Planning for Uncertainty
Since March, when most countries started to go into lockdown because of the COVID-19 pandemic, life for many organizations has been turned upside down. Despite the current easing of restrictions in some areas, it looks unfortunately likely that COVID-19 will pose a threat for the rest of 2020, with some areas already forced to roll back re-openings and shut down again. Continued bouts of business disruption seem inevitable, and the impact for some companies could be highly damaging, if not catastrophic.
After months of weathering the pandemic, it is clear that companies will have to alter their business practices going forward. Organizations likely need to accept that the operational arrangements put in place during the pandemic—or variations on them—will either need to continue or be a fallback position as additional waves of the pandemic may emerge. The way that risks are identified, prioritized, and managed is also set to change.
For example, the lockdowns have demonstrated the importance of effective risk identification and mitigation, and made clear that resilience planning will need to be a key boardroom priority moving forward—which has not always been the case. In a survey telecommunications firm Telstra released in June, only 14% of U.S. organizations reported having a full business continuity plan that included major risk events such as pandemics. Similarly, EY’s Global Board Risk Survey, conducted at the end of 2019 before COVID-19 erupted worldwide, found that nearly 80% of board members felt unprepared for a major risk event. Such rates of unpreparedness will no longer be acceptable moving forward.
“While participants responded to our survey before the COVID-19 pandemic began, the numbers underscore the importance for organizations to be prepared for these kinds of events,” said Steve Klemash, EY Partner and the EY Americas Leader of the Center for Board Matters. “Now, more than ever, it is imperative for boards and directors to adopt a new risk mindset and take a future-first risk approach so that they are prepared for even the most unpredictable issue.”
PLANNING FOR FUTURE SCENARIOS
The pandemic has forced many risk professionals to change their priorities and approaches, especially given uncertainties about potential future outbreaks of COVID-19. Organizations will need to adopt scenario-planning techniques to build a picture of the longer-term situation and the potential impacts, according to Rick Cudworth, Crisis and Resilience Partner in Risk Advisory at Deloitte. This will help organizations prepare for subsequent waves of the pandemic and more easily modify plans when necessary.
Risk experts have suggested a wide range of factors that need to be included in any scenario-planning model. In terms of workforce risks, such issues could include continued employee absence; loss of key staff and team leaders; forced redundancies and lay-offs; low employee morale; and persistent skills shortages. More broadly, companies must look country by country and region by region, considering the potential impact lockdowns may have on their operations and customer bases. This includes which facilities or parts of the business need to be closed down first or last. (As a rule of thumb, risk experts advise that the last parts of the operation to start up following the end of lockdown would be the first to close down again in the event of a next wave.) Organizations must also consider whether the level of risk should prompt downsizing and cutting costs or expanding and gaining market share in an increasingly unpredictable global economic environment.
One of the chief ways companies are already mitigating the effect of the crisis is by reviewing their supply chains, with a large number saying they will develop alternate options for sourcing goods and services, and some indicating that they will seek to change contractual terms. Many say they will look more deeply into the financial health of their suppliers and may consider strengthening risk protection measures in their agreements.
Cudworth suggested planning for crisis scenarios by focusing on the simple principles of safety, flexibility, and resilience. From there, risk professionals can estimate the changes in demand for goods, products, and services depending on how infection spikes may impact each core principle. “Assumptions around likely demand changes for products or services under each scenario are particularly important,” he said. “These measures will enable organizations to consider and then plan the changes they wish to make to operations under each scenario and the resource implications for sites, people, supplies, and finance.”
It is particularly important to keep abreast of government updates so that organizations can consider which restrictions are more likely to be reinstated and their likely effects, such as orders for people not to use public transportation, regional lockdowns, or forced quarantines.
At the same time, companies with international operations or global supply chains will need to recognize that different regions are likely to be operating under different circumstances at any point in time, which may mean that workers in one location may be ready to move, but operations in another may be temporarily closed or cut off. For example, while there was initially concern over the availability of supplies from China as it went into lockdown, the tables soon turned and China’s recovery was stalled by a shortfall in orders from Europe and the United States as both regions simultaneously experienced some form of lockdown. “This is a trend we may see on and off globally over the coming months,” Cudworth said.
Cudworth believes that there are three key issues that risk managers need to bear in mind about trying to resume operations after a lockdown. “First, there is uncertainty over which restrictions may be lifted and when,” he said. “Second, it is possible that, while some restrictions are lifted, others may later need to be re-enforced. Third, organizations will have choices to make about the extent of return and precautionary measures above those mandated by government.”
To prepare for further waves of the pandemic, companies could use a simple traffic light system to highlight which regions in a company’s global footprint are at highest risk of contagion, said Peter Bannister, Senior Vice President of Governance, Risk and Compliance at MetricStream. Each color code would then have different protocols, offering insight into both local risk and resulting business operations. For example, “green” would equal low or no community virus transmission and business as usual. “Yellow” would indicate employees work from home as needed. “Red” would signify working from home is mandatory.
Legal risks around breach of contract may also increase for suppliers and manufacturers in the coming months. “As the pandemic hit, many businesses were not able to fulfill their contractual obligations and there was a desire to release suppliers—at least temporarily—from their commitments to ensure business continuity on a wider scale,” said Nick Lees, Partner at law firm Walker Morris.
“However, commercial partners are unlikely to be as forgiving in the event of a second wave as COVID-19 is no longer an unprecedented event, so risk managers need to effectively assess their individual circumstances to avoid a tsunami of litigation should they be unable to comply with contracts a second time around,” he said.
