In our last blog, we looked at the immediate priorities for risk managers, but these steps alone aren’t enough.

Major economic and social shocks, such as COVID-19, can change everything from your customers’ finances to the human resources you have available so it’s vital that you check your strategy is still fit for purpose.

You may not yet be certain if there’s going to be an increased demand for your goods or services or if your current way of working will be sustainable, but you can take steps now to emerge from the crisis stronger and fitter than before.

This blog will help you gather the information needed to make informed decisions, understand your expected performance range (encompassing your best and worse-case scenarios) and plan for a number of eventualities. The key to success lies in understanding what significant changes have happened, predicting those which are likely to happen and identifying what you need to do to survive.

Markets

Although COVID-19 is a global pandemic, it has affected countries to differing extents. Use credible websites, industry forums, trusted advisors (such as your Chamber of Commerce) and your local market experts to help you understand the impact in the countries and areas in which you operate.

Good questions to ask:

What is the expected change to GDP in each country?
What has happened to employment rates?
How have disposable incomes been affected? How are they likely to be affected in the future?
What will the impact be on any customers or suppliers in the region?

Competitors and your place in the market

Now’s the time to objectively re-assess the competition and your place in the market.

Good questions to ask:

Have any key competitors gone out of business or sound vulnerable (e.g. have your HR people been approached by their staff or have you had a number of speculative applications via your website from their employees)? How are they communicating with their customers about COVID-19? Are they warning customers on their websites about lengthy delays? Are products/services unavailable? Is their social media filled with complaints?
Are there any opportunities for mergers or acquisitions?
Do any of your key competitors seem stronger (e.g. launched new products or increased marketing)?
What competitive position do you need to take to grow and prosper?
Will you be able to scale up to meet demand? If not, what needs to be done to do so?

Risks

Do make sure you look far enough ahead, and broadly as well. It’s too easy to be over-focussed on COVID-19 to the detriment of other risks. For instance, cybercrime has grown rapidly during the pandemic (we issued a warning about this as early as March) and you need to make sure you are properly protected from phishing attempts and minimise the risks of purchasing counterfeit or sub-standard goods.

Good questions to ask:

Do we have a robust programme of cyber security training to mitigate risk?
Is remote working on the risk register?
How will Brexit affect us?
What happens if there is a second spike?
How will we handle business travel once free movement is allowed?
What happens if another country has a spike?
What happens if delays in payment cause cash flow issues?
What are the implications for staff mental health?
Are staff more likely to request flexible working?

Don’t forget to look at opportunities too. What has worked well for your business in recent months? How can you change and improve to maximise your growth? A recent survey by the Business Continuity Institute identified that less than 25% of respondents expected their business to return to the same way of operation as before COVID-19.

Reduction and Recession

The gloomy economic forecasts all state that we must prepare for a recession, so you need to look at how and where your organisation spends its money. Where are the costs within your business that can be quickly cut? Whilst it may be tempting to cut people from your organisation, the same economic forecasts suggest that the economy may bounce back quickly.

Good questions to ask:

Where can we reduce costs?
Do we have a good management accountant to help us record and crunch numbers, choose and manage company investments, drive risk management, budgeting, planning, strategizing, and decision making?
Can we reduce the cost of our salary bill by offering flexible working or part time hours?
Can we refine, automate and improve our processes to make them quicker and less costly (whilst maintaining quality)? Have we asked those at the coal face for their suggestions?
Have we applied for all relevant grants (local Enterprise Partnerships and Chambers of Commerce are a great source of information)?
Have we spoken to our Bank Manager or Accountant about using Bounce Back Loans and CBILS (Coronavirus Business Interruption Loan Scheme) to help ‘tide us over’?
Are we invoicing all the goods and services that are produced? Are we being paid on time?
Can we renegotiate some of our fixed costs such as rent or spread the payments over a long period?
Do we have a long lead time for recruitment? If so, do we risk being under-resourced if we reduce headcount, but the economy bounces back quickly?

