This article first appeared in Forum, The Edge Malaysia Weekly on October 26, 2026 - November 1, 2026

The anatomy of an ordinary failure, with extraordinary consequence, is a lesson that Malaysian boards of directors should not ignore.

At 10.02am on Tuesday, Sept 8, a notification appeared at Britain’s air traffic control centre outside Southampton: The link between London Area Control and the core flight-data system had dropped. It restored itself in 45 seconds. Engineers logged it and found no hardware fault. Two and a half hours later, every departure in the UK was suspended.

The cause, set out in the operator’s preliminary report, was not bad data. At 10am, a controller requested a squawk code, the identifier tying a radar track to a flight plan. Nothing about the request or the flight plan was abnormal. Mid-update, a higher-priority message arrived and paused the allocation, as it is designed to. When processing resumed, a defect in legacy code meant it resumed wrongly, and the output was corrupted. The window in which that was possible was roughly one millisecond.

The corrupted record then contaminated subsequent updates. Each attempt to process it timed out, and the link between the two systems was severed and rebuilt to protect their integrity. Nobody identified corruption until 12.32pm. Departures stopped at 12.45pm and at 1.32pm, the link dropped for good and controllers reverted to manual handover. Aircraft sat on the tarmac for five hours, flights diverted as far as Germany and restrictions lifted only at 7.30pm. More than 2,000 flights were cancelled.

It would be easy to file this as a British infrastructure story. It is not. It is the clearest recent illustration of how modern organisations actually fail — and of the risk which the climate crisis is loading on Malaysian balance sheets.

Three features matter more than the technology.

First, the cause was trivial and the consequence systemic. Nobody erred. The request was valid, the flight plan ordinary, the interrupting message routine system behaviour. What failed was a flaw that had lain dormant in legacy code for years, exposed only by a one-millisecond coincidence of timing. Catastrophe did not require a catastrophic cause.

Second, the warning had already been received. A collapse in 2023, triggered by a rogue flight plan in a different subsystem, produced recommendations airlines were told had been fully implemented. As one airline executive put it: “We never saw the evidence.” The operator insists the two events are unrelated, yet this is the third significant failure in three years. The governance failure was not ignorance of the risk, but the acceptance of assurance in place of verification — a distinction every audit committee recognises after an incident, and few insist on before one.

Third, the residual risk had been accepted rather than engineered out. A system of this scale and age cannot be exhaustively verified, however much it is tested. Accepting that is legitimate. What makes it a governance question is where the consequences land. The operator absorbed a software fix, while airlines, airports and hundreds of thousands of passengers absorbed the loss. Every recovery timeline given to the airlines was missed, so credibility was spent faster than capacity was restored. The chief executive has refused to resign, and the transport secretary has called the outage “not unavoidable”.

Britain did not lose its skies to an extraordinary event, but because an ordinary one met a latent flaw in a system too large to verify exhaustively, after an earlier warning had been answered with assurance.

That is precisely the shape of physical climate risk.

As warming advances, heat, rainfall intensity, drought and storm surge grow more frequent and severe. As earth systems approach tipping thresholds, outcomes historical data assigns near-zero probability begin to arrive in clusters. The specific event cannot be forecast. No company knows which week the port will flood, which supplier will lose power, or which insurer will quietly decline to renew. It can only know that its systems will be tested outside their design assumptions, without notice.

For Malaysian directors, this is not an imported concern. The December 2021 Klang Valley floods caused an estimated RM6.1 billion in losses — roughly 0.4% of nominal GDP — displaced some 400,000 people and killed close to 50. Only about a third of those losses were insured. The remaining two-thirds landed on households, companies and the public purse — structurally the same decision the air traffic operator made: a defensible saving that transfers cost to those who never chose it.

Nor was 2021 an aberration. Official statistics record substantial national flood losses in each of the past three years, with Kelantan, Terengganu and Kedah repeatedly worst affected. A board that considers a major flood as a once-in-a-century event is relying on a distribution that no longer exists.

Water, meanwhile, is Malaysia’s equivalent single point of failure. In November last year, raw water pollution forced several Johor treatment plants offline and cut supply to some 1.2 million users for five days — in a state courting water-intensive manufacturing and data centre investment. A trivial cause halted an essential service for most of a week.

The exposure compounds where growth meets constraint.

Malaysia handles roughly 13% of global chip assembly, testing and packaging, concentrated in Penang — an island expanding against raw water constraints its own chief minister calls severe.

Concentration plus constraint is what turns a local weather event into a global supply chain interruption, and that fragility will be priced by overseas customers, their insurers and very likely our reinsurers, before it is priced in the boardroom.

Statements of resilience are now moving into filed and public disclosure, where any remediation that cannot be evidenced becomes a liability once tested.

What distinguishes the prepared is not prediction. We need to build organisations that do not depend on knowing exactly when the next event is happening. We use scenarios to widen the field of vision and conditions to set the design brief. What temperature, water availability and insurance environments our assets must function in, stress-testing to failure rather than tolerance and demanding evidence that remediation was completed.

Two questions belong on every agenda. Where could a single ordinary failure — one supplier, site, utility or water source — halt the enterprise? Are we budgeting for the climate we are entering, or the climate our historical data describes?

Resilience is not the capacity to foresee the next shock. It is the capacity to remain functional when foresight fails. Britain’s skies closed because of one millisecond of unlucky timing on an unremarkable Tuesday, and a warming world will supply boards with a steady stream of such Tuesdays.

Those already adapting will meet them as disruptions. Those who are not will meet them as crises — and crises, as the air traffic operator is discovering, test institutions rather than systems.

Sunita Rajakumar is founder of Climate Governance Malaysia (CGM), the national chapter of the World Economic Forum’s Climate Governance Initiative, now known as Chapter Zero Alliance. The alliance is an effort to support boards of directors in discharging their duty of care as long-term stewards of the companies they oversee, specifically to ensure that climate risks and opportunities are adequately addressed.

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's App Store and Android's Google Play.