This is how to stay master of the situation, even under extreme conditions

Covid-19 is leading to both a global health crisis and an economic crisis of unprecedented proportions. The implications for business in this regard are still far from clear. "What we do know is that the impact is exceptional and that the effects will be felt for a long time to come," says Harmen Jansen, managing consultant at Improven. "Actively managing the risks now takes on a different dimension than before," Jansen stresses. "In doing so, it is important to review diverse risk scenarios, including the very extreme ones."

Could organisations have seen the current crisis coming?

Jansen: "In most organisations, a global calamity like Covid-19 was not seen as a real risk. It was a 'black swan', the chances of something like this happening were too small to take into account. That makes this crisis a very harsh lesson. So it turns out it can be done. The current situation now demands flexibility, creativity and new ways of thinking from everyone. It is also important that organisations identify, discuss and continue to monitor their risks more intensively than before. In boardrooms, people should actively engage in dialogue about possible risks and scenarios, even if they are very extreme scenarios. It is important that an organisation's top management knows exactly what the consequences of this crisis are for its own goals, strategy and operations. Executives and boards of directors must take decisions on this."

Why do organisations need to start evaluating risks and risk scenarios just now?

Jansen: "Many organisations have plans in place to achieve specific short-term and long-term goals. But those plans have suddenly lost much of their meaning. Everything is different now. We are dealing with a big sum of all kinds of uncertainties coming our way. Solutions must be found for the uncertainties now encountered. Those solutions are there, even for the situation we are in now, but one has to rig and deploy them at the right time and in the right context. What is being asked of organisations now is to understand the risks that are emerging and reduce the impact. That is what it is all about now."

What risks are currently being discussed within organisations?

Jansen: "Nobody knows how long this will last and what the actual economic consequences will be. I see that uncertainty translated into all kinds of issues, but at its core it is always about organisational continuity. One of the concerns is whether organisations will have sufficient cash in the medium term to continue and secure continuity. Incidentally, there are all kinds of management measures that can be taken that can limit the impact of the crisis on liquidity. Think of liquidity planning, strong contract and supplier management, taking out a loan or making payment arrangements. In addition, the government offers some emergency schemes (e.g. the NOW and TOGS schemes or tax deferrals) that help stay afloat financially.

Another major concern is the employability of employees. People also wonder whether primary processes can continue if too many colleagues drop out due to illness or are insufficiently available because they work from home. This calls for inventiveness from organisations, and I see that all kinds of smart solutions are actually being found to make these kinds of risks manageable. A lot is suddenly possible now, partly because of all the technological options available.

Finally, on a very different level, we also see several risks becoming more prominent. For example, employees are getting into all sorts of applications that are not actually suitable for business use. You see it with video calls, with email exchanges, with sending large files. And in doing so, organisations run risks of which they are often unaware. For example, we see We-transfer being used to send large files because organisations' own e-mail capacity makes that impossible. Or privacy-sensitive information is sent back and forth via private e-mail to still get on with work. In addition, not everyone has that fast and reliable internet connection at home, so private Wi-Fi is regularly used. Data traffic is then usually not properly encrypted, making it easier for hackers to access it."

What can organisations do to mitigate the risks of working online?

Jansen: "There are a lot of possibilities. Besides arranging practical matters such as expanding network capacity and servers, for instance, secure connections and additional account security can be provided by applying multi-factor authentication, for instance. In addition, more awareness needs to be created in organisations that working from home and online is important, but also carries risks. It doesn't all have to be ready overnight, but work on it and gradually grow towards a more secure situation, we say at Improven."

That risk awareness, how can organisations do that?

Jansen: "Organisations need to communicate with their employees on such issues in a well-structured way. We have programmes for that. Colleagues sit alone a lot so they are more than open to attention from their employer. And develop e-learning programmes around these topics, which proves to be very effective in practice."

Are there any positives to the developments that are happening now?

Jansen: "It is clear to everyone that this situation is negative. But at the same time, I also see the strength of many organisations. Changes - for example when it comes to remote working - suddenly appear to be possible. Many organisations have adapted at lightning speed and found ways to keep work going. What's more, people suddenly find they can do much more work than initially thought. At the same time, a strong sense of togetherness is emerging in organisations. That is important, it can contribute to creativity in the organisations and thus also to finding answers to important risks and opportunities that arise now."

What steps can organisations take now in terms of risk management?

Jansen: "The most important thing is that there is sufficient dialogue in the organisations about the effects of this crisis on the organisation. What risks do we see and what actions are required of us now? Document the decision-making process as well; this can then be reflected on at a later date. For many organisations, the coming period will be dominated by short-term actions aimed at keeping their heads above water.

In the longer term, organisations can review their existing risk assessments. Take stock of the risks and discuss what has changed and decide whether any parts of the risk analyses need to be adjusted. My tip is: don't go ticking off risks but focus on what is really important and don't forget the extreme (low probability, high impact) risks. We now see that even these can happen. The latter can be done using scenario management. This involves taking stock of the effects on the organisation of extreme scenarios. This is very instructive and often leads to new insights. This gives risk management a new dimension for many organisations, with a focus on stimulating the (risk) dialogue between directors and management. Risk managers and security officers can play an important role in this and show just now how risk management can add extra value."

"Finally, I would like to encourage organisations to reflect on this crisis over time. It is a unique situation from which we can also learn a lot. Discuss with each other how things were done, what could have been done better and what went right. These are incredibly valuable lessons for the future and also help boost risk awareness."