Long-term horizons

The impending macro-economic collapse, and the huge social and economic challenges created by climate change, can’t be wished away. Now is exactly the right time to review whether you can de-carbonise your organisation more quickly than previously planned: most commentators believe that COVID-19 has acted as a ‘wake-up call’ to inspire people to think more socially than before. Firms which align with this ‘new normal’ automatically give themselves a market advantage.

Good questions to ask:

What steps can we take to improve our environmental credentials, e.g. ISO14001 (the Environmental Management Standard)?
How could we make this a competitive advantage?
What would the costs be?
Are there energy efficiency grants available (e.g. from local councils)?
How can we improve our business planning, e.g. working towards ISO22301 (the Business Continuity Standard) and use this to win more business?
What would the costs of improving our business continuity be? How do they compare to the advantages?
Are our clients beginning to look for ISO22301 in their supply chains?

Human resources

There is likely to be strong competition for resources. You should work with managers to anticipate the skills you’ll need to draw upon. Make sure that skills matrices are up-to-date, and any progression planning documentation is current. Keeping documentation about your resourcing decisions will help protect you from future scrutiny.

If you anticipate a resource shortage, you can take steps now to line up the external resources you need, e.g. by building a relationship with recruitment agencies, improving the careers page on your website, using social media to position you as an employer of choice or finding sub-contractors.

Good questions to ask:

When were our skills matrices last updated?
Do skills matrices show any areas of risk or shortfall? How can we plug skills gaps? Do we have up-to-date progression plans? Are our employees’ plans likely to have changed?
Do we have a single point of failure (i.e. where there’s only one person who knows how something works or who has a relationship with a key client or supplier)?
Do we have relationships with recruitment agencies? Are their terms favourable? Are we confident they can deliver?
Does our digital presence (website and social media) attract new recruits?
Can we use sub-contractors? Will they be available? What will the costs be? Do we have the relevant contracts prepared?

The supply chain

The Business Continuity Institute forecasts that there will be a lot of focus on supply chain as businesses endeavour to protect their operations. Not only do you need to protect yours, you also need to think about your role in your clients’ supply chains.

Good questions to ask:

If we work on a ‘just in time’ model, should we move away from this?
What goods, if any, do we need to stockpile? What are the implications of stockpiling?
How will we operate if a key supplier fails or is significantly disrupted?
Have clients shown an increased interest in the resilience of our supply chain?
What would happen to our client relationships and sales if our supply chain was impacted?

Scenario planning

Use a scenario planning approach. None of us really knows what the future holds, or indeed how and when the pandemic will come to an end, so planning for multiple alternative outcomes provides the best level of flexible response. For each scenario, collect information and identify the ‘trigger points’ that could signal a change in your broad direction of travel. Table-top exercises to talk through scenarios and agree actions are an inexpensive but powerful way of asserting control over risks.

Good questions to ask:

What possible outcomes should we plan for?
Have we collected the information we need to plan effectively?
Have we made any assumptions (these are where weaknesses in plans are likely to be)?
Who owns the plan?
Are we tracking actions to ensure risks are mitigated as effectively as possible?

Capital resources

Working out your resourcing plan will enable you to strengthen your position by talking to your bank or funding partners before others do.

Good questions to ask:

What capital resources do we need?
Who can we approach e.g. banks or funding partners?
Can we easily access any information needed to support any funding requests?

In conclusion

These are challenging yet exciting times for risk managers. Twenty years ago, many of us were in the ‘back-office’ doing worthy but unrecognised technical roles. Worse still, young people didn’t aspire to be risk managers.

The pandemic has changed that overnight. Boards now need risk advocates focused on difficult areas such as crisis planning and remote work data privacy — and they want a risk manager with the right ‘future skills’ to lead it. If ever there were a time to enter risk management, it’s now.

The IIRSM offers a one-day introduction to managing risk, delivered by Risk Evolves. Newly revised to deal with the latest thinking about risk and COVID-19, climate change and cyber security, details can be obtained from Holly Mulvihill at the Institute at holly.mulvihill@iirsm.org. Our readers can attend for the same price as IIRSM members.