Cost-of-living pressures, inflation, climate risk, cyber risk, supply chain concerns, geopolitical instability – the dance card of risk managers is full and it’s no surprise that the social capital commanded by experts in risk and insurance is at a premium.
Lending his perspective on these challenges, James Crask (pictured), head of strategic risk consulting at Marsh UK & Ireland, emphasised the spread and interconnectivity of the poly-crisis environment facing businesses. Taking supply chain vulnerability, for example, he said, it’s a risk that came into sharp focus in response to both COVID and the ongoing conflict in Ukraine.
“What we’ve learned from those two events, in particular, is that a lot of organisations just don’t know enough about their supply chain, and where their risks are, below the people that they’re paying invoices to regularly,” he said. “So, you get a part in from a tier-one supplier but actually, the risk is somewhere else that’s not visible to you.
“Geopolitical risk is a big focus, particularly for our clients that have global footprints and are looking at where to invest in the future. We’ve lived through a period of relative peace and stability in most of the economies that we work and that is coming to an end. This is creating more uncertainty because the decisions that we made in a more benign risk environment are now coming under a bit more scrutiny.”
Crask noted that the cost-of-living and inflationary pressures which have been dominating headlines are not just issues for individuals and families, but are also impacting the operational efficiency of businesses and undermining their resilience. In an environment where organisations are financially stressed, he said, it may not be that the economy itself puts them out of business, but rather that it serves as the straw that breaks the camel’s back, tipping them over the edge.
“So, balancing an organisation’s investment in resilience against efficiency measures is another area that’s taking up quite a lot of time and discussion at senior levels,” he said. “Because there is a cost associated with resilience measures – whether it’s back-up IT systems, or additional staff, or extra stock in a warehouse – and that’s often the place you look at when you’re cutting costs in a business. When things aren’t going well, resilience measures are an easy target for efficiency savings.
“But if you do it wrong, you’re threatening the organisation’s long-term viability against the next big event. And the next one that comes along could be the thing that knocks you off your perch. I think there is a danger of organisations becoming a little too comfortable with their preparedness and questioning why they need to continue to invest in risk management. But the truth is, you’re only as good as your last crisis.”
This behavioural shift is being largely driven as a result of organisations having survived the poly-crisis environment of recent years. However, Crask highlighted the need for businesses to recognise that their survival is a testament to the success of risk management, not an indication that it’s no longer necessary. This should reinforce the need to continue that investment, he said, so businesses can be ready to respond to new risk events as and when they arise.
And with such a glut of risk factors at play, he said, prioritisation is at the heart of the conversations risk managers should be having right now.
“You can’t protect yourself against everything and you can’t predict the future,” he said. “So, what does that mean? It means you need to get into a position where you’re focusing on what truly matters to the organisation, on protecting the crown jewels. Not knowing what the future is going to hold with any great certainty drives the need to be a little more selective.
“That’s where robust risk quantification and scenario-based analysis can help you, not to predict the future, but rather narrow down the possibilities to the extent that you can get a grasp of them and work out what can actually be done in a tangible sense to mitigate some of those issues. So, it’s about taking operational, tactical steps that will have a manifest change on your overall resilience in the long term.”
A core challenge impacting businesses today is how to balance a resilience budget in a way that addresses operational and more proximate risks which require immediate attention and systemic or chronic risks which might take longer to materialise. For Crask and his team, a key solution is understanding the pathways to these risks and mapping out what impacts they will have on the business when they materialise.
“It’s about understanding at what stage will the organisation experience tipping points where decisions need to be made to invest, and how much investment can be done now versus what that cost will be nearer to when that risk starts to materialise,” he said. “Because the two figures will be very different. That’s a decision for boards to take but it’s not an easy one in environments where it seems there’s always more immediate problems that need to be addressed.”
Getting that balance right is especially tricky for risk professionals because they’re faced with justifying investment in a risk that hasn’t happened yet and might seem unlikely to happen. It’s hard to know with any degree of certainty whether the decision you make today is going to make a material difference to your resilience in the future, he said, but that’s where effective prioritisation and risk quantification step in.
“If you use scenarios to help drive your planning, you can work out what processes, plans and capabilities you might need to invest in to reduce your exposure to the impact that scenario will have,” he said. “And the more you can quantify it, the more defendable and easier that conversation is to have with senior people when they come looking for those cost savings.”
The risk environment presents a real opportunity for risk managers to take on more expanded roles and to leverage the value they bring to organisations, Crask said. And he has seen how the role of the risk manager has evolved to take on greater prominence over time, which he believes is a sign of their value being better recognised by organisations.
“Risk management is all about helping a company manage uncertainty and we’re in an extremely uncertain environment,” he said. “So, the social capital that risk managers have at the moment, within the organisations they support should be enormous and their value should be sought by senior executives – and the good ones are.
“Ultimately, having a robust conversation about risk is easier than one might think at the moment because senior executives want this data and insight to help improve their confidence in decision-making. Otherwise, they’re shooting in the dark.”
