The risk profile of an organisation is a landscape sensitive to any and every evolving external factor. There are, however, very few situations in recent years which have managed to rewrite the risk profile of businesses so profoundly as the COVID-19 pandemic. The ‘COVID Risk Review’ a global survey recently carried out by the operational risk association, ORX, assessed over 160 senior risk professionals from banks and insurers, and found that the top risk profile has changed completely since the start of 2020.
Key among these findings, noted Steve Bishop (pictured), the head of risk information and insurance at ORX, is the realisation of how great a shift in risk occurred between January and May when this survey was conducted. Such swift changes are quite unique in operational risk profiles, which tend to change quite slowly and to be influenced mainly by new business or societal trends.
“We saw a shift where there was only one risk in the Horizon report we published in January that was present on the top five risks that we published in the report in early June,” he said. “And that’s just quite unprecedented as you tend to only see things like that during a crisis, with operational risk. To a certain extent, we saw that in the financial crisis of 2007 – 2009. This is a really sudden shift and change in people’s focus.”
Business continuity registered as the most pressing risk facing financial services professionals, which made perfect sense, Bishop noted, as this risk profile reflected what organisations had to deal with during the initial stages of the crisis. These businesses have had to manage business continuity in a way they could never have anticipated. Traditional business continuity tends to rely on things like recovery sites, and the resilience of individual systems and buildings, whereas this crisis represented an organisation-wide issue.
Perhaps the most striking development in this risk profile has been the rise in concern around ‘people risk’ as the line between work lives and personal lives becomes increasingly blurred and firms are faced with the challenge of implementing and maintaining robust work-from-home policies. People risk was ranked 11th in an ORX survey in January but now registers as the fourth most pressing concern. Both during the crisis and going forward, Bishop said, there’s a real underlying worry around people which has not been an area of focus for some time. This people risk is also a driver of some of the other risks which are concerning organisations, so it’s imperative to find ways of managing and mitigating this.
“People is a risk that organisations have always wanted to manage effectively, but the current heightened level of this risk has really brought it to the forefront,” he explained. “Organisations are also having to think about people’s roles in processes. Many processes are designed to operate in an office environment and very quick changes have had to be made to accommodate the work from home situation, with businesses relying heavily on their people to implement changes to processes and controls. This is in addition to the consideration that people are more vulnerable, in the home environment, to making mistakes or being preyed on by fraudsters.
“There’s been the immediate concern with working from home in terms of changing processes and the associated challenge for people being able to operate effectively in their home environment. However, there’s also the longer-term concern of, if you now have a more remote workforce, how can you manage your people effectively? How can you develop them and retain them in this remote working setup? Organisations are having to shift their focus to think about how they’re going to achieve that going forward.”
The COVID-19 crisis has reinvigorated an emphasis on people, Bishop noted, highlighting that many of the organisations ORX interacts with have begun to place an increased premium on investing in the physical and emotional well-being of their staff. Employers have a better understanding of the pressures that the pandemic has put on to individuals and families, both from a societal perspective as well as from a work perspective.
Looking to the future evolution of this risk profile and how the placement of people risk as a key concern might change will be fascinating, Bishop said, and ORX will be re-running the research again shortly to start a conversation surrounding the long-term implications of this crisis. The real question facing businesses now is what risks they should be looking out for over the next six to 18 months, as the future starts to become a little clearer.