Effectively balancing cost efficiency and resilience is a delicate tightrope for modern businesses to walk, with pressures on either side always threatening to tip the equilibrium. It’s a balancing act that has traditionally overwhelmed many businesses, with the scales often dipping in favour of the cost efficiency side of the equation as noted by James Crask, head of strategic risk consulting, Marsh UK & Ireland.
“Going back into the not-too-distant past, you would typically find very traditional business continuity, if it was done at all, being delivered in a silo within a business,” he said. “And that silo would rarely talk to other parts of the business that also have a role to play in managing risk – whether that’s security risk, health and safety risk or financial risk etc. – in the context of a cost efficiency discussion.”
But what happened, Crask said, is that major events such as COVID-19 and the ongoing conflict in Ukraine, amid all the economic instability faced by businesses at the moment, have led to a breakdown of those traditional silos and moved the dial on resilience discussions. Resilience planning is now expected to be delivered in a more integrated way with the other disciplines within an organisation.
“And why has that happened? In my view, it’s down to a couple of things,” he said. “One is that resilience is now much more at the top of the boardroom agenda. You’ve got senior levels of attention on it, which perhaps, in the past wasn’t the case in a lot of organisations. And two, in living through COVID, Ukraine and everything else that’s happening, we’ve realised how interconnected all the risks we’re exposed to are, and that interconnectivity drives the need for a more integrated approach to managing them.”
Reflecting on his risk management career, Crask highlighted that the biggest change he and his team have seen is not in the risks that they are championing greater awareness of but rather the board-level attention and focus these discussions are now receiving. Without that, the ability to proactively mitigate effective business continuity measures is throttled.
It’s a fascinating time to be in this line of work, he said, as the mission of what resilience is there to deliver – to help businesses weather the current storm but also prepare for the storm clouds just over the horizon – is coming into its own. It’s a transition that is also feeding through in the number of client inquiries Marsh is receiving on the topic.
“There’s always been a strong demand from clients for us to help them prepare for disruption events, but COVID sent this demand into the stratosphere for us and many other organisations delivering these kinds of services,” he said. “And Ukraine has done that again, in addition to all the supply chain challenges and the economic challenges that a lot of businesses are now facing. So, the demand is certainly quite unprecedented, in my career at least.”
Whether or not businesses will be more willing to engage in resilience conversations going forward is dependent on the business in question and the team setting its strategic purpose. There are always going to be organisations that are primarily focused on the here and now, Crask said, and it’s very natural to prioritise what’s in front of you. However, COVID, in particular, offered a challenge to global supply chains that spotlighted the interconnectivity of risk and forced everybody to think beyond the traditional boundaries of their organisation.
“And when you start to think outside of your organisation, you start to open your mind up to potential risk scenarios that you haