This post first appeared on Risk Management Magazine. Read the original article.
Since March, when most countries started to go into lockdown
because of the COVID-19 pandemic, life for many organizations has been turned
upside down. Despite the current easing of restrictions in some areas, it looks
unfortunately likely that COVID-19 will pose a threat for the rest of 2020,
with some areas already forced to roll back reopenings and shut down again.
Continued bouts of business disruption seem inevitable, and the impact for some
companies could be highly damaging, if not catastrophic.
After months of weathering the pandemic, it is clear that
companies will have to alter their business practices going forward.
Organizations likely need to accept that the operational arrangements put in
place during the pandemic—or variations on them—will either need to continue or
be a fall-back position as additional waves of the pandemic may emerge. The way
that risks are identified, prioritized and managed is also set to change.
For example, the lockdowns have demonstrated the importance of
effective risk identification and mitigation, and made clear that resilience
planning will need to be a key boardroom priority moving forward—which has not
always been the case. In a survey telecommunications firm Telstra released in
June, only 14% of U.S. organizations reported having a full business continuity
plan that included major risk events such as pandemics. Similarly, EY’s Global Board Risk Survey,
conducted at the end of 2019 before COVID-19 erupted worldwide, found that
nearly 80% of board members felt unprepared for a major risk event. Such rates
of unpreparedness will no longer be acceptable moving forward.
“While participants responded to our survey
before the COVID-19 pandemic began, the numbers underscore the importance for
organizations to be prepared for these kinds of events,” said Steve Klemash, EY
partner and the EY Americas leader of the Center for Board Matters. “Now, more
than ever, it is imperative for boards and directors to adopt a new risk
mindset and take a future-first risk approach so that they are prepared for
even the most unpredictable issue.”
Planning
for Future Scenarios
The pandemic has forced many risk professionals to change their
priorities and approaches, especially given uncertainties about potential
future outbreaks of COVID-19. Organizations will need to adopt
scenario-planning techniques to build a picture of the longer-term situation
and the potential impacts, according to Rick Cudworth, crisis and resilience
partner in risk advisory at Deloitte. This will help organizations prepare for
subsequent waves of the pandemic and more easily modify plans when necessary.
Risk experts have suggested a wide range of
factors that need to be included in any scenario-planning model. In terms of
workforce risks, such issues could include continued employee absence; loss of
key staff and team leaders; forced redundancies and lay-offs; low employee
morale; and persistent skills shortages. More broadly, companies must look
country by country and region by region, considering the potential impact
lockdowns may have on their operations and customer bases. This includes which
facilities or parts of the business need to be closed down first or last. (As a
rule of thumb, risk experts advise that the last parts of the operation to
start up following the end of lockdown would be the first to close down again
in the event of a next wave.) Organizations must also consider whether the
level of risk should prompt downsizing and cutting costs, or expanding and
gaining market share in an increasingly unpredictable global economic
environment.
One of the chief ways companies are already
mitigating the effect of the crisis is by reviewing their supply chains, with a
large number saying they will develop alternate options for sourcing goods and
services, and some indicating that they will seek to change contractual terms.
Many say they will look more deeply into the financial health of their
suppliers and may consider strengthening risk protection measures in their
agreements.
Cudworth suggested planning for crisis
scenarios by focusing on the simple principles of safety, flexibility and
resilience. From there, risk professionals can estimate the changes in demand
for goods, products and services depending on how infection spikes may impact
each core principle. “Assumptions around likely demand changes for products or
services under each scenario are particularly important,” he said. “These
measures will enable organizations to consider and then plan the changes they
wish to make to operations under each scenario and the resource implications
for sites, people, supplies and finance.”
It is particularly important to keep abreast of
government updates so that organizations can consider which restrictions are
more likely to be reinstated and their likely effects, such as orders for
people not to use public transportation, regional lockdowns or forced
quarantines.
