Regulations creating operational risk (and how it relates to POPI)

Ok, so that is an unfair title. But you’ll understand what I mean:

Zurich Financial Services has just been fined £2.3m for a data loss event incurred in 2008 in South Africa.

Zurich joins HSBC, Nationwide and Norwich Union in the club of companies fined by the FSA now.

In fairness, the fine wasn’t so much for losing the data, but rather for:

  • losing
  • unencrypted data
  • and not having monitoring and controls in place
  • so that it was only discovered and reported to regulators a year later

The South African perspective

The FSA’s seriousness about these issues is mirrored in our looming Protection of Personal Information Bill. This is not the same as the disturbing proposals for a Protection of Information Bill which covers public or government information. Continue reading

Fourth Floor Tails

I blogged recently about why I park on the fourth floor of the Cape Town airport parkade, and also about understanding and utilising unlikely but extreme events to your advantage. There is actually a link between these two posts.

Parking on the top floor does have a cost. It takes longer to drive up all the ramps and does, perhaps, on average take longer than parking on the most convenient floor every time. This extra time is a premium I pay to reduce the potential for really bad outcomes and thus optimising the parking problem. For example:

  • I avoid the situation of attempting to park on a lower floor (trusting the untrustworthy electronic vehicle counter) and, after driving around for a while trying to find parking, having to give up and try a different floor. This much longer time, even if it only happens rarely, is a much worse outcome than 30 seconds on every flight. It can easily be the difference between making and missing a flight.
  • I don’t have to worry about remembering where I parked my car. I don’t know that I am more forgetful than the average traveller, but travelling almost every week makes each trip blur into the next. I don’t waste headspace on trying to remember where I parked my car, and I don’t worry about forgetting. I have the peace of mind from having purchased a time of insurance against the risk of forgetting where I parked.

I get no value out of successfully memorising my car location, but gain from removing this risk and this worry from my routine.

If your company has a foreign currency exposure due to imported input components, this is a risk and a worry over which you have no control. Your energies are better expended elsewhere, on the operational and sales issues that you can effectively change. Get rid of these risks and get on with your real business.

How not to do SEO

Search Engine Optimisation (SEO) is an unfortunately necessary part of driving traffic to discover a website. Good content is necessary but not sufficient.

Why SEO is necessary

A large percentage of web traffic is directed by search engines. After all, this is how Google has become the giant company that it is. I tried to track down some hard statistics on this, but they varied widely and didn’t seem all that credible. Nevertheless I think it is clear that this traffic is signficant.

Search engines use algorithms and automated scripts (“spiders”) to understand the importance, quality, relevance and popularity of content on the web. A radiographer takes xrays without being able to see directly the same picture as the xray will produce. A photographer taking black-and-white photographs needs to ignore the colour in the viewfinder and imagine the light and shadows and shapes of the final photograph.

If your website has excellent content, but structures it in a way that is not readily accessible to a search engine’s spiders, then the spider will pass on by without sending humans to visit your site. Two easy examples may help:

  1. Flash content – the content may look great and be ground-breaking and useful, but since most spiders don’t currently “understand” Flash content, it will be ignored.
  2. Login, registration and forms – if large parts of a website are accessible only after filling information in a form or registering and logging in, the spiders won’t get in the door.

There are other considerations that are postulated to be relevant:

  • Duplicate content “dilutes” the scores of any individual page
  • Many links to irrelevant, poorly rated pages can suggest that your site is not providing useful info to the user. This effect is stronger since search engines try to separate “link farms” and rings and other methods to make a collection of websites appear more connected than they are in reality.
  • Poor choice of keywords that searchers may often use, or targeting terms that are widely targeted by a range of other websites.

