Companies are not in the business of predicting the next pandemic, but having robust crisis management processes in place is a pretty good place to start, says Steve Giles
This article was first published in the June 2020 UK edition of Accounting and Business magazine.
High-impact, low-probability risk presents challenges for all leaders. Proper preparation can mitigate the effects, but it is not easy to allocate sufficient resources to something that may never happen. Awareness, sound judgment and resolve are required to build resilience.
The coronavirus catastrophe is no exception. Consider the following example. I conducted a board evaluation recently for Company A, listed in London, an exercise that included reviewing board packs. The pack for the March 2020 board meeting was comprehensive and some 264 pages long. The meeting was held in the first week of March. The documentation was missing any mention of Covid-19.
The pack went out one week before the board meeting, in late February 2020, so coronavirus was not on the risk radar, although reports of deaths in Italy were already circulating – the virus had spread from China to Europe. The board agenda was out of date even as it was being put together.
Company A operates in financial services, so its failure to recognise the virus threat early is understandable. But governments have no excuse. The risk to citizens and economies of a pandemic, together with its likelihood, have been modelled for years – Covid-19 was a predictable disaster (even if some governments’ responses weren’t well planned).
A wide risk lens
Directors are responsible for managing risk. They require assurance over the principal risks – those that can impact business model, reputation, solvency or liquidity. This requires applying a wide risk lens to capture all relevant future events, including uncertain ones.
There are three key attributes that promote risk awareness:
- Horizon-scanning. Directors and managers should continually monitor the business environment to identify emerging issues and early warning signs.
- Developing a risk-aware culture. Directors should aim to create an organisational risk culture where everyone is encouraged to raise their insights or concerns, which can be accelerated to the board where appropriate.
- Avoiding complacency. Optimism bias undermines effective risk management. The initial responses of many Western governments to coronavirus look complacent compared with those of democracies in Asia Pacific. Put simply, Hong Kong, Taiwan and Singapore were ready for Covid-19, their planning shaped by the trauma of the Sars epidemic in 2003.
Company A’s actions are instructive. The chief risk officer, aware of Covid-19, produced a briefing paper that became the first substantive item of the March board meeting. His presentation led to a full discussion of threats to the business and possible mitigating actions. The original board agenda was largely discarded because directors appreciated the urgency of the situation.
Leaders must face up to the costs involved, but it’s not always easy, especially when the threats are not imminent. Drives for efficiency and value for money help to explain the poor preparations for the pandemic of various governments.
Business leaders face tough decisions too. Climate change is an example of a high-impact risk that directors often struggle to manage effectively. There is growing concern at ‘greenwashing’, while many companies fail to meet their reporting disclosure requirements. In contrast, the Spanish group Repsol became the first oil and gas company to set a target of net-zero emissions by 2050. Assets were reviewed, resulting in an impairment charge of €4.8bn.
Directors have two techniques available to mitigate high-impact risk:
- Insurance. The transfer of a proportion of risk to a third party is an important risk management tool. The board must ensure that its insurance strategy is aligned with the business strategy and the corporate risk appetite.
- Contingency plans. These are essential for effective crisis handling. There are two types: data recovery and/or disaster response plans (securing the continuity of IT systems), and crisis management plans (emphasising effective communications) – see the panel above for the key components.
A poll conducted by the Chartered Governance Institute (ICSA) in April found that 80% of respondents have confidence in how their board is handling the pandemic. ICSA says: ‘This is testament to the crisis management plans that most organisations already had in place.’
Unfortunately, Company A had no ready-prepared, board-approved crisis management plan. Instead, the work done on preparing for a no-deal Brexit has been dusted off. This provides a helpful framework, facilitating the assignment of responsibilities to a core executive team, effective home-working and weekly board updates via Zoom. There is no media management strategy, though, and the directors are becoming concerned about inconsistent messaging to stakeholders, as communication shortfalls can damage reputation and undermine resiliency.
From governments to companies, leaders are discovering there is no substitute for proper preparation when it comes to handling a crisis.
Steve Giles is a consultant and lecturer in governance, risk and compliance.
"Leaders must face up to the costs involved, but it’s not always easy, especially when the threats are not imminent"