At the same time, companies with international
operations or global supply chains will need to recognize that different
regions are likely to be operating under different circumstances at any point
in time, which may mean that workers in one location may be ready to move, but
operations in another may be temporarily closed or cut off. For example, while
there was initially concern over the availability of supplies from China as it
went into lockdown, the tables soon turned and China’s recovery was stalled by
a shortfall in orders from Europe and the United States as both regions
simultaneously experienced some form of lockdown. “This is a trend we may see
on and off globally over the coming months,” Cudworth said.
Cudworth believes that there are three key
issues that risk managers need to bear in mind about trying to resume
operations after a lockdown. “First, there is uncertainty over which
restrictions may be lifted and when,” he said. “Second, it is possible that,
while some restrictions are lifted, others may later need to be re-enforced.
Third, organizations will have choices to make about the extent of return and
precautionary measures above those mandated by government.”
To prepare for further waves of the pandemic,
companies could use a simple traffic light system to highlight which regions in
a company’s global footprint are at highest risk of contagion, said Peter
Bannister, senior vice president of governance, risk and compliance at
MetricStream. Each color code would then have different protocols, offering
insight into both local risk and resulting business operations. For example,
“green” would equal low or no community virus transmission and business as
usual. “Yellow” would indicate employees work from home as needed. “Red” would
signify working from home is mandatory.
Legal risks around breach of contract may also increase for
suppliers and manufacturers in the coming months. “As the pandemic hit, many
businesses were not able to fulfill their contractual obligations and there was
a desire to release suppliers—at least temporarily—from their commitments to
ensure business continuity on a wider scale,” said Nick Lees, partner at law
firm Walker Morris.
“However, commercial partners are unlikely to be as forgiving in
the event of a second wave as COVID-19 is no longer an unprecedented event, so
risk managers need to effectively assess their individual circumstances to
avoid a tsunami of litigation should they be unable to comply with contracts a
second time around,” he said.
Recognizing
Potential Opportunities
Risk management certainly focuses on
mitigating the downsides of risk, but that is only one aspect of the job. The
function’s true value comes to light when risk professionals also identify the
upsides and how they can be leveraged to benefit the business.
Companies must be better prepared to exploit
available opportunities during periods of relative normalcy, when businesses
can operate more like they did in the pre-COVID world, said risk management
consultant Michael Waters. He believes that companies will need to make the
most of the “good times,” mainly because “we have no idea how long they might
last.”
Lockdowns will likely be reinstated at both
local and national levels in countries around the world, which may mean
shutting down facilities for weeks or months at a time with little notice. This
could cut supply chains, potentially repeatedly. “As such, companies need to be
able to ramp up sales, push production, and source high volumes of goods very
quickly during ‘normal’ operational periods to maximize profits and generate
enough cash flow to tide them over before they face being closed again,” Waters
said.
Organizations should focus on areas where
they can make “quick wins,” pivot their product and service offerings, and
examine whether they can easily exploit other business opportunities.
“Companies need to look at whether the products or services they are providing
can be modified easily and quickly to benefit other industries,” he said. “For
example, can the components a manufacturer produces for the airline industry be
used elsewhere, or tweaked easily so that they can be? Can the warehouse space
they own be rented out to essential-service providers if their own production
is mothballed? Businesses need to think on their feet. Making even small
adjustments may save them from going under.”
For example, some hotels that would otherwise
have remained dormant were able to secure some business by presenting
themselves as suitable accommodation for key workers like health care
professionals who had to stay near their worksites due to shift changes,
transportation problems or infection controls. Some manufacturers that were
forced to close their factories and other sites were able to lease their floor
space to supermarkets, which temporarily stored food and hygiene products while
trying to cope with increased public demand. The revenue streams in either case
are unlikely to have matched usual financial projections, but these companies
were at least able to bring in some income rather than shuttering entirely.
