The Hidden Cost of Playing It Safe
We rarely make opportunity cost explicit in the military. Because we never think about opportunity cost, risk aversion seems safe.
Opportunity cost - the lost potential gain from an alternative, when a different one is chosen.
Common sources:
- Failure to delegate authority
- Bureaucratic processes
- Delay
- Failure to innovate
Recently the Acquisition Transformation Strategy has instructed the military to deliver capabilities to operators earlier - to take on more acquisition risk, in order to buy down operational risk. It is not immediately clear how to judge acquisition risk vs operational risk. Opportunity cost is one way they may be compared. When senior leaders ask us to take acquisition risk to lower operational risk, opportunity cost is the missing yardstick.
Consider a decision - “delay a capability one day”. You must weigh the value you will derive from delaying for one day against the opportunity cost of that decision. The value you will derive from delaying for one day will vary based upon why you are delaying. The opportunity cost of delaying that capability is equal to the value that the entire force would derive from employing that capability for a day.
How can you figure out the “value that the entire force would derive from employing that capability for a day”? One crude but effective way to underestimate value is to consider the lifetime cost of the system, and divide it by the lifetime of the system (in days). So - if the lifetime cost of the system is $365M, and the lifetime is 10 years, or 3650 days, then the force would derive at least $0.1M per day of value from the system. A key assumption here is that the force will derive greater value from the system than its cost - but if that assumption fails then we should probably cancel the project anyway. This is, of course, a rough example and grossly underestimates the value of many systems. Many systems have greater wartime value, so the estimate is very conservative.
Going back to our earlier decision to delay for one day - is your delay worth $0.1M? Imagine a delay of 10 days, is it worth $10M?
Opportunity cost is not visible on a balance sheet, but is felt directly in a fight.
It deprives the warfighter and the nation of that quantity of value. Let’s consider one very common source of opportunity cost.
Opportunity Cost from Failure to Delegate
We’ve already seen how delay clearly leads to opportunity cost, but consider failure to delegate. Keeping decision-making at a higher level than necessary creates artificial bottlenecks around:
- Decision analysis and reporting
- Decision selection
- Decision announcement
- Decision implementation
That is not an exhaustive list, but when decisions must go up a chain of command each of those steps will cause personnel to take extra pains and formality, incur routing delay, and may result in incrementalism. Incrementalism in the worst case looks like “changing happy to glad” at one step, then “glad to happy” at the next: costing time but adding no value.
Delays mount quickly as a decision goes up the chain. Many other issues come from raising decision-making from the lowest-informed-level, as documented in books such as Turn the Ship Around. Delay is a major driver of opportunity cost.
These decision-making delays are so common, getting a decision within three days can feel amazing within the military. Decision staffing timelines are commonly “no less than a month”, though, and such delay is accepted. I’ve interacted with several processes where decisions are made only once a quarter, even for cases that are considered a foregone conclusion.
Consider the opportunity cost of such a delay. Our programs deliver significant value to the warfighter, that is why we pursue them. The opportunity cost of a day, week, or month delay, then, is massive. It quickly grows into the million-dollar range.
Balance that cost against the value of holding the decision at a high level. If a higher-level leader’s decision is certain to avert a multi-million dollar catastrophe, then the opportunity cost may easily be outweighed. Alternatively, if a higher-level leader’s decision only selects from two reasonable options, one of which is $10M and the other is $10.1M, then the value of the decision is much closer to $0.1M despite the total multi-million dollar price tag. The opportunity cost of a day likely outweighs the value of the decision.
Leaders are extremely valuable, but their value lies in building teams capable of making decisions autonomously, and in delegating appropriate decisions to those teams.
Leaders that keep decision-making instead of delegating drive massive invisible cost.
Let’s discuss a specific and common decision-related delay and the resulting opportunity cost.
Opportunity Cost from Hiring Delays
Acquisition offices need personnel for all kinds of work, for example financial management, engineering work, or security planning. It is not reasonable to hire personnel overnight, but on multiple occasions my unit experienced a delay of over one month working through hiring practices. Some candidates sat in limbo for over a month, with no status update, while others flew through. The reasons for these delays were simply that the office handling hiring was a bottleneck: too many offices were trying to hire, periodic reporting requirements were hitting them, the office faced other demands.
