Risk Preparedness: Managing a Crisis

An interview with Cliff Trollope, MNP, Partner, Enterprise Risk Services

Nobody Saw This Coming

I don’t think anyone was really ready for this specific disruption and that’s OK. We found that those organizations who were prepared to some degree (plans, structures, training, etc.) did better and had fewer bumps. A traditional pandemic plan would focus on issues like people not coming into work because they were sick or were caring for a sick person – a loss-of-staff disruption. With COVID, we didn’t see it coming, and even if you did say there’s going to be a disruption, who knew that we would be locked down, borders would be closed and a significant loss of workplace business continuity would occur. What we have learned is the importance of having a really good process for managing a crisis at the executive level.

Managing a Crisis

When you’re dealing with the unknown, you need the process and structure to manage the crisis, which is the important part. Organizations who had a good crisis management program, and may have been soft on the business continuity side, were able to adjust, make up some business continuity plans and get through it. But if your executive level wasn’t ready to manage the wider crisis or external stakeholders, or make sound and timely decisions, it was more of a challenge.

Does Preparedness Matter?

Absolutely, preparedness matters. Those who weren’t as prepared as they would like to have been realized this pretty quickly. The last year has taught us the importance of knowing your stakeholders and knowing your level of risk throughout your organization. There were organizations who had risks in their supply chain, and there were others who had risks with people. During all of this, communication with external and internal stakeholders proved to be critical.

Risk Rising to the Top

The COVID-19 pandemic has raised the importance of being prepared for a significant incident and crisis. COVID has raised the importance of continuity of operation to the c-suite and board level. It has raised the profile of risk preparedness across the country. Now that people have gone through something like this, I think we will see a change in mindset about risk from Canada’s corporate leaders.

How to Create a Risk Framework

Don’t over-complicate the monitoring and tracking of risks, and be ready to capitalize on opportunities that situations present. If you are a company starting cold, do not overcomplicate it. Go through the standard process, which is to identify the risks that could impact your business the most and then go broad. People in finance and operations should identify the risks that are specific to their part of the organization and assess those risks by simply giving each risk a score out of five – based on likelihood and impact. In the end, identify the risks, assess the risks, analyze the risks, and then decide how you’re going to treat them.

Who Owns the Risk?

Someone in the organization has to own the risk program. It matters less where the risk responsibility sits as long as there’s one lead and that there are senior people there to support it. After you’ve identified and assessed your risk, you need to constantly moderate, monitor and update the controls in place to reduce the risks. You have to build that risk awareness that will inform strategic decisions, and once you have your risk assessment done and your framework in place, you can link it to your business strategy. Only then will companies start to see the value of having a risk framework because it is there to help you make informed business decisions.

Business Culture

What this has taught me about risk is the importance of understanding your risks in a broad nature. COVID hit some industries and some people very hard, while other businesses have had success like never before. In the end, what COVID has done is create different risks. I had a long discussion last week with someone who said their risk now isn’t revenue but people. COVID has created a human resource risk around health and wellness and retention, which talks to just how dynamic risk is. COVID has shone a magnifying glass on the culture of a business – it has become a culture amplifier. If an organization going into this was cohesive, communicated well, had strong leadership and engaged employees, then the COVID experience brought all that to the surface, and they did very well. The opposite is also true. If a company was fragmented, confused, and not slick as an operation going into COVID, then the light discovered all those cracks.

For more information on MNP and all of its business-related services, visit: mnp.ca