far end of the apartment in their own quarantine for the next four or five days, hat away, then mask and gloves off and into the rubbish. All clothes off and into the washing machine, and me into the shower. A good soaping and washing, out, and turn on the washing machine on long cycle and 60c, since my reading and watching suggests that temperatures over 55c will kill the virus. Into the kitchen, new gloves and face mask, and all the shopping either wiped down, or removed from packaging and put away. Anything that I could was put in the highest shelf in the cupboard and will not be touched for at least 4 – 5 days, and then with wipes again.

Is that safe enough, or overkill? I have no idea. But it seems to make as much sense as anything else, and seems to make more sense than ignoring. I did see people out without masks, including the fruit and veg guy at the supermarket. Someone who comes in contact with hundreds of people. I feel for him, but there are masks available, and without a mask he increases his chances of catching this, and his chances of spreading it while he is asymptomatic.

I really do think that by the end of summer, not wearing a mask in shops will be seen as poor-form.

A magical journey, the Panama Canal Railway

A year ago we had the opportunity to take the Panama Canal Railway journey from Panama City to Colon. It was simply enchanting.

The Panama Canal Railway provides a sightseeing trip from Panama City to Colon. The service was excellent, and the views spectacular. The Panama Canal Railway is primarily a freight line, moving containers from Colon to Panama City and back. Economically it can make great sense to off-load contains in one port and load then onto other ships at the other end of the canal. This allows a homogenous shipment to be broken down and distributed to ships going to a range of ports on the other side of the canal, and saves the cost of sending the ship through the canal. 

There is also a daily "commuter" rail service from Panama City to Colon in the morning with a return trip in the evening. This doubles as the tourist train.

The train leaves Panama City promptly at 7:15am (return is at 5:15, promptly). The train travels through the lush forest along the side of the canal, and bursts out at the town of Gamboa (as in the video above, though sadly it was not a sunny day), and the line then passes beside the canal for most of the remainder of the journey.

Possibly the most magical part of the journey is then the train feels like it is gliding over the middle of Lake Gatun, the lake that enables the canal to exist. With no tides, and no danger of the water level rising, the train tracks are flat and straight, and the train seems to float across the lake. It is easy to imagine the train laying floating track in front and rolling it up behind, as it makes its way across.

Sadly at the Colon end of the trip. the train slowly rolls past a stinking acre of rubbish that may be burning depending on the rain, but certainly is being picked over by Panamanians and vultures.

Approaching the northern terminus there are great views of the new bridge, built to open up the Caribean coast west of Colon.

The price is $25 per adult, and is well worth it. 

Convincing Boards to focus on Cyber Security is no easy task, when...

Convincing Boards to focus on Cyber Security if no easy task, when those working in the business have priorities, responsibilities and rewards specifically structured to make Cyber Security a lower priority. Convincing Boards starts from the "middle" and must work both "down" and "up", and it will not be an easy or fast process.

I recently spoke to the CRSA (Control Risk Self Assessment) Forum in London, hosted at the IRM's offices (with thanks to Carolyn Williams), and very ably organised by Paul Moxey. My desire was to highlight the challenges that management (operational to the C-suite) face, and the decisions that must be taken, many of which lead to a de-prioritisation, or even ignoring, of Information Security.

This is not to suggest that Information Security should be de-prioritised, far from it. But the purpose was to highlight the difficulties that the Risk Professional will have in gaining the internal support to both raise and then to gain resources required for effective InfoSec.

To encourage the participants to consider (and actually, engineer scenarios in which InfoSec would lose out to other priorities) I provided two "role-plays". A very quick caveat; neither case represented a real company or actual situation, but was built from a wide range of situations I have been party to or have been the Internal Auditor or Risk Manager associated with elements of the case.

Role-Play 1: "Complex project choices"

The first looked at project level issues and delivery concerns leading to a situation in which InfoSec, while critical, was actually "pushed into the long grass" by each group that considered the case.

