February 26, 2015 by Mark Aiello
There’s nothing like a good buzzword to cloud an issue. The talk lately in risk management is about “resiliency.” But we’re lucky this time— it actually means something. Resiliency is what you have when you coordinate various programs within your organization, ones that support the ability to respond to an adverse event and return to a “business as usual” state, all with minimal impact.
Now many organizations have already done their best to be “resilient.” They’ve had program elements in place for a number of years, most commonly Business Interruption insurance and Business Continuity Management. And they may well work well in helping organizations respond effectively to disruptions. But more often than not, the two programs rarely exist as part of an integrated framework.
Let’s back up first and dissect the problem. At the most basic level, an unexpected disruption in operations will result in a loss of revenues and an increase in costs to facilitate the recovery. And on a more comprehensive level, you can have a significant number of other impacts that organizations face over the short term, medium term, and long term.
Short-term impacts can include safety and wellbeing, increased operating expenses, diversion of management attention, and the ability to deliver key programs and services. This is when an organization needs access to capital to mitigate the impact and start the recovery process. So the first steps after a disruption are crucial: depending on the immediate response, there may be negative public or media attention that needs to be managed.
Say a disruption isn’t effectively managed in the short term. Not only will operating costs increase and the ability to deliver key programs and services be compromised, organizations may also run into trouble accessing capital for growth or even continuing operations. Then there could be customers lost, suppliers lost, contracts cancelled. Third-party partners may be having a long think over the nature of their relationship with the organization treading water.
As for long-term impacts… Well, the problems that existed in the short and medium terms could stay on the horizon, and as time passes, the organization may see its reputation erode away like the tide washing away a sand castle. Does the organization still have what it takes to retain key customers, suppliers and staff? Can it still attract new customers and talented, skilled employees? All the distraction and diversion can cripple an organization’s long-term growth and viability. The lack of a strong, comprehensive resilience framework can result in devastating challenges that are difficult to overcome in the long run.
Once the safety of all the stakeholders is ensured during a disruption, the key priority is to recover and resume operations to get things back to business. Organizations need to have the ability to recover effectively, along with the capital to make it happen.
The core purpose of Business Interruption insurance, of course, is to offer funding to help cover lost revenue or increased expenses because of the disruption, including short-term financial impacts. It injects the much-needed liquidity in the short term, but naturally this insurance will only respond if the cause of the disruption is covered within the scope of the policy coverage. And it’s only a short-term solution—it often falls short of providing an effective recovery framework that focuses on long-term resiliency.
In contrast, an effective Business Continuity Management program has the blueprint to ensure both the effective use of capital in the short term, as well as the recovery strategy for long-term organizational goals. Traditional BCM programs combine a number of elements, such as emergency response, crisis management, and business resumption; they may include different planning documents and often different resources, but most programs cover some element of all three key components.
Your typical BCM programs put a foundation in place to ensure a systematic approach to recovery: one based on clear communication of corporate priorities, and that will make sure the stakeholders are trained and able to make the right decisions.
But most also have a critical flaw: they don’t consider the capital requirements for recovery. In other words, an effective BCM program can give you all the tools needed to recover, but if you don’t have the funding to carry it out, those same tools are ultimately useless.
Despite the fact that most organizations carry Business Interruption insurance, and have a BCM program in place, the two programs are rarely linked. Many organizations will employ a risk manager to coordinate the insurance program with no involvement in the BCM. Meanwhile, the BCM program is under the guidance of another individual in the organization, fully disconnected from insurance. It’s silo thinking a farmer would love.
As organizations develop a BCM program, they typically begin with a Business Impact Analysis to analyze and evaluate the operational and financial impact of a disruption, while considering the organization’s tolerance to withstand it. The results should naturally feed into the insurance program decisions on limits and waiting periods, but that disconnect means it rarely does. To add to the problem, the analyses tend to be purely process-driven and don’t address capital needs to achieve effective resumption of operations.
First, you have to recognize there is a disconnect. Then an organization has to break down those silos and foster integration.
Communication is the obvious key. As a first step, it’s important to know what types of risk management activities are going on within the organization and who is responsible for those activities. For example: • colleagues with responsibility for BCM should be encouraged to reach out to the colleagues that have responsibilities for insurance, BI in particular; • develop an awareness of what their programs entail, how they are evaluating risk, implementing risk management strategies and monitoring progress.
Once those initial walls have been broken down, the next step is to create better direct ties between the BCM and BI programs, such as: • mapping business impact values and recovery priorities to BI coverage limits and retention levels; • incorporating BCM measures into insurance negotiations to provide better comfort to insurers on exposures and recovery strategies; • considering BI funding in BCM strategies and action plan; and • mapping BCM response to coverage provided in BI program.
There’s been a lot of research of late on how brokers can make themselves more valuable to risk managers in terms of offering expertise, rather than pitching products. Companies and organizations are looking not only for coverage but solutions. So the savvy broker would suggest creating an integrated risk management function that’s ultimately responsible for the coordination of all risk management strategies and activities. Now this doesn’t necessarily mean a single manager will handle all risks, but there should be a centralized corporate function that’s able to connect the dots of risk management under one strategic umbrella.
Taking the long view, risk management is often seen as something that happens outside of day-to-day management, but it should be better integrated with corporate hierarchy and aligned with impacts and abilities to achieve results. The key benefits would be greater accountability, consistency in decisions and shared knowledge, as well as greater awareness of issues, more efficient use of capital and resources and a decreased total cost for an organization’s risk.
Creating a resilient organization isn’t the result of a single effort. Resiliency is the end-state of a well-integrated risk management program. It’s about taking a holistic approach to create awareness of the uncertainties that could disrupt an organization and preparing effectively to manage them.
Mark Aiello is senior vice president and practice leader of Organizational Risk and Resilience at Marsh Risk Consulting.
Copyright 2015 Rogers Publishing Ltd. This article first appeared in the February 2015 edition of Canadian Insurance Top Broker magazine
This story was originally published by Canadian Insurance Top Broker.