Opinion by Vanessa Thurlwell of Mondial Risk and Business Consultants and Craig Kent, Head of Risk Management at Aon South Africa.
South Africa made it to 5 March 2020 before our first official confirmed case of COVID-19 was announced by Health Minister, Zweli Mkhize.
The case load is now rapidly increasing and stringent measures have been put in place by Government and the private sector to attempt to flatten the curve and prevent our health system from being overwhelmed. Every single organisation across the globe is experiencing some form of impact, ranging from full shutdowns, staff isolation, supply chain interruptions, cancellation of events and travel, changes to business hours, not to mention the massive impact on the healthcare industry.
We need to prepare our organisations for both the best and worst-case scenarios, ensuring that we account for all potential eventualities and ensure our organisations can manage, recover and prove resilient in the short-, medium- and long-term. The challenge remains that based on other pandemics and viruses, the rates of infection, mortality rates and the geographic spread of COVID-19 cases has not been along predictable lines.
The COVID-19 Coronavirus Risk Assessment
- Context and Stakeholders
According to best practice risk management, we first need to understand our organisational context and our stakeholders. We need to determine our relationship with countries with significant numbers of confirmed cases, like China, South Korea, Iran and Italy. We need to understand our organisation’s fit in the global context and how this might pose risks to international travel and international operations. We need to know how our suppliers and customers may also be affected, and how this may impact us and cause supply chain disruptions.
In terms of our employees, we need to ensure regular communication of accurate facts, what plans we have in place, and in all interactions, we need to ensure that we do our best to minimise hysteria. We may also notice that responses from stakeholders who do not analyse their risk properly may be illogical or counter intuitive, because of basing decisions on perception rather than fact. A comprehensive analysis of contexts and stakeholders is a critical foundation to identify the risks that our organisation may face, as many risks may be the product of or have implications for our context and stakeholders. We can also map the stakeholders according to their level of power or influence and level of interest. This will determine how we prioritise and manage them and communicate with them.
- Risk Assessment
We then need to consider the risks of the spread of the virus both globally and locally and what impact it might have on us as South Africans and on our organisations. Some risks may have more direct causes than others, and organisations will also vary in their exposures to the impacts of the risks. We are already seeing the immediate impacts, for example loss of revenue due to cancelled events, and supply chain issues from panic buying. But further down the line we need to look at the medium- and longer-term impacts on our organisations and the global economy. When looking to mitigate risks, organisations need to attempt to prevent risks first, and then have controls in place that will reduce impacts if the risk were to happen. In the South African context, the fact that we were later in the infection spectrum allowed us to learn from experiences of other countries and organisations, allowing us to attempt to reduce the impacts through being more on point with our controls. Organisations may however deem many issues to be out of their control and beyond their influence, in which case plans need to be in place for preparedness to respond to impacts once they occur.
On the flip side, while our response or treatment plans will heavily focus on mitigation, there are many opportunities, even if it is to test new technologies and solutions to problems, alleviate traffic congestion with rotation and work from home systems, and environmental monitoring reports are also showing a decrease in pollution in many cities.
The diagram below shows some of the typical areas of impact to consider.
How do these global events tip our appetite and tolerance perception?
Our traditional risk management practices implicitly treat risks as measurable, somewhat predictable and assume that we have some level of knowledge of the causes and drivers as they have happened before elsewhere. But the extreme risks, like a global pandemic, do not fit this description. They have very different characteristics, significantly more “unknowns”, there is very little applicable historical data and there are unclear relationships between causes / drivers and consequences, making it difficult to forecast the potential level of impact.
- Risk Appetite and Tolerance
We need to deal with these extreme risks differently, particularly in terms of Risk Appetite and Tolerance. We know we have zero appetite for the extreme risk, but we will have different levels of appetite and tolerance to the range of impacts that will stem from them. And there is no one-size-fits-all approach. By considering the impacts above, different organisations – public and private sector, international and local, import and manufacturing, large and small, labour-intensive and automated – will have different levels of appetite and tolerance for each impact type, and different perspectives on the risk versus the reward or opportunity. And more often than not, other extreme risks have occurred in the past that have led to similar impacts and losses, for example, natural disasters may also interrupt the supply chain, or when trade sanctions are imposed for political reasons.
Initially the decisions to cancel events, sports and large gatherings was up to the organisers, based on their appetite for the risk. For example, the cost of having to mitigate the infection risk was deemed unacceptable (outside of tolerance) by organisers. But now, as the situation has worsened and moved way beyond just the event organisers’ decisions, we have seen festivals, concerts, sporting events and other gatherings being cancelled by authorities, particularly after the declaration of the State of Disaster by Cyril Ramaphosa on 15 March 2020. In our own organisations, we may need to analyse the costs versus benefits of business travel and how essential it is, or if the risk of delay to delivery of imported products is greater than the cost of using a local supplier as an alternative, to keep the risk within tolerable levels.
We need to separate these extreme risks and crisis situations from everyday ‘normal’ risks. We need to deal with them differently, with much more agility and ensure efficiency in risk mitigation, as the timeframes are significantly shorter. This is due to the risks being more unpredictable, non-recurring in nature, emerging from unknown risk drivers and difficult to quantify.
A traditional governance structure that works well during normal operations becomes too slow and inefficient in a crisis situation. We need to have some level of crisis governance and our mechanisms for decision-making and cascading actions through the organisation in a simple manner but with effective control, communication and feedback. This governance should be designed, approved and set up well before an extreme risk event emerges as part of your Business Continuity Management / Crisis Management framework. Then once a crisis event is detected, we can assess the risk and impacts and, based on appetite and tolerance for the impacts, we will know if we need to be in crisis management mode or not.
What should we be doing right now to prepare ourselves for COVID-19 Coronavirus?
Depending on the organisation, and the context implications and risks identified, we need to keep stakeholders informed and mitigate risks to stakeholders, supply chains and your organisation’s reputation.
In Conclusion
As we follow the progress of the COVID-19 Coronavirus and see the impacts and responses of affected countries, what other global organisations are putting in place to mitigate impacts, and how the virus progresses, South African organisations need to assess their risk individually, decide on response strategies based on their appetite and tolerance for the potential impacts and learn from others.
Many organisations have put similar, immediate proactive controls in protection of their human capital in place, while business continuity response is following. What is critical in going forward is to understand your organisation and what the best possible processes and controls are that can be put in place, so we are prepared to mitigate both immediate and the long-term impacts.
We cannot prevent these crisis events from occurring, but we can successfully mitigate the lasting impacts through feasible protection of our organisations through resilient preparation.
News, Views and Thought Leadership