A typical SEO strategy is quite complex and takes times, effort and money

A typical SEO strategy would cover analysing the target audience of a site, understanding the site content, understanding the site structure, doing keyword analysis, checking out competitors, generating a few good quality inbound links if applicable, possibly generating some linkbait content, installing appropriate tools (e.g. Google Analytics) to monitor traffic and then repeating the cycle once the customer behaviour is better understood. Key metrics are site traffic generated, low bounce rates, long time on the site, repeat customers, higher sales (or more contacts if online sales aren’t part of your service) and higher search rankings.

All of this takes time (both from the SEO but also from the website owner). There are many fly-by-night organisations claiming to do SEO with neither the knowledge or the business ethics to get it right. It is probably because it is a poorly understood, sometimes arcane speciality, that these companies get into business with low starting capital costs.

How not to do SEO in ten easy steps

I received an unsolicited email from Zenteq recently. I’m not providing a link to their website as I have no reason to believe they can deliver anything useful.

  1. Sending unsolicited email (aka SPAM). This is typically a bad idea. Best case scenario you get a few new customers. Worst case scenario you irritate a huge block of potential customers, have your mail server and/or IP blocked as a source of spam, have your ISP close down your website for abuse and so on.
  2. Use bright (as in reflective safety wear) green text and truly ugly formatting. Not a professional image by far.
  3. Offer to “SEO” the website by submitting to 600,000 search engines monthly. This is irrelevant and a giant waste of money.
  4. Charge R350 per month. In the short-term, this is far too little. The work involved at the outset of optimising a website for search engines requires several full days of work. However, in the long-run, this may well be too much. Since there appears to be no reason for the client to stay with Zenteq, we have a familiar problem where the business model doesn’t make sense for a serious operator and thus it’s likely that it isn’t a serious operator. (on trawling their webpage I see there is a R1000 upfront fee as well. Nice not to include this in the email. It still isn’t enough for serious upfront work)
  5. No description of other components of SEO strategy, or examples of prior successful work.
  6. “From” email is marketing@fire-equipment.org, “Reply to” is newheights70@telkomsa.net but the content directs the reader to info@zenteq.co.za. So which is it?
  7. Structure your email so that it gets stopped by the spam filter built into both Thunderbird and Apple’s Mail application.
  8. Include icons on their site claiming valid XHTML code, but then fail the test when the button is clicked.
  9. Analysis of google results shows no links to zenteq.co.za.
  10. And my favourite – a search on google for “seo site:za” which searches for the top websites relating to “seo” within the “za” domain doesn’t have zenteq listed in the top ten pages. A first-page listing is almost an requirement if you expect any number of click-throughs.

So who guards the guards, and who optimises the optimisers?

Country Foods, mushrooms and still not the Z

Would you lend money to Country Foods Limited? According to the Z score perhaps you should have participated in the listing in October 2007. Based on their prospectus and audited financial results for the year to September 2007, their Z-score was high within the grey zone, within reach of the coveted “safe zone”. As recently as June this year, Business Report was describing their winning recipe.

Now, with complaints of non-payment from suppliers, a resigned founder and CEO, vague comments about restructuring and now a request to be suspended from the AltX. Not an ideal scenario. The Z-score now? Well into the danger zone based on the interim numbers I have.

The cause of the decreased Z-score? Two primary items account for most of the change. First, from Business Report:

In its first-half profit statement it reported that profit fell 96 percent to R219 000 because of a late crop and power cuts.

The second is the share-price and thus implied market value, down from a listing price of 100c to 15c.

So, the Z-score certainly demonstrates consistency with the change in fortunes of the company. To this extent, it is a success. As for the use of the Z-score to manage a turnaround,  the two useful suggestions the formula spits out to the acting CEO?

  1. Increase earnings
  2. Increase market value

Because I know I wouldn’t have thought of that without the Z.

Don’t use Altman’s Z-score for managing a turnaround

I attended workshop presented by the famous credit analyst and model builder, Professor Edward Altman. He is probably most famous for the invention of the seemingly immortal Z score, which is still in use 40 years after its creation in 1968.

