Seeing What Isn't There
Enhancing risk management at your company
“What are the black swan events? What are we missing that we aren’t even considering?” These are the common questions asked during enterprise risk management (ERM) sessions. The usual response is “We’ve looked at everything.” But have you?
I expect pandemic risk did not rank high on your business’ risk register prior to this pandemic. That’s okay – it didn’t even show up on most risk registers. But why is that? How did we miss it? Let’s look at this from an ERM perspective.
ERM assesses the inherent likelihood and impact of particular risks. Even if your firm did have the pandemic as a possible risk, you probably ranked the likelihood very low. The impact? Well, we haven’t been through a pandemic like the novel coronavirus since before ERM was even a business practice. Very few would grasp the scope and pervasiveness this pandemic would have on the local and global economies. Previous recent pandemics like SARS, MERS, and H1N1 were relatively localized and/or quickly managed with vaccines. The companies and regions impacted by the pandemics of the past 20 years likely had pandemic risk ranked higher on their risk registers. They had seen the impact of a pandemic on the economy and their business.
In the wake of SARS, many industries required pandemic plans of their individual organizations. These pandemic plans were methodical and well thought out, and incorporated mitigation strategies for much of the devastation we are experiencing now. Still, the scope and magnitude of the effort to maintain business continuity during a pandemic for 18 to 36 months results in a high residual risk to the business. For most of these companies, however, their pandemic plans were shelved, reviewed annually at best, and generally never discussed at the risk table. As we’ve seen from this pandemic, regardless of how good your plans are, the impact to your business and the general economy is very high.
So what can we learn from this? ERM is intended to be a forum for businesses to review any and all risks and assess their likelihood and impact to the organizations. For a time, risk registers became large and unmanageable, leading to a desire to only focus on key risks the corporation is aware of or has experience with. The result is companies became stuck in a rut – only reassessing risks already on their risk register. They only look at what is already there.
Companies need to expand their view to look at potential risks beyond their operations and industry. Global concerns, issues occurring in other industries, and social trends must be considered for their impact on the company. Consider that science fiction movie you saw recently or research predictions from futurists. Outlandish risks that stretch the imagination will introduce a creative element to the ERM experience. The best risk analysis considers what is not already seen.
During your next ERM session, devote time to describing, discussing, and evaluating the issues that are seemingly unrelated to your company. Ask probing questions as you evaluate if and how they could impact your business. Get creative and have fun with it. Who knows? Seeing what isn’t there might identify a significant business exposure or, better yet, lead you to the next breakthrough for your business.
Karri Howlett Consulting provides customized trusted advisory services to support your organization as you prepare aligned, powerful, and purposeful business plans. With over 20 years of experience working with and leading organizations creating new businesses or business expansions, or embarking on ownership transition, Karri Howlett, CFA, C.Dir. provides governance, strategy, and financial expertise to support and enhance your business.