When low probability high impact risks occur, organizations rely upon tried and tested responses to deal with the immediate aftermath and restore ‘normality’ as quickly as possible. But with the pandemic caused by Covid-19, many governments, organizations, and communities are beginning to realize that a resumption of ‘normality’ may never happen.
Key challenge for risk practitioners is to identify and monitor the connectivity between factors
As we try to define what a ‘new normal’ looks like, how should risk management practitioners adapt so that they can retain public confidence in their ability to anticipate and plan not only for the shockwaves expected from Covid-19, but from other future pandemics. Unless people feel safe and secure as they try to adjust to new ways of living and working, public confidence in government and the organizations we rely up will never be restored.
The pace at which Covid-19 spread through global communities was akin to a tornado, ripping up infrastructures and connected networks at local level and escalating up to a national crisis affecting all walks of life. So, one of the key challenges for risk practitioners will be to identify and monitor the connectivity between those factors that define the risk environment communities live in and organizations operate in.
New technologies give time to prepare for a risk incident
To do this, it is important to link risk assessments that focus on critical vulnerabilities through a set of scenarios that allow practitioners to model the impact of alternative ‘what if’s’. These can then be used to define key indicators which reflect the risk environment an organization operates with, using a set of thresholds which reflect an organization’s risk tolerance. With this in place, new technologies can support a dynamic monitoring system to track and report on changes in that risk environment and give organizations time to prepare for a risk incident.
Anticipation rather than reacting or even over-reacting
Without such a system in place, organizations and indeed governments will remain ‘on the back foot’ having to react rather than anticipate, reliant on information that has not been corroborated in a timely manner which can led to over-reaction. This must be avoided for communities to feel that they can anticipate and plan with confidence about how their own lives need to adapt. Not every threat, real or perceived, becomes a risk and by creating a sense of fear to persuade people to change behavior, coupled with discrepancies in the data provided as a justification for that change, public trust has been undermined. As a consequence, changing the message to make people feel safe and secure enough to resume their lives and restart the economy under the ‘new normal’ has received limited support.
Covid-19 should be managed inside normal risk management frameworks
The other impact of Covid-19 on risk management practices is that there will be a tendency to manage it outside normal risk management frameworks in a manner similar to how cyber-security is managed and this is a mistake. Undoubtedly as with any risk, one needs to have experts capable of undertaking reliable risk assessments, but once done, the outcomes need to be embraced within a fully functioning risk management system which can deliver joined-up thinking about how to manage all-risks.
So this ‘new normal’ for risk practitioners provides an opportunity to connect the dots between the global risk environment and local communities that people, places and networks depend upon, strengthen the competencies and capabilities of existing risk management architectures and provide assurance that Covid-19 and other future low probability high impact risk events are being managed in a manner that ensures the safety and security of us all. Tornados might be unpredictable when they do occur, but what can be predicted is that there will be another!
Alison Lyall
Director of Advisory Services
Optix Risk Management Ltd.
alison@optix-rm.com
Photo: Laura Vanzo / Visit Tampere