Risk Management for Three Times
Experience tells us over and over again that there are three times that are important for risk managers.
1. Before a major loss event
2. Immediately following a major loss event
3. Longer term after the major loss event
Most of the discussion and literature about risk management focuses on the first of these times. We focus on identifying, measuring and mitigating risks in advance of events.
But for each of an organization’s major risks, it is extremely important to think about the other two times. Over and over, we see examples of situations where the second period is mishandled, often multiplying the size of the loss.
The most common first reaction seems often to be to hope for the best assuming that the loss is minimal and postponing taking any significant actions. For those events that turn out to be really major, this can have two very negative consequences. Often, if the right steps are taken right after the event, the eventual loss is significantly reduced. In addition, those early moments after a loss are when the most effective actions to reduce reputation impact must be taken.
For the longer term recovery from a major loss event, the organization needs to quickly develop a plan to cover the losses and to get the organizational capabilities back as close as possible to the state before the loss event.
In both “after” times, the actions taken might be very different if the loss event is one that impacts many others in the same space or is an event that impacts the organization alone.
What the risk manager needs to do is to use the contingency planning process to put together response plans to large loss events arising from every major category of exposure. Start with the extreme loss scenario itself. Imagine a two black swan event. Then develop your responses for such an event if (a) it is just your problem or (b) if it strikes most others in your area of operation.
When it is your loss alone, the reputation risk is high and their needs to be a major effort to managing the perceptions about your organizations. When the event strikes everyone in your area of operation, the issue will be resources to support recovery. When everyone is out looking to use those same resources, availability and or price are likely to become adverse.
Risk managers will often report on their top risks to their board monitoring the risk position. Those reports are all about Time 1. There should also be reports for Times 2 and 3. Having this discussion with the board in advance also makes it more likely that management will be able to implement the Time 2 plans immediately if both they and the board are prepared by advance discussion. While it is unlikely that the exact plan that was developed would be used, the conversation about what will be done can focus more around the variations to the developed plan that are demanded by the actual situation.
This part of risk management can also be a job saver for the risk manager. Many risk managers may be one of the scapegoats in the event of major losses to an organization. By providing the leadership needed to prepare in advance and forcefully recommending the needed steps in the loss event, the risk manager can make sure that they are seen as part of the solution, rather than the cause of the problem.