RECOGNIZING POTENTIAL OPPORTUNITIES
Risk management certainly focuses on mitigating the downsides of risk, but that is only one aspect of the job. The function’s true value comes to light when risk professionals also identify the upsides and how they can be leveraged to benefit the business.
“Companies must be better prepared to exploit available opportunities during periods of relative normalcy, when businesses can operate more like they did in the pre-COVID world,” said Risk Management Consultant Michael Waters. He believes that companies will need to make the most of the “good times,” mainly because “we have no idea how long they might last.”
Lockdowns will likely be reinstated at both local and national levels in countries around the world, which may mean shutting down facilities for weeks or months at a time with little notice. This could cut supply chains, potentially repeatedly. “As such, companies need to be able to ramp up sales, push production, and source high volumes of goods very quickly during ‘normal’ operational periods to maximize profits and generate enough cash flow to tide them over before they face being closed again,” Waters said.
Organizations should focus on areas where they can make “quick wins,” pivot their product and service offerings, and examine whether they can easily exploit other business opportunities. “Companies need to look at whether the products or services they are providing can be modified easily and quickly to benefit other industries,” he said. “For example, can the components a manufacturer produces for the airline industry be used elsewhere, or tweaked easily so that they can be? Can the warehouse space they own be rented out to essential-service providers if their own production is mothballed? Businesses need to think on their feet. Making even small adjustments may save them from going under.”
For example, some hotels that would otherwise have remained dormant were able to secure some business by presenting themselves as suitable accommodation for key workers like health care professionals who had to stay near their worksites due to shift changes, transportation problems, or infection controls. Some manufacturers that were forced to close their factories and other sites were able to lease their floor space to supermarkets, which temporarily stored food and hygiene products while trying to cope with increased public demand. The revenue streams in either case are unlikely to have matched usual financial projections, but these companies were at least able to bring in some income rather than shuttering entirely.
Some experts are more sanguine about overall financial prospects for businesses during the lockdown. While there are “likely no great outcomes” from the pandemic, there are still opportunities that can be seized, according to Simon Geale, Senior Vice President for Client Solutions at procurement consulting firm, Proxima. Even on a basic level, “a good outcome might be faring better than the competition, or being ready to move first,” he said. “The risk manager’s role is going to be to keep on top of multiple scenarios but not paralyze the business in ‘what ifs.’ Speed and agility will be key.”
He suggested that the best approach for risk managers is to learn, scenario-plan, prepare, maintain close relationships with key partners, and manage the company’s liquidity while monitoring that of the supply chain.
“First, you probably have to consider how a second wave of the pandemic will affect you,” Geale said. “Will demand go up (like toilet paper) or down (like hospitality), and what does that mean for your business? Risk managers need to look back at what happened and then look forward to consider what kind of business the organization is going to be over the next one, three, six, and 12 months, then calibrate accordingly.”
Second, companies must consider whether they would be able to pivot their offering. “Would you be able to continue trading if XYZ were true? You have to do this scenario-planning so that you know how to prepare and react if it happens,” he said. “For some, the ability to quickly flag, shut down, and preserve cash will be critical. For others, the ability to flag and quickly ramp up might be key.”
However, the trouble for risk managers and their businesses is that adequate preparation is going to cost time and money at a point when both are scarce, he said. Traditional ways of working could also slow businesses down when they need to speed up.
“We might all have to accept the ‘perfect imperfections’ that we have found over the last few months and work out what to embrace as our new ways of working,” Geale said. “This means thinking about what has actually worked better than normal, and how we can use technology and more collegiate, agile behaviors to keep this newfound focus and agility going in the future.”
A NEW WAY OF THINKING
Some believe there is an opportunity for risk professionals to not only change their focus, but reexamine how risk management and risk decision-making take place throughout all levels of the organization. According to Val Jonas, CEO at risk software and services consultancy, Risk Decisions Group, the pandemic taught many risk managers a valuable lesson: Do not think about the likelihood of a risk occurring—think about how prepared the organization is to deal with it and recover from it.
“The possibility of a pandemic occurring has been included in the World Economic Forum’s (WEF) risk indexes for over a decade,” she said. “However, because it was classified as ‘high impact but low probability’ when it did make it into the report’s ‘top five’ global risks, everyone ignored it and didn’t test their resilience. That thinking will need to change now.”
One of the key lessons from the pandemic is that organizations need to become more “risk-intelligent” by using the tools and information they already have more strategically and quickly so they can promptly react if, and when, subsequent waves of COVID-19 affect operations. “Risk functions need to hold risk information centrally so that people who need it can access it in real-time,” Jonas said.
She also believes that organizations need to be much better at empowering employees to make their own risk decisions in a crisis scenario, particularly at the middle-management level. “The CEO and the board are going to be dealing with the big-picture risks and are not going to address nitty-gritty work stuff,” she said. “Middle management needs to feel empowered enough to make decisions themselves so that the business can react to the changes quickly and so that employees feel their concerns are being heard and addressed.”
To the extent possible, risk managers should consider a more forward-looking perspective. “The only way to get through any kind of crisis is to find a solution and drive towards it,” Jonas said. “No business is going to go back to operating as it did before, so every organization has to adapt and figure out a new way of working. Companies may want to use the current situation as an opportunity to start thinking more long-term, particularly with regard to how climate change may impact future operations, supply chains, and ways of working, for example.”
No organization is likely to emerge from the current pandemic crisis unscathed, and the resilience of many businesses is likely to be tested by the next wave of the pandemic or other global crises. By analyzing what companies did right, what they did wrong, and what they might need to do in the near future, risk professionals may be able to develop a plan that not only helps protect the company from failure, but also helps prepare it for future opportunities and ways of working.
Written by: Neil Hodge, Freelance Journalist, for Risk Management.