Newsletters
Risk Central
Digital EditionSouthwest, It’s Not That Complicated: Takeaways from a Business Resiliency Fiasco
Skip Smith, BS, MS, ARM is the president of Innovative Risk Solutions, LLC, a consulting company specializing in developing cutting-edge Risk Management programs around safety, Environmental Sustainability, Crisis Management, Business Continuity, and Disaster Recovery. Before starting his business, he served as the Vice President of Safety, Business Continuity & Disaster Recovery at Scripps Networks/Discovery Channel, where he led the global functions for Operational Risk. Skip has worked for a number of fortune 500 companies in various leadership risk management roles, such as Coca-Cola, USA, Novelis, Popeyes, Service Master, and Hooters Sports Distribution.
A lot has been written and said about the recent Southwest Airlines fiasco, and I am sure it will continue, but the real message is the internal lessons that must be learned by Southwest and other organizations that lead with customers.
I believe in full disclosure and must confess that my wife and I had our flight canceled that week as we were going to attend my brother’s wedding. Therefore, I will try not to come across as a “Monday morning quarterback.”
Let’s start with Bob Jordan, the 34-year Southwest veteran who became CEO in February 2022. At the time, he indicated Southwest had some real work to do in making things right, saying, “For now, I want you to know that we are committed to that.”
However, what stood out to me was that he neglected to mention a business resiliency program, which would focus on the core mission of disaster recovery and business continuity. We all understand that the road is paved with good intentions, but intentions are not a plan. I am pretty sure several issues contributed to the meltdown, and the idea of not knowing when systems can fail did not help.
As I write this article today, I am still not sure if contingency planning on the part of Southwest would have addressed the red flag issues below, but it’s useful information to show how something like this could have occurred:
- Decades of focusing only on the balance sheet and not on operational technology upgrades
- Lack of current scheduling software upgrades and improvement lapse
- Failure to update systems or test disaster recovery and business resumption plans
- Lack of a viable disaster recovery and business continuity plan that could have lessened the impact
As you might guess, this is not a great position to be in with your customers. Leadership plays an essential role in ensuring this never happens again.
To that end, I was inquisitive and wanted to look at Southwest’s website and see who sits on the senior executive leadership team. I know it includes a chief legal and regulatory officer — that’s a start!
I did not, however, see a leader specifically tasked with the responsibility of identifying business vulnerabilities, ensuring operational resiliency and enhancing existing technologies to ensure someone had a chair at the table to speak to these issues.
When in leadership, one should genuinely understand the key risks in their business — especially the airline business.
Due to the nature of the airline business, you would expect to have many incident response plans that address the organizational risks perceived to be highly significant and highly likely, such that their inherent risk demands a specific response plan.
I have difficulty understanding why Southwest did not have a methodology that incorporates both a qualitative and quantitative risk assessment to provide the direction necessary to include the right plans and offset identified potential risks.
The questions Southwest should have answered before the events of late 2022 include “Are we doing enough to minimize risk?” “How much would downtime cost us as a result of key business failures?” and “Are we spending on the right things?” Answering questions like these is critical to developing the right risk strategy.
While an organization can’t and shouldn’t have a response plan for every type of outage, it can and should have plans to address or mitigate its catastrophic risks. And, in this case, those plans could have addressed:
- Downtime production outages
- Data loss impacting the system and its end users
- Financial loss
- Reputational and regulatory loss
Indeed, this could have been one of those Apollo 13 moments for Southwest. In other words, this would have been its “finest hour” if just some of its past business issues had been addressed in 2019.
Instead, it is left in a sea of organizational crisis management problems, with significant financial obstacles that will continue to grow. Just a few of its current issues:
- Southwest faces an estimated $825 million or more in the costs of nearly 17,000 flight cancellations from December 2022
- Lost revenue could account for over half of those costs, with the remainder comprising employee compensation, customer reimbursements and related charges
- The cancellations took place during a nationwide storm that led to a meltdown of its scheduling system, which needs to be fixed now
- Southwest also faces a lawsuit over allegations that it did not refund stranded passengers
A note to management leaders: Surround your leadership team with technology experts and other team members who have a wide range of diverse thoughts and insights into organizational resiliency.
If anything, we learned from Southwest that this incident could have been avoided. I can only imagine the number of hours spent in confusion, knowing that if it had been proactive from the onset of the need for system upgrades, the potential for disruption would have been a lot less.
As indicated, it’s not complicated when you understand and know when business processes can fail and act with a plan before a situation becomes a crisis.
The good news is that today we have AI technology systems that can provide us with real-time information about system disruptions, and the cost of implementing them is much less than the cost of losing customers. &
