Coronavirus has taught us that continued business success in a volatile, uncertain, complex and ambiguous world requires us to think and act differently about risk.
We can no longer be defensive; we need to be ready and able to grab opportunities when they arise. We can no longer consider and manage risks in isolation to one another; we need to think strategically. And we need to recognise that you can’t plan for everything; the whole organisation needs to be prepared to deal with uncertainty.
Pandemics might be unpredictable, but they are recurring. Plus plans for the implementation of measures such as social distancing, self-isolation, border screening, school and workplace closures are all well documented. Yet COVID-19 seemed to take many organisations by surprise. Or did it?
According to a survey by the Institute of Risk Management, the majority of organisations had considered pandemic risk, or something with similar consequences to the organisation, before it happened. Indeed, 30 per cent had considered both the operational and financial impacts. So not really a surprise for most organisations.
However, the same survey also finds that while the risk function of the organisation had considered the risk, this consideration only turned into the implementation of the recommended risk management actions in less than one third of organisations. What is going wrong?
One problem is that the human perception of risk is far from rational and most people only associate the word “risk” with the potential for bad things to happen. This, when combined with a business environment that is being increasingly dominated by internal control practices driven by regulation and an aggressive media, has been shown to lead to defensive risk management behaviours.
A consequence of such behaviours is a disproportionate emphasis on value preservation through operational reliability, relative to value creation and realisation through business process innovation. Another is it undervalues the impact of large-scale events.
The result is large-scale events that may require a complete rethink of business process and strategy, such as pandemics, are often only included in the narrative of risk registers or risk planning. This means investment for them focuses on operational continuity as opposed to preparing the senior leadership to be able to adapt fast to realise opportunities.
It is backed up by a survey from the Business Continuity Institute, which found at least half of organisations felt they were not adequately prepared for the pandemic.
A second problem is balancing threats and opportunities in the heat of the moment requires being able to see the big picture. Yet most organisations continue to embrace a risk management and monitoring system where risks are mostly managed within the business unit or silo in which the risk resides. For example, credit risk within finance and treasury, customer loyalty and retention within sales, employee succession risk within human resources.
Therefore, when it comes to events such as pandemics that create different but interrelated risks spread right across the whole organisation and the environment in which it operates, business leaders find it hard to get a handle on what is happening and make the necessary trade-offs between value preservation and value creation activities.
However, after a shaky start, many organisations have not just survived they are positively thriving. Indeed, observing some organisational responses has put me in mind of a quote often attributed to Winston Churchill: “Success is not final; failure is not fatal: it is the courage to continue that counts.”
It turns out the quote is much more likely to have originated from a copywriter for Budweiser Beer, rallying people to be resilient in the face of the Great Depression that followed the Wall Street crash of 1929. But regardless of the origin, the sentiment is the same: sometimes the situation you find yourself in will be in flux, sometimes it will be better, sometimes it will be worse.
But knowing clearly what you want to achieve and possessing the courage to take risks, together with the skill, will and grit to manage those risks, is what will ensure you realise the reward from the risks you take, rather than suffer the losses.
