The Haphazard Response to COVID-19 Demonstrates the Value of Enterprise Risk Management
Arlington, VA (March 10, 2020) — Just 12 percent of more than 1,500 respondents believe their businesses are highly prepared for the impact of coronavirus, while 26 percent believe that the virus will have little or no impact on their business, according to a recent survey by Gartner, Inc. In a Gartner business continuity webinar on March 6, Gartner experts asked participants how prepared they are for impact of COVID-19.
Read more about compliance, risk and COVID-19
“This lack of confidence shows that many organizations approach risk management in an outdated and ineffective manner,” said Matt Shinkman, Vice President in the Gartner Risk and Audit practice. “The best-prepared organizations can expect to enjoy many business advantages over their less-prepared peers as they minimize the disruption caused by the coronavirus.”
Most respondents (56 percent) rate themselves somewhat prepared, and 11 percent said they were either relatively or very unprepared. Just 2 percent of respondents believe their business can continue as normal, highlighting the huge range of businesses that could be affected by the outbreak. Twenty-four percent of respondents expect little disruption, while the majority expect business to continue at a reduced pace (57 percent), to be severely restricted (16 percent) or to be discontinued altogether (1 percent).
The challenge lies partly in the ambiguity inherent to managing an emerging risk such as coronavirus. Organizations often have policies in place to deal with most risks, but they don’t activate them until it’s too late because no one is owning the risk or taking it seriously until it is fully manifested. The threshold for a risk to generate executive action is often too high to enable an effective response.
“Board members tend to deal with emerging risks by just assuming they will go away and instead focus their attention on what is most important today,” said Mr. Shinkman. “In good times this methodology is reinforced because sometimes emerging risks really do just go away. It’s when they don’t that problems inevitably emerge.”
Having an enterprise risk management (ERM) function function in place means that an organization is more likely to see risks coming and then mitigate the impact of those emerging risks more swiftly and effectively. Gartner’s view is that a focus on impacts rather than specific scenarios is best practice for ERM.
“It’s nearly impossible to predict exactly if or how a particular scenario will unfold or even when,” said Mr. Shinkman. “That’s what creates the ambiguity and often inaction around emerging risks. It’s much more effective to focus on potential impacts and how to mitigate them.”
A pandemic provides a perfect example of how this approach works – companies that wait until the emerging risk is already impacting operations and/or many employees will likely find themselves playing catch up and losing ground to companies that were better prepared.
Companies can get better prepared by considering what interim events could occur that would suggest that a pandemic, or similar emerging risk, is about to sharply increase in terms of its impact or likelihood. By using an ERM approach to identify and prepare for those specific events – and setting up mechanisms to monitor for them – the best companies are better positioned to avoid major disruption.
For those dealing with a crisis response to the coronavirus in their organization, they should have planned responses to specific impacts. For example, what will the company do if one employee gets sick? Ask all employees to self-isolate? Are work-from-home procedures sufficiently mature to support that or will work have to stop? Do suppliers or clients need to be notified? Is finance able to support operations in the event of anticipated losses?
Using an impacts-based method makes it very clear when to trigger a response plan and to start mitigating the effect of specific impacts on an organization. Also having response plans that react to specific impacts means it is simpler to communicate the plan to staff, so that all employees can play a part in managing risk. In fast-moving situations such as this, the more people who are owning risk, the more likely it is that an organizational response will be timely.
“Avoid constructing elaborate ‘what if?’ scenarios and focus on what is known,” said Mr. Shinkman. “Many organizations likely already have plans in place to deal with the types of disruption they are facing because of the coronavirus. The job of risk management is to ensure the right plans exists and make sure they get used at the appropriate moment.”
Gartner clients can access the full research in Managing Ambiguity in Crisis Escalation Procedure.
Learn more about how to lead organizations through the disruption of coronavirus in the Gartner coronavirus resource center, a collection of complimentary Gartner research and webinars to help organizations respond, manage, and prepare for the rapid spread and global impact of COVID-19.
About the Gartner Risk Management Leadership Council
Senior executives need actionable information to make quick decisions. Successful organizations embed risk management into strategic decision-making processes to help the business execute on its growth priorities. Gartner Risk Management Leadership Council equips enterprise risk management leaders with insights, advice and tools to better navigate high-risk growth decisions. More information can be found at: https://www.gartner.com/en/audit-risk.
About Gartner
Gartner, Inc. (NYSE: IT), is the world’s leading research and advisory company and a member of the S&P 500. We equip business leaders with indispensable insights, advice and tools to achieve their mission-critical priorities today and build the successful organizations of tomorrow.
Our unmatched combination of expert-led, practitioner-sourced and data-driven research steers clients toward the right decisions on the issues that matter most. We are a trusted advisor and objective resource for more than 15,000 organizations in more than 100 countries — across all major functions, in every industry and enterprise size.
To learn more about how we help decision makers fuel the future of business, visit gartner.com.
