Risk management lessons must be learnt from Covid-19 crisis

The Covid-19 pandemic has raised the profile of risk management and risk managers, but also shown that important lessons must be learnt if the profession wants to make the most of its chance to shine. Risk managers have told Commercial Risk Europe that the pandemic has, above all, shown the need for companies to boost resilience and embrace strategic, enterprise risk management (ERM). But, as Airmic’s CEO John Ludlow explained, there are many important lessons to learn from the Covid-19 crisis, which has put risk management in the spotlight. A big one is the need for more robust planning to ensure organisations and government are better prepared for such risks. “I think individual risks on the risk registers need to be profiled for more clarity. They need to be looked at in terms of their speed and their connectivity. Scenarios need to be run, crisis plans developed and preparedness actions taken in a timely fashion,” said Mr Ludlow. “One of the big failures of the government here in the UK during the pandemic was the state of preparedness. This needs to be monitored and pro-actively raised and lowered as dynamic risks come and go. So, there needs to be more robust planning on the prepared-ness side of the equation,” he added. Mr Ludlow also believes that governments and companies must work better together to help mitigate risks like a pandemic, with the former taking the lead. “Everyone has to get together: industry and businesses. One of the problems I think that we have is that industry tried to take a lead, but it’s government that needs to take a lead on these things,” he said. The crisis also highlighted that agile, collaborative and communicative risk managers will invariably do better than their peers, continued Airmic’s CEO. “It was clear during the crisis that you can’t be the archetypal risk manager driven only by your process. You have to be agile and you have to act and think with agility. Plans are great but, as the saying goes, “plans don’t last ten minutes of interaction with the enemy”. You’ve got to be able to reappraise and replan as you go along, as necessary,” said Mr Ludlow. The Institute of Risk Management’s (IRM) chair Iain Wright said the world was turned upside down as a long-predicted, but “perhaps not sufficiently” managed, global pandemic hit. He stressed that risk managers were positively involved in the crisis response but said the IRM expects “a sharper focus” on resilience and strategic risk management going forward. “These topics have been around for some time, but this period of crisis will focus attention on ensuring organisations have the people and skills to raise their game to what will be required in ‘the new normal’,” said Mr Wright. Airmic’s technical director and deputy CEO Julia Graham said the pandemic has put a spotlight on risk management and is a time for the profession to shine, because organisations have seen its value. She said risk managers with the knowledge and skills to move from back to front of house, and perform, will stay there. “It is the time to find new friends and allies. Heads of corporate communication, for example, are the gatekeepers of reputation and should be an ally. Company secretaries are gatekeepers to the board agenda. They are your route to a strategic audience – people that the business looks to for leadership,” said Ms Graham. But she stressed that there are crucial lessons risk professionals must learn from the crisis. Among these is understanding that crisis plans often weren’t broad enough, as well as the need for more focus on connected risks and high-impact, low-frequency threats. And the days of risk silos are surely over, added Ms Graham. “Most large and responsible organisations will have had a pandemic crisis plan but these typically envisaged a regional pandemic; few thought it would go global, or develop at such velocity. The lesson is that the world is now so much more connected – and we are in this context together,” she said. “Meanwhile, most organisations will have had pandemic on their risk registers but few will have modelled how connected their risks are and what happens to other risks when a connected risk is triggered. Risks like a pandemic and cyber are connected and need to be assessed in the own right, and for the change in profile they cause on other risks when they are triggered,” she added. Ms Graham also explained that high-impact, low-probability risks, such as a pandemic, often fall off risk registers when the severity is assessed. She urged risk managers to ensure they have effective horizon scanning and ensure boards consider these issues alongside risks on their risk registers. And she emphasised that the “need for integrated ERM is clearer now”. “Connected risks need whole business thinking – silos cannot be tolerated and functions need to work proactively together to build and maintain resilience,” she said. Richard Hoult, head of risk, audit and assurance at Thames Water, agreed that the Covid-19 pandemic has thrown the need to concentrate on catastrophic risks into sharp focus, and given risk managers the chance to get such issues high on the agenda. “From what I’ve seen and heard, the value of risk managers has generally improved. For many, pandemic was on the high-impact, low-likelihood risks list, so previously didn’t really get much traction or attention with the business. The focus on ‘what if..’ is now getting more attention and traction with the business, especially around the high-impact/low-likelihood catastrophic risks,” said Mr Hoult. “To be more prepared for risks of this type, use scenario planning more, even if it’s desktop planning, and use Covid-19 as a case study with examples of what went well and didn’t go well, so these are part of future learning,” he advised. Mark Dawson, Airmic board member and head of insurance at Dyson, said risk managers have found the pandemic challenging, with the profession on a quick learning curve. He advised risk managers to put people first because employees are the important asset, identify key risk exposures and prioritise risks to help mitigate the impact on business. “Above all, look to improve your business resilience, look at what worked and what could be improved,” said Mr Dawson. David Lanfranchi, risk manager at CSM Sport, said risk managers should keep things simple and engage with the right people early. Collaboration and communication can resolve most problems, continued Mr Lanfranchi. And he importantly reminded risk managers that just because they are dealing with one crisis does not mean other risks have gone away.

Risk management lessons must be learnt from Covid-19 crisis

Want to read this article?

Read Next

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

Want to read this article?

Read Next

ICEYE in data collaboration with Juniper Re on flood and wildfire

Senior appointments in Lockton’s crisis management team

European rates up overall but financial and cyber lines falling: Marsh

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

Related Articles