In recent years, there has been a noticeable shift of mindset towards a more positive view of risk. ‘Disaster recovery’ has become ‘business continuity planning’. Boards and governing bodies have been encouraged to better understand and manage their risks rather than fearing them. The approach has been to adapt and mitigate, rather than eliminate or ignore.
Increasingly, we view risk as the ‘management of uncertainty’ rather than something negative. We now talk in terms of our ‘appetite for risk’, contrasting areas where we may be ‘risk hungry’ with those where we are risk-averse. We are getting much better at modelling scenarios. Plus, we are far better at measuring the non-financial consequences of risk, including the impact on intangibles such reputation and trust.
Now, suddenly, responding to coronavirus has stress-tested our business continuity plans, which have become live strategies that are being refined and adapted in the fast-changing threat environment. What is our response telling us about our appetite for risk, our agility and our business continuity plans?
Generally, there are four broad options to managing risk: avoid the risk completely; transfer the risk via insurance or other means; accept the risk and go ahead regardless; or seek to really understand the risk in terms of likelihood, impact and mitigation. This includes assessing ‘resilience’ and building in ability to recover in a way that not only anticipates problems but also puts in place robust contingency arrangements. These are the types of discussions and judgements that risk registers are intended to support.
Faced with coronavirus, our business continuity plans quickly move us to option four. Unfortunately, most existing plans are based on bringing people together in an alternative secure location, whereas this threat means we want to disperse our people to build resilience.
We are therefore having to be more imaginative and accept more risks. The scope for home working is being extended to what have traditionally been no-go areas. Banks for example, are experimenting with home-based currency and bond traders. Hospitals and GP surgeries are being encouraged to conduct consultations using Skype. Suddenly, need is driving innovation.
These changes also pose new questions – for instance, if home working becomes a key part of business continuity plans, should employers pay for broadband for their staff?
Above all, we need to adapt to human behaviours and the law of unintended consequences. In Italy, the anecdotal evidence is that the closure of schools and universities has meant that many people who work in the north rushed to move south during the shutdown to take their children to safer areas. Thus, a move intended to limit the spread started to drive the disease further.
This required the government to quickly implement movement restrictions, firstly on 16 million people in the north, and then the entire population.
Generally, we look at risks in isolation. The nature of this threat is forcing organisations to take a more holistic view. It’s forcing us to be more open to new ways of working that, once adopted, may mean we never revert to our previous restrictions. We may learn valuable lessons.
