Many organisations are engaged in discussions about COVID-19 and its implications from a risk management perspective.

At RSM we believe that all organisations can benefit from these experiences as we head into the “new normal”.Many organisations are engaged in discussions about COVID-19 and its implications from a risk management perspective.

This article gives some tips to help organisations assess the currency of their risk management and to apply the learnings, from operating in a flexible and agile manner, and how this will impact future operations. This will not be a recap on all good risk management practices, but those that are COVID-19 related.

1. Do not throw governance out the window

Many organisations may have taken on a state of emergency, reducing board activity and giving the executive greater decision-making power, or alternatively, the Board becoming increasingly involved in operational matters.

Whilst the physical aspect of direction and control may be changing, the fundamentals of good governance should remain the same. Without governance providing effective strategic direction, risk management can easily become a tick box exercise.

Those charged with governance should monitor, guide, and challenge (constructively), the progress of an organisation’s response to COVID-19. It is important that COVID-19 response monitoring and reporting i.e. progress, issues, innovations, and key learnings, be a standing agenda item for management and Boards.

TIP

  • Adapt your governance arrangements to make sure your Board functions properly and as intended. This will allow your Board to set direction, measure performance, have oversight, undertake scrutiny, and make decisions.Adapt your governance arrangements to make sure your Board functions properly and as intended both through and after COVID-19.

It is in exceptional circumstances such as this that an effective Board comes to the fore.

2. COVID-19 is not a risk in its own right - it currently affects everything

Organisations may be including the COVID-19 pandemic as a new risk in their strategic risk register. This suggests that the risk exists in isolation with a specific set of controls and actions. This is not the case; previously defined risk events have now been changed. COVID-19 adds a new dimension to an organisation’s risk management and the subsequent effects on the organisation’s strategic risks are likely to include both threats and opportunities that require in-depth exploration.

Organisations should look at their strategic risk profile as a whole and understand the threats, opportunities, and risk interdependencies. Too many risks (risk registers) are reviewed on a transactional basis, i.e. in parts but not as a whole.

TipS

  • Review your strategic risks drivers. This will likely mean that you have to adapt your controls or create new actions in the context of the risk, to ensure that it is being suitably managed.
  • Identify, assess, and validate new or existing strategic risks and/or opportunities.

3. COVID-19 response - things do happen

Contingency planning is a key feature in the management of risk. By now most organisations will have some form of COVID-19 response plan in hand to ensure the survival, recovery, and continuity of operations.

The above goes for any kind of significant event to which an organisation is responding, not just the current COVID-19 situation.

TIP

  • All organisations should have a contingency framework within which it can operate when situations like COVID-19 or similar arise.​All organisations should have a contingency framework within which it can operate when situations like COVID-19 or similar arise.​

The World Economic Forum Global Risk report may be helpful. It is produced annually and focuses on what might be the world shapers in the next 12 months. A global pandemic has been in the report for a number of years.

Organisations may wish to consider how the realisation of such risks in the future might impact its operations and existence, i.e. what happens globally will eventually impact locally, and then consider the organisation contingency framework in that context.​

4. 'Don't throw the baby out with the bathwater', with respect to COVID-19 risk management

There is a tendency through crisis management to focus all efforts on the immediate crisis. In the COVID-19 circumstances, this is understandable, however be mindful of not allowing other major risk exposures from being attended to and/or arising.

Delivering capital projects on time and on budget, managing ever-decreasing budgets, cybersecurity threats, and payroll issues to name a few.

Organisations have had to adapt quickly to new ways of working and collaboration with implications for both people and culture and should look at their strategic risk profile as a whole and understand the threats, opportunities, and risk interdependencies. Too many risks (risk registers) are reviewed on a transactional basis, i.e. in parts but not as a whole.Don't 'throw the baby out with the bath water' with respect to COVID-19 risk management

TipS

Organisations should, as a priority:

  • Investigate what worked well and what did not and the impact on its people and their desired culture.
  • Rapidly review the status of all other business-critical activities and recast plans and actions to ensure successful delivery.
  • Assess their priority settings and re-affirm or supplement resourcing to ensure successful delivery in the post COVID-19 world.

Agile organisations will adapt to new ways of working by being more selective, regarding workplace attendance, balanced by the organisational requirements and its workplace culture.

5. Don't manage the COVID-19 response via spreadsheets

Some organisations have made huge spreadsheets to record their actions. But a spreadsheet is not a reporting tool and is reminiscent of organisations that still put the whole risk register (in spreadsheet form) on the Boardroom table.

In doing this, where do you start? It is also highly likely that it is already out of date by the time this happens.

TIP

  • This is a fast-moving environment so make sure that the Board, management, and staff have access to real-time information, e.g. updated actions, communications, evidence, etc. all in one place.

This will provide key stakeholders visibility of the response and ensure a more coordinated and consistent approach.

Investing in a system to communicate and track actions, progress, and updates, and provide useful management information doesn’t have to be expensive and will cut down on unnecessary and inefficient administration. This will provide a good return on investment.

6. Prepare to manage the change risks - embracing the 'new normal'

All organisations will need to adjust to a new way of working and grasp the opportunities that this presents for increased operating efficiency and effectiveness.All organisations will need to adjust to a new way of working with COVID-19 and grasp the opportunities that this presents for increased operating efficiency and effectiveness.

These will be wide-ranging from where we work, how we work, and how we engage with customers, suppliers, and stakeholders.

In some cases, this might necessitate a top to bottom organisation restructure to realise the benefits that this change can bring.

How can RSM help with managing risk during COVID-19?

Do you have a question, or require assistance, in relation to managing risk during COVID-19? Get in touch with your local RSM Office for more information.