What a US$54 billion project taught me about continuity

For six years I was a risk manager on Chevron's Gorgon LNG project on Barrow Island off Western Australia. It is the most expensive project in the company's history, a US$54 billion build on a Class A nature reserve with 8,500 people living and working on an island that, by law, could not be changed. Everything that arrived had to be inspected for a single seed. Everything that left had to be accounted for. And the project could not stop, because a stopped day at that scale had a cost that made everyone in the room go quiet.

People assume the lessons from something that size do not transfer to a US$40 million contractor. In my experience the opposite is true. Scale makes the failure modes visible. It does not change them. I see the same six patterns on Barrow Island's scale and on a 200-person contractor's scale: a single point of failure, a legacy system running on borrowed time, growth that has outrun its controls, investment deferred until it compounds, a prior failure patched instead of fully rectified, and change made to a critical system or process without anyone assessing the new risk it created.

Rule one: name the single point of failure before it names itself

On Gorgon we knew, to the person and the part, what the project depended on. Which vessel, which crane, which permit, which individual with which competency. We knew because we had been forced to write it down, and because the cost of being surprised was too high to leave anything to memory. Most mid-market businesses have never written theirs down. They know it, the way you know where the creak on the stairs is. Knowing is not the same as having a plan for the week it goes. The first thing an audit does is turn what everyone knows into a register with a cost against each line, before that single point of failure becomes a missed milestone and a penalty clause.

Rule two: recovery is decided before the failure, not after the damage is already done

In 2011, before Gorgon, I was on board the Gryphon Alpha in the North Sea when a storm tore it from its moorings. I stayed after the non-essential crew were evacuated, and I was later part of the leadership team that brought the operation back. I have since presented that incident to the insurance market at Lloyd's of London. The thing that decided how fast we recovered was not what we did after the moorings failed. It was how well we had understood the operation before they did. The same is true of a resignation, a system crash or a client claim. Businesses that have mapped their processes recover in days. Businesses that have not are still discovering what they lost a quarter later, and if the underlying exposure is never fixed, not just patched, the same failure comes back for a second, more expensive visit.

Rule three: nothing goes to production on a promise, no matter how long the fix has been overdue

On Barrow Island every change to a critical system was validated before it was trusted, by people whose job was to be difficult. That is where dual sign-off in our Blueprint comes from. A fix that removes a single point of failure is only a fix if the people who used to carry the risk believe the new output, and the only way to earn that is to run the new thing side by side with the old one until the numbers match and both sides sign. It is slower than a demo. It is the reason the fix holds, and the reason deferred investment, once finally addressed, does not just become the next failure mode wearing new software.

Why this matters more at your size, not less

A megaproject can absorb a failure with money. A mid-market contractor absorbs it with people, and there are fewer of them. When the controls lead resigns from a business with 120 staff there is no bench. When the estimating system falls over in tender week there is no second team. And a business that has grown fast, revenue and headcount scaling past the controls built for a smaller company, often does not find out its systems have been outrun until the exact week it can least afford to. The tolerance for failure is lower at your size precisely because the resources to recover are thinner. That is the argument for treating continuity as a board risk rather than an IT ticket.

None of this needs a US$54 billion budget. It needs the discipline to name the dependency, decide the recovery in advance, and refuse to trust anything that has not been validated. That is what we brought back from the island, and it is what the Operational Certainty Blueprint is built on.