During the workshop, Professor Altman recounted a story about how a company managed themselves out of near-failure using his Z score. I’m not denying the facts of the story, and I’m not even saying that use of the Z-score at this company (GTI Corporation) didn’t help the turnaround. I am proposing that using Altman’s Z-score to manage turnaround would be ill-advised.

Download the full Viewpoint below.

Don\'t use the Z-score to manage a turnaround

Spreadsheet addiction

This article isn’t new, although it seems to have some pretty current info (about Excel 2007, for example).  Worth a read for anyone who uses spreadsheets for everything, but doesn’t want to touch a database, Mathematica / Maple / Maxima / Octave / Matlab or R / S / S+ etc.

http://www.burns-stat.com/pages/Tutor/spreadsheet_addiction.html

And yes, I use R, Maxima, Octave, MySQL, Access as well as Excel. Right tool for the job, son.

Fooled by the Black Swan

Is your organisation one black swan away from disaster? Are you taking hidden risks in the quest for success, and using hope as your only risk management tool?

Nassim Taleb’s books should be required reading for life

Nassim Taleb is one of my new favourite authors. I’m actually a little slow on the uptake here since I am currently reading his 2005 book “Fooled by Randomness: The Hidden Role of Chance in Life and in the Markets.â€? meanwhile the New York Times has his current book “The Black Swan: The Impact of the Highly Improbableâ€? on their best-seller list. I wholeheartedly recommend “Fooled by Randomnessâ€?, and fully expect that once I have read his current book I will be able to do the same for that.

Dumb luck is a large contributor to success in an uncertain world

Do you want the success of your organisation to be at the mercy of dumb luck?

Nassim Taleb’s writings resonate with me, because I agree with them. He just has an infinitely more entertaining (let alone more convincing) way of explaining his viewpoints. One of his major themes is how poor our understanding is of randomness. And he’s not talking about the “average joeâ€? in the street. If anything, he is more scathing of those so-called experts of the financial markets who are made or broken largely by luck. The unlucky fall be the wayside not be heard from, whereas the lucky shout their own praises from the rooftops.

I am not going to go further into his arguments in this post – the book is worthwhile reading if you are interested. However, I do want to touch a theme introduced in Fooled, and further expounded upon (I assume) in “The Black Swan�.

At some stage, the sun is going to stop rising

In the not so distant past, it was assumed that all swans must be white. Every swan ever seen had been white. All the classical statistical inference would have attributed a 100% probability to all swans being white. Until the rather unfortunate discovery of a little place called Australia. Enter the Black Swan.

Don’t trust past experience blindly, and trust your intuition even less

In risk management terms (and when I talk about risk management I include managing an organisation in the face of uncertainty, which includes every organisation I have ever known), events that may seem extremely unlikely based on past information and experience may still happen. If the occurrence of a black swan for your organisation would be catastrophic, are you really prepared to just hope that the past experience to date accurately reflects the future?

Actuaries and risk management

“Actuaries only look at the past so they are Fooled by Randomness.” This is a superficial description of actuarial work. Without a doubt, actuaries look to the past to infer certain parameters about the future. I’m not convinced this is necessarily bad as long as one realises that the past is not all there is to the future. The impact of HIV/AIDS and annuitant mortality improvements are typical of areas where actuaries have recognised that the past does not reflect the future and attempt to adjust for this in their calculations. Actuaries have the unfortunate job of trying to accurately estimate what this unknown future scenario will look like, rather than recognising that the risks exists and managing it.

When it comes to managing potentially catastrophic risks, Mr Taleb’s preferred practice is to limit all risks no matter how unlikely they may seem. The good news here is that if the consensus view is that the risks are extremely unlikely, the costs of mitigating those risks (transferring, hedging, reinsuring, selling etc.) should be relatively low. Mr Taleb prefers to find ways to use past patterns to make a profit, but use a sophisticated paranoia when managing the risks. He goes further and aims to benefit from the occasional black swan that flies his way. Again, more of this in his very worthwhile reading books.

