How organisations can better manage contingency risks

In response to the Covid-19 lockdown, many businesses have had to quickly set focus on crisis management and continuity planning. Chamber strategic partner RSM’s associate director Adam Lickorish delves deeper into how organisations can effectively prepare for contingency type risks that may sit outside of traditional business continuity threat analysis.

Over the years, high impact and lower likelihood risks have often fallen off the radar because they are so unlikely to occur that they don’t get the airtime the primary risks do. We have all at some point heard the phrase “that will never happen to us” or “we’ve got that under control”. This leads organisations into making assumptions about how effective

the controls are at mitigating the risk, and less effort is made in truly understanding the risk itself and its current state. Should this happen, and the risk then moves towards fruition, the likelihood increases, and the result is that the risk sits squarely in the primary box. We are going to consider a number of challenges that boards face and what can be done to help the management of the contingency risks.

CHALLENGE 1: THE TIP OF THE ICEBERG, CAN YOU SEE WHAT IS UNDER THE WATER? Having a broad and frequent board risk reporting cycle is fundamental, as it provides a wider and rounder picture of the organisation’s risk profile and provides insight into those potential risks on the horizon or where the organisation might be required to react. Having these risks visible at board-level helps to inform decision-making

and the triangulation of information. Key risk indicators for contingency risks will also have a role to play as that can help identify the trajectory of the risk and again, provide deeper insight.

CHALLENGE 2: WHAT ARE YOU GOING TO DO IF IT DOES HAPPEN? Not many organisations out there thought that a pandemic of this scale was high on the list of events that might occur in 2020, yet with a crisis management plan and a business continuity plan, most organisations have managed to “muddle” through the past three to four months. Now, it isn’t suggested that a full business continuity plan is drawn up for

every high impact and low likelihood risk on the register, as this would make them too lengthy and unwieldly. However, being able to understand what action would need to happen and what the impacts would be is a strong starting point.

The pandemic has highlighted the need for contingency planning

CHALLENGE 3: WHEN DO YOU WANT TO KNOW ABOUT THIS RISK? Setting an organisational risk appetite can be a challenging process but once in place and understood, it will enhance the organisation’s approach to risk management, not just contingency risks. However, in the case of contingency risks, if appetite levels are set and risks are appropriately prioritised, it will assist in deciphering whether further action is required to mitigate the risk.

CHALLENGE 4: THESE CONTROLS WORK, BUT WHO SAYS? As organisations have become more complex, and the landscape riskier or more opportunistic - depending upon your outlook - there is a requirement to ensure that resources are focused effectively. Knowing where to deploy time and cash can be challenging in all organisations but sight must not be lost on the contingency risks. A robust assurance map is key as it will provide insight into the effectiveness of the controls managing those risks. There are a multitude of assurance sources available within

organisations, as well as external sources. Identifying and capturing these may seem a lengthy task, however the benefits will be seen and hopefully provide comfort to management teams and boards for contingency risks.

CHALLENGE 5: HAVE YOU GOT ONE EYE ON THE HORIZON, AND THE OTHER ON EXISTING RISK? We will all be familiar with risk reviews and risk identification workshops, however tying the two aspects together can get overlooked on occasion as they are often done in isolation. Over time, it is sometimes the case that risks are not new but are morphed versions of those previously identified. Recognising this can save valuable time, particularly from a contingency

Covid-19 will have wide-ranging knock-on effects for businesses

20 business network August/September 2020

risk perspective as the control environment will be similar, but being specific on the causes and articulating the risk is a crucial part of telling the story. Those who aren’t the risk owner are not as close or familiar with the risk so therefore need an understanding if required to make risk-based decisions.

Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36  |  Page 37  |  Page 38  |  Page 39  |  Page 40  |  Page 41  |  Page 42  |  Page 43  |  Page 44  |  Page 45  |  Page 46  |  Page 47  |  Page 48  |  Page 49  |  Page 50  |  Page 51  |  Page 52  |  Page 53  |  Page 54  |  Page 55  |  Page 56  |  Page 57  |  Page 58  |  Page 59  |  Page 60  |  Page 61  |  Page 62  |  Page 63  |  Page 64  |  Page 65  |  Page 66  |  Page 67  |  Page 68  |  Page 69  |  Page 70  |  Page 71  |  Page 72