All Is Going Well Until It Isn't: Metrics That Turn from Green to Red Overnight
Organizations often assume risks are under control based on positive metrics, but critical cracks remain unnoticed until a sudden crisis erupts. This mental model highlights the danger of incomplete reporting and the failure to see that key mitigations are insufficient.
THE IDEA
All Is Going Well Until It Isn't. Metrics That Turn from Green to Red Overnight
Another problem you can see is when an organisation has identified a critical risk and has, in principle, measures in place to keep it ‘under control’, but then, suddenly, the risk turns into a crisis in the space of a few days. After which the board, senior management and other stakeholders ask: ‘How did that happen?’
Hurricane Katrina, which devastated New Orleans and the surrounding area in August 2005, caused thousands of deaths and billions of dollars in damage. It was an example of a risk that many thought was ‘being worked on’ (especially after Hurricane Isidore, Hurricane Ivan and the Hurricane Pam exercise). Hurricane preparedness was progressing, but some of the most crucial mitigating actions (building levees, etc.) were not improving as quickly as turned out to be necessary. The inquiry report provides a painful but powerful reminder of how easy it is to know about a risk, be in the middle of improving things, but be missing the fact that critical ingredients are still missing. The title of the inquiry report says it all, there was ‘a failure of initiative’.16
I see similar problems quite frequently:
- A project is reporting positive progress, with a few minor setbacks, and then, suddenly, there is news that the project will be delayed.
- News that business continuity plans are mostly in place, with no serious ‘red flags’, but then things are shown not to be working (which happened a lot during the COVID‐19 pandemic).
- Cyber security and ransomware risk is reported to be ‘under control’, and then it isn't.
- Work is underway to encourage staff retention; but then it transpires that some key staff (e.g. working on IT projects) have left for a consulting firm, resulting in project delays.
When a root cause analysis (RCA) is conducted, a common finding is that the relevant risk was on the radar screen, but it was either:
- not being reported upwards on a timely basis (as discussed) or
- not understood (and documented) in ‘high definition’, so that critical cracks might be more clearly seen 17 or
- reported from a ‘glass half full’ perspective rather than ‘glass half empty;’ again, masking the urgency of what may still need to be done. (Illustration 5.3 epitomises the problem, which can be encountered both in a business context and in daily life.)18
The detail reported upwards and the criteria used to judge whether work is ‘on track’ both affect how easily critical gaps can be missed.
Illustration 5.3 Perspectives on progress
When to use it
Project management: Use this model to challenge overly optimistic status reports and ensure critical path risks are visible.
Cybersecurity: When reviewing vendor risk or internal controls, look beyond compliance checkmarks to actual resilience.
Crisis preparedness: Before a crisis, run a 'premortem' to imagine what could go wrong and identify whether current metrics would detect it.
Personal decision-making: Apply the model to personal goals (e.g., health, finances) where surface progress may mask underlying vulnerabilities.
FROM THEORY TO EVERYDAY LIFE
In practice
Hurricane Katrina (2005)
Despite years of hurricane preparedness exercises and incremental improvements, critical levee construction had not kept pace. The failure to recognize this gap led to devastating consequences when the hurricane struck.
Project Delays
A project reports positive progress with minor setbacks, then suddenly announces a major delay. Root cause analysis often reveals that key risks were not reported upward or were described in overly optimistic terms.
Cybersecurity Ransomware
Cyber risk is reported as 'under control' until a ransomware attack cripples operations. The organization had metrics showing compliance but missed that critical controls were inadequate.
A MOMENT TO REFLECT
Put it to work.
Think of a recent project or initiative where everything seemed 'green' until a crisis emerged. What specific indicators were you relying on, and what might have been hidden behind them?
How can you increase the 'granularity' of your risk reporting to surface slow-moving, critical gaps before they become emergencies?
In your team or organization, are risks reported from a 'glass half full' or 'glass half empty' perspective? What norms encourage honest disclosure of problems?
Often confused with
References
- Failure of Initiative: The Final Report of the Select Bipartisan Committee to Investigate the Preparation for and Response to Hurricane Katrina — U.S. House of Representatives (2006)
CONTINUE THE CONVERSATION
Source texts
- Beyond the Five Whys Root Cause Analysis and Systems Thinking (James C. Paterson)