Some experts are more sanguine about overall
financial prospects for businesses during the lockdown. While there are “likely
no great outcomes” from the pandemic, there are still opportunities that can be
seized, according to Simon Geale, senior vice president for client solutions at
procurement consulting firm Proxima. Even on a basic level, “a good outcome
might be faring better than the competition, or being ready to move first,” he
said. “The risk manager’s role is going to be to keep on top of multiple
scenarios but not paralyze the business in ‘what ifs.’ Speed and agility will
be key.”
He suggested that the best approach for risk
managers is to learn, scenario-plan, prepare, maintain close relationships with
key partners, and manage the company’s liquidity while monitoring that of the
supply chain.
“First, you probably have to consider how a
second wave of the pandemic will affect you,” Geale said. “Will demand go up
(like toilet paper) or down (like hospitality), and what does that mean for
your business? Risk managers need to look back at what happened and then look
forward to consider what kind of business the organization is going to be over
the next one, three, six and 12 months, then calibrate accordingly.”
Second, companies must consider whether they
would be able to pivot their offering. “Would you be able to continue trading
if XYZ were true? You have to do this scenario-planning so that you know how to
prepare and react if it happens,” he said. “For some, the ability to quickly
flag, shut down and preserve cash will be critical. For others, the ability to
flag and quickly ramp up might be key.”
However, the trouble for risk managers and
their businesses is that adequate preparation is going to cost time and money
at a point when both are scarce, he said. Traditional ways of working could
also slow businesses down when they need to speed up.
“We might all have to accept the ‘perfect
imperfections’ that we have found over the last few months and work out what to
embrace as our new ways of working,” Geale said. “This means thinking about
what has actually worked better than normal, and how we can use technology and
more collegiate, agile behaviors to keep this newfound focus and agility going
in the future.”
A
New Way of Thinking
Some believe there is an opportunity for risk
professionals to not only change their focus, but reexamine how risk management
and risk decision-making take place throughout all levels of the organization.
According to Val Jonas, CEO at risk software and services consultancy Risk
Decisions Group, the pandemic taught many risk managers a valuable lesson: Do
not think about the likelihood of a risk occurring—think about how prepared the
organization is to deal with it and recover from it.
“The possibility of a pandemic occurring has
been included in the World Economic Forum’s (WEF) risk indexes for over a
decade,” she said. “However, because it was classified as ‘high impact but low
probability’ when it did make it into the report’s ‘top five’ global risks,
everyone ignored it and didn’t test their resilience. That thinking will need
to change now.”
One of the key lessons from the pandemic is
that organizations need to become more “risk-intelligent” by using the tools
and information they already have more strategically and quickly so they can
promptly react if and when subsequent waves of COVID-19 affect operations.
“Risk functions need to hold risk information centrally so that people who need
it can access it in real-time,” Jonas said.
She also believes that organizations need to
be much better at empowering employees to make their own risk decisions in a
crisis scenario, particularly at the middle-management level. “The CEO and the
board are going to be dealing with the big-picture risks and are not going to
address nitty-gritty work stuff,” she said. “Middle management needs to feel
empowered enough to make decisions themselves so that the business can react to
the changes quickly and so that employees feel their concerns are being heard
and addressed.”
To the extent possible, risk managers should
consider a more forward-looking perspective. “The only way to get through any
kind of crisis is to find a solution and drive towards it,” Jonas said. “No
business is going to go back to operating as it did before, so every
organization has to adapt and figure out a new way of working. Companies may
want to use the current situation as an opportunity to start thinking more
long-term, particularly with regard to how climate change may impact future
operations, supply chains and ways of working, for example.”
No organization is likely to emerge from the
current pandemic crisis unscathed, and the resilience of many businesses is
likely to be tested by the next wave of the pandemic or other global crises. By
analyzing what companies did right, what they did wrong, and what they might
need to do in the near future, risk professionals may be able to develop a plan
that not only helps protect the company from failure, but also helps prepare it
for future opportunities and ways of working.