You can "enjoy" the role-play case study here.

The constructed problem centres around the competing constraints facing any business when it comes to systems implementation. The various strains on all members of a project team, including the leadership, sponsor, and steering committee, require to balancing of resources and priorities. Sometimes individual incentives outweigh the needs of the business. While this is not acceptable, it is a reflection of the reality of motivating people, and in some cases, focusing those people on outcomes that they are responsible to deliver.

When participants received the "role-play", there were more than a few people saying "I've worked on this project".

The premise was fairly simple; the project is in its final stages but has run over budget (Quelle surprise) and over time: and the user community's level of frustration is rising to breaking point. The infrastructure model is not adequately integrated into the corporations secure environment, and the additional time and cost will push the project further over budget and time.

The groups were then asked, each playing a specific role, to provide a recommendation, as a group.

As expected (and constructed), not one of the groups said that project implementation should be delayed until security concerns were addressed. In one group, the person playing the role of the IT Infrastructure representative threatened to "call Internal Audit" to which there was a response, "So you plan to stab your colleagues in the back?"

Others proposed setting up a working group to assess and recommend addressing the security and infrastructure issues after the project, while acknowledging that this would become, in effect, a new project fight for resources against all other projects. But it wouldn't impact their ability to deliver what they were required to deliver.

The final takeaway for participants was that it will be difficult to gain the internal allies required to address security if their support will be counter to their own needs, responsibilities and rewards.

Role-Play 2: "The C-Suite and External Expectations"

Likewise, at the C-Suite level, internal and external expectations can be such that investment in Cyber Security becomes a secondary consideration behind meeting the short-term demands of shareholders, markets or owners. This Role-Play set out to demonstrate the push and pull of competing requirements, again against a backdrop of systems implementation coupled with quarterly reporting needs, in challenging market conditions.

Take a look at the Role-Play here.

The four participants (the COO, CFO, CIO and Director of Communications) each have competing priorities, yet all are also keenly interested in ensuring company success.

Read the Role-Play and decide for yourself how these individuals should respond, and challenge yourself to find a way for them to agree to invest in greater Cyber Security, or to make a recommendation to the Board to do so.

Once again, while all but one of the groups could bring themselves to abandon their roles' self-interest, they did all recommend that the CIO push Cyber Security to the top of his or her agenda for the coming quarter. The outlier group suggested that the business "take the hit" this quarter and focus on Cyber Security, while also communicating the markets that they were doing so to improve the company's ability to protect and server customers in the future (though they did not agree fully on how to avoid the potential ramifications of announcing that they would focus on Cyber Security and the potentially associated assumption that their systems were not secure).

Summing up:

In both, or either case, do you recognise your company, or a company you have worked with in the past?

If so, be assured that it is possible to convince Boards, but only once the required groundwork has been completed. In the two Role-Plays above, it is too early, and there are too many competing priorities. But there is hope in each, in that the need is recognised, and there are ways out.

Gaining Board agreement on Cyber Security requires time and planning, with careful messaging along the way. In addition, before the Board can "buy-in" to investment in Cyber Security, key stakeholders within the business must also "buy-in", as it will be their alternative expenditure and investment plans and programmes that may suffer or be put on hold to accomplish improved security.

Role Play 2: "Shareholder Expectations"

Shareholder expectation generally revolves around the meeting of targets, primarily revenue and profitability targets that ensure either a dividend flow (private companies and utilities) or sustained growth in the share price. Senior managers, "C-Suite" executives and Directors know this and know that their bonuses and futures (in this company and in any others) depend on a track record of delivering to shareholders' expectations.

Welcome to the mid-year session of the Exco as it prepares for the upcoming earnings release season. Things seem to be on track, and the 1st Qtr results were in-line with expectations. The share price has responded roughly as expected. This quarter however, could be a little more difficult. Trading conditions are worrying the Marketing director, while internal costs are not dropping as quickly as budgeted. The new system is going to be at least two months late, possibly three, pushing benefits into the 4th Qtr.