Understanding all these potential risks, and understanding the potential for financial or operational impact on your organisation is not easy. Some of the results can be counter-intuitive, and simply drilling through the analytical steps to get to practical, useful steps requires a combination of common sense, uncommon insight into risk, and a tool-set capable of meeting the problems head-on.

In general, the human mind is a pretty poor tool for understanding a probabilistic world and making good decisions in the face of uncertainty.

What makes a good decision?

As an aside, another element of Mr Taleb’s thinking that I read with a fervently nodding head is that in an uncertain world, decisions should not be evaluated based on the outcome, but rather on whether it was the right decision given the information available at the time the decision was made. This is also not to say that the outcome never provides any information about the quality of the decision, just that it usually doesn’t. For example, take the decision to call “headsâ€? on the toss of a “fairâ€? coin. If the coin dutifully lands heads up, does that make the decision a good decision? I would argue very strongly that it does not. A more difficult example to agree with is that of a fund manager selecting a particular stock. If it the share appreciates in value over some period, is that sufficient evidence to show that the “buyâ€? call was a good one? Again, I would argue that it doesn’t. Especially when there is a large selection of fund managers making calls on all manner of stocks on a regular basis. Some of them have to be right some of the time. And a few of them will be right a great deal of the time just through luck.

Do you have a Black Swan?

Now if your organisation has a currency exposure, perhaps you are importing a component of your production process, or maybe your sales are partly to a foreign country, should you be bullish on the exchange rate? Should you be tring to time the market? Or should you be managing your risk by removing the areas of uncertainty over which you have no control, and where you are likely to be less informed than most professional currency traders, and where those self-same professional currency traders are playing in a massively uncertain world, where those with good “track recordsâ€? are more likely to be lucky than skillful? What happens if the Black Swan of a sharp exchange rate depreciation (or appreciation) is enough to wipe our your year’s operational earnings?

“We can’t afford risk management”

A common response to the argument for risk management is that hedging (or reinsurance, or put options or credit guarantees or business interruption insurance) is expensive. As I alluded to before, if the risk really is that unlikely, the cost should be relatively low. If the cost is high, it may reflect that others have a more prudent view of the possibilities of those risks than you do, which should start the alarm bells ringing immediately. The other side is that do you really believe than an appropriate way to build and manage your organisation is to continually take a small but very real risk of a catastrophic risk in order to make additional profit? If that is the primary source of profit for your organisation, then the fundamentals of that business may need to be revisited. Selling far out of the money naked call options as an income source may never get you into trouble and yield a modest revenue stream. Very few would agree that this is a good long-term strategy for success. A good number of the few that do have already been burnt in the process.

So what now for understanding and managing risk?

So there are four major points I would like to conclude with:

  1. If you operate an organisation, you operate in an uncertain world and are exposed to risks

  2. Just because you have never seen a Black Swan, doesn’t mean you will never see one.

  3. If there is a risk that could severely damage your business (a Black Swan), you had better have a better risk management strategy than closing your eyes and hoping

  4. Identifying these risks, measuring them and understanding their impact on your business, and then understanding the options available to you in managing those risks is an important and non-trivial exercise.

Do you speak word?

Like it or not, MS Word is the most ubiquitous document-creation application out there. There are many other great (many would argue better and certainly cheaper) products as well, but for the moment most of you know Word.

Although my point is that you probably don’t. If you use Word for creating documents of more than a few pages, with a standard format, look and feel, and haven’t heard of the following points, haul out the manuals and the books,help files and the  google  search  results

  • Show formatting marks
  • styles
  • templates
  • cross references
  • Protect Document
  • Custom menus and toolbars
  • Word Count
  • Track Changes
  • Index and Tables
  • Bookmarks
  • Fields
  • Mark formatting inconsistencies

I use all of these with almost every document. If you don’t, you should at least have made the informed decision not to, rather than being unaware of their potential.