What has the COVID-19 pandemic taught us about business resilience during a crisis? Dermot Grenham and Isaac Alfon explain
Aesop’s fable of the oak tree and the reeds provides a salutary lesson on the importance of flexibility and humility in the face of powerful, unexpected forces. Since the start of the COVID-19 pandemic and its associated lockdowns, individuals and organisations have had to demonstrate high degrees of resilience to adapt and survive. A cursory glance at local high streets shows that many companies were not able to cope.
Resilience comes from the Latin resilio, ‘to spring back’, which suggests the reeds’ response to the strong winds: they bend low but return to their normal upright positions once the wind has died down. The haughty oak, meanwhile, gets broken in two. Crescendo Advisors’ survey of the UK insurance industry’s response to COVID-19 provided some hints on how to be more like the reeds.
The elements of success
Risk management and Own Risk and Solvency (ORSA) frameworks are becoming increasingly sophisticated, but it is important to remember the basics. One of the fundamental aspects of risk management is learning from past events and creating a virtuous cycle of risk and control enhancement. We must learn lessons from the current crisis while realising that the next such crisis will be different. No two black swans look alike. Individuals and organisations need to build up their resilience so that they can respond positively when danger, in whatever form, threatens. This is particularly relevant in the context of insurers’ implementation of regulatory requirements for operational resilience (see Isaac Alfon’s article ‘Operational resilience: how much to learn from COVID-19’ – bit.ly/Crescendo_OpResil).When assessing personal or organisational resilience, a few key characteristics turn out to be key indicators of success.
The first, picking up from the example of the reeds, is the extent to which senior colleagues are prepared to carry out more low-level tasks in order to keep the show on the road. This requires an understanding of business continuity arrangements, ideally honed by some practice ‘war games’, and the ability to reprioritise business aims fast, accepting some changes in one’s day-to-day obligations. In practice, this means people should be able to backfill for colleagues and departmental barriers should be broken down. Documentation of processes and spreadsheets, while not everyone’s favourite job, is crucial if you are to maintain services during a storm.
A second indication is communication and empathetic skills. During Crescendo Advisors’ survey, one CEO was described as focused on ‘communication, communication and communication’. This is especially important if the means of communication suddenly need to change. Managers and leaders must keep in close contact with colleagues, understanding their situation and helping them cope with the challenges they are facing to remain productive. New ways, times and places of working need to be tested out.
A third is being able to remain resilient over an extended period. An elastic band will return to its normal length if stretched and released quickly but, if stretched and held taut for too long, it loses elasticity. Reacting to a crisis over a short period of time is hard enough, but a crisis that continues for months, if not years, requires a different and deeper type of resilience and maturity. Over an extended period, you also have to attend to the other aspects of your life, including your family, social relationships, and mental and physical health.
“The Oak stood proudly and fought against the storm, while the yielding Reeds bowed low. The wind redoubled in fury, and all at once the great tree fell, torn up by the roots, and lay among the pitying Reeds”
Reflecting on a crisis
It was not a total surprise when COVID-19 hit the UK and lockdowns were imposed, and some preparations had been made. We may not be so lucky next time. Figure 1 shows the self-assessed state of readiness of the survey’s participant companies at the time of the first UK lockdown. None considered themselves to be totally prepared. All had some level of readiness, and the level of readiness differed between different areas of the business. Among survey respondents, differences in the successful management of the lockdowns depended on how well developed their crisis management plans were, the extent to which staff had already been able to work from home, and how well they used the warning time before the first lockdown.
Figure 2 shows the self-assessed quality of the company’s response to the crisis. Generally, companies considered themselves to have done better than expected given their level of readiness. This is particularly true for the en masse move to working from home. Such a change in working patterns, if attempted in normal times, would probably have taken months to plan and implement. However, when faced with the immediate closure of offices, staff members were up and running at home in a matter of days and possibly even hours. Most of the work that needed to be done carried on: services were provided to customers; projects and change initiatives were launched and completed; new staff were taken on remotely, with many not meeting new colleagues in person for months, if at all.
Companies’ chief risk officers can now reflect on how their organisations performed during the pandemic, and how fit for purpose their risk management frameworks turned out to be. This review should include how the company’s business continuity plans stood up to the test, especially given that most other organisations were going through the same thing at the same time. The COVID-19 crisis may fairly quickly have brought to light any gaps or ambiguities in policy documentation or internal procedures and governance arrangements, or might have shown that existing governance arrangements were inadequate in a fast-moving environment.
As the months rolled by, other issues may have come to the fore: the need for more regular and detailed monitoring of risks, including those relating to people; changes in strategic risk levels, producing an updated ORSA; reviewing new operating models. Lessons from these reflections should be fed into the implementation of operational resilience regulatory requirements. Based on feedback from the survey, this is likely to include strengthening organisations’ crisis management capabilities, considering stress and scenario testing in a more holistic way, and reviewing the potential risks of outsourcing.
As part of this reflection, chief risk officers can also reflect that R, a letter that has taken on a life of its own during the pandemic, should not just stand for ‘risk’, but also for ‘resilience’.
Dermot Grenham is company actuary for The Medical and Dental Defence Union of Scotland
Isaac Alfon is a managing director at Crescendo Advisors