A 30 day delay in hiring one person on a program results in delayed value to the operational force. If that person is going to manage an effort, that entire effort will experience a significant delay, likely nearly 30 days of delay in operational value. As previously described, a 30 day delay quickly rises into the millions of dollars of opportunity cost.
For most personnel we hire, a delay of one day will not directly result in project delay for one day. It certainly will result in some delay. Often we anticipate hiring delays - we are so used to them that we bake them into a project’s timeline. Just because it is a planned delay does not make it any less of a delay though, and does not reduce the opportunity cost to the force.
The value of the hiring process is what we must balance against this opportunity cost. At best the value of the hiring process equals the cost of firing a bad hire later—roughly a year of salary. Commonly, this would be less than $0.1M.
Hiring processes necessarily take some amount of time. This opportunity cost consideration demonstrates, though, that delays of even one day quickly outweigh the value of the hiring process.
The risk of a bad hire is real, but the benefit of delaying hiring for another set of reviews is small compared to the opportunity cost of that time.
Let’s look at another example of opportunity cost stemming from keeping decision-making too high.
Opportunity Cost from Cybersecurity Delays
For systems with cyber components, the Authority to Operate (ATO) is a common source of delay, and is one source of delay that often directly results in delivery delay. That’s because regularly the cybersecurity processes occur at the end of a project, once components are known and understood, instead of throughout a project as modern practices like DevSecOps teach.
Fortunately, ATO delay is also regularly baked into project timelines. It becomes a stage on our Gantt charts. We brief the plan up the chain, with a little extra time baked in. If our Risk Management Framework (RMF) processes happen within the 3 or 6 months we budgeted, then we stay on time, schedule is green, and everyone is happy.
But that ATO delay is often on the critical path, and even if completed “on time” so the schedule is green, it resulted in 3 to 6 months of opportunity cost to the force.
The opportunity cost from these sequential processes is massive. Just as with other examples it quickly rises into the millions of dollars.
Again, the value of the RMF process must be weighed against the opportunity cost. We require ATO to reduce the possibility that cyber intrusions will cause damage to personnel and property. Many projects may have potential damages that match or exceed the millions-of-dollars of opportunity cost. However, architectural selections (zero trust), iterative and incremental (Agile) deployment processes, and modern infrastructure processes (DevSecOps) all significantly reduce that potential. The value of a traditional RMF process, in these instances, is much lower. The cyber risk is much lower so the benefit from the process is lower.
The balancing of value vs opportunity cost is not a simple consideration here. However, the personnel most capable of making the decision are the data owners, system engineers, and leadership at the lowest levels. Empowering them to make the decisions speeds delivery, and delivers value quickly, lowering opportunity cost, while still providing security.
Practically - compliance requirements are generally out of the control of Project Managers, but they can embed RMF in iterative development with DevSecOps. Leaders should loosen the reins enough for teams who understand their systems to accept tailored risk. The RMF allows us tailoring per-organization, but we under-use this feature.
Risk Aversion
Nobody ever got fired for following the bureaucratic process.
The standard bureaucratic processes feel safe to individuals, but safety is necessary primarily because of our architecture. These individuals are attempting to meet the objectives of their leadership, and their leadership has instituted the processes.
Many of these processes charge the military a massive, but invisible, opportunity cost. Fear of reducing these processes is a massive obstacle.
Leaders, then, need to realign their organizations and organizational incentives.
Balance the opportunity cost with every decision.
Instituting a process, or allowing one to persist, is a decision. Simply considering the opportunity costs you impose will lead to improved organizational outcomes and improved national security outcomes.
Leaders should:
- Identify their decisions, even if the decision is to not act or change.
- Quantify the opportunity cost for that decision - identify the benefit we’re missing by not taking another road.
- Balance that opportunity cost with the value of the chosen path.
- Delegate decisions to the level where information originates.
This is how we change our risk averse culture, and what it looks like to take smart risk during acquisition to reduce operational risk.