The COVID-19 crisis has exceeded resiliency mechanisms the world over, while it also shifted thinking, as seen in the widespread recognition that it caught everyone unprepared. Although some companies had “pandemic” on their risk register, they never really thought about it, defined it or exercised it in drills or war games.
Senior leaders now have a heightened understanding of pandemic risk. However, the problems it has wrought are overwhelming. Businesses are caught up in recovery, return to market and balance sheet protection — in other words, survival. Most are not for additional waves or the next pandemic. Companies need to be agile, but agility is not easily achieved, especially in organizations that have not examined why they were caught unaware or unprepared for the next catastrophic risk.
Forecasting the Next Wave
In the immediate- to mid-term, companies should be preparing for a possible next wave of infection. Companies may be forced to make difficult decisions, including slowing their reopening plans, or even shutting back down. Fears about the pandemic may also heighten absenteeism, creating workforce barriers to reopening.
Resiliency through times of uncertainty requires that, rather than waiting for conditions to worsen, companies should build operational and strategic agility into daily operations. Critical to agility is anticipation — the ability to forecast future operating conditions. Companies don’t need to be fortune tellers, but they do need to constantly envision various risk scenarios and build game plans to address those myriad situations.
At its core, strategic risk forecasting is no different from other forward-looking exercises, such as contemplating an M&A transaction. In that instance, a company would need to assess that transaction against different assumptions and possible outcomes: What if the M&A is successful? What if integration goes poorly? What are the risks and upsides in different situations? Such exercises are common in financial stress-testing yet rarely applied more broadly to risk management across the enterprise.
Consider a hypothetical scenario surrounding a next wave of COVID-19, using a financial stress-test approach. The list of questions will vary based on each company’s situation, but the broader strokes include:
- What will it mean for my company if the next wave starts in December versus starting in 2021?
- What if our country experiences the next wave before other geographies, receiving less warning and lead time than we did with the first wave?
- What if we have 90 days — instead of 180 — to understand the potential effects and scale operations?
- How do workforce impacts vary under different timeline scenarios?
- How will it affect my B2B relationships from a downstream perspective?
- What are the conditions that would necessitate slowing down our reopening or contemplating shutting back down?
Organizations need to widen their definition of what risks are. Rather than focus on the traditional “bubbles” on a risk register heat map — such as property and casualty risks — risk professionals need to consider what they have overlooked. This includes risk areas not previously imagined and the “grey space” between individual risk topics where risks may converge, be interdependent or become greater than the sum of their parts.
The biggest lesson learned from the last couple of months is the need to build risk forecasts that account for even previously unimaginable events. Yet many organizations continue to look at risk in a discrete and reactive way.
The “New Normal” Means More than Masks
Building agility, entrenching resiliency, and embarking on risk forecasting exercises require expenditures of time and capital, both human and financial. In many ways, agility — the ability to anticipate and preposition resources to proactively adjust to changing conditions — is the counter to efficiency. Considering that so much of the global economy, especially in the last 25 years, has focused on maximizing efficiency through just-in-time delivery, it is not surprising that so many organizations lacked the resiliency to absorb the shocks that COVID-19 created.
Just as we all recognize that our personal post-COVID-19 lives will be quite different, companies must evaluate whether they can afford to return to old risk management practices. Having so viscerally experienced exogenous shock in the last several months, business must now redefine what materiality means in terms of risk. They need to develop metrics that allow them to make the right measurements. For example, measuring risk aggregation and interdependencies across the value chain can help companies understand the degree of contingent business interruption risk they face. Resilience metrics can help determine how much stress an organization can withstand at individual points in the value chain. Early warning, crisis event metrics can help organizations navigate the initial days of a crisis. Agile use of data means that when data indicates a problem, such as a growing second wave, preplanned decisions can lead to swift action.
How well organizations respond to COVID-19 today, not simply by surviving but by thriving, will define how they survive the next great systemic shock.