You now have to make some decisions:

1. The COO. You have numbers to make, promises to keep. The numbers that you received from your senior managers are promising, but you don't believe them "I've seen numbers like these before, and they are always overly optimistic". Your CIO is constantly late with delivery, system outages have become too frequent, and the IVRs never seem to match the problem. To compound things, someone in IT changed the “404” error page to redirect to the Dictionary.com definition for “liars”.

2. Head of Corporate Communications. When dealing with crises and missed targets in the past, your motto has been "Bad news is good news, good news is no news" and the spin spin spin. But you feel things are reaching a point where your own credibility is coming into question. If things continue as they are, you're afraid the only professional option left to you will be to apply to become the Director of Communications at the White House in Washington.

                

3. CFO. You've managed to, just, get the numbers right for the 1st Qtr results, but this quarter will take a small miracle, and missed targets have been shown to severely limit the longevity of CFOs. The numbers expected by the markets (or owners) are possible, but there better not be any down-side surprises. There are costs that can be shifted into out-quarters, and revenue that can be brought forward, if we tweak our revenue recognition policy.

4. CIO. You know that the existing systems need replacing, that infrastructure is supporting the users, but the Security guy(s) are telling you that a serious architecture review is needed (again, "review" means they know there are problems but are too afraid to tell you everything), and the company simply cannot continue to avoid significant new investment. Your proposals for Security investment themselves will increase the overall IT budget to the equivalent of 12% of revenue from the current 10% of revenue, a level that is already at the high end of the scale for this kind of business.

Time to have your conversation, and come to an agreement that the CEO will be able to defend at the next earning call/shareholders meeting.

Role Play 1: "Complex Project Choices"

Scenario: A new system is in the final stages of development, and should "go-live" in three months. Testing is ongoing with the usual bugs and use-case mistakes. The project is projected (for the third month in a role) to come in at exactly 109% of budget, thus avoiding the need to go back to the Board for authorisation for additional spend.

The COO has committed to the Board that the system will go in on schedule. Internal Audit has given an "adequate" grading on a review of the project to date.

IT infrastructure has just reported that the servers will be ready, but that they will not be within the secured domains used by other corporate systems. To do so will require a re-architecting project. However, they do not think there is a major security threat, though when pressed, they've admitted that it would be possible, under "extreme" circumstances, for a hacker to gain access to "some" data. Re-architecting the environment will take an additional 4 months, and will add £275,000 to project costs, taking the project well over the 109% of budget.

You are now meeting to "discuss" the situation. You are:

1. Project manager. If you do not get this project in on time and within the allowed budget, you lose your bonus (20% of your salary), and you probably will not get that next project. Worse, you’re regular steering committee meetings with the sponsor (and team) are becoming a nightmare of complaints about timing, internal resources being diverted to testing, costs, etc.

2. IT infrastructure. You don't completely trust your own people's assessment, as there have been breaches before when some data was stolen. You also know that the 4-month estimate is probably optimistic. A few people in your IT team know too much about your systems, hoard that information, and honestly, you would have “moved a few on” if they didn’t hoard their knowledge. Can you trust them to fix the architecture in anywhere near to estimated time or budget?

3. Operations Manager from User Community. Your people have been crying out for this system for years, budgets have been cut, headcount reduced, and people are reaching a breaking point, with absenteeism escalating. Meanwhile, the project continues to demand more of your frontline experts for “testing”.

4.  Strategic Planning. Your models show that this system is going to boost profit by 5% annually, with an immediate 2% this year, to a profit-line that is already stressed. Missing the targets is not an option, as the cost of future external funding through equity or bond issuances will be impacted by the company’s evidence of being able to meet market expectations.

So, what do you all agree to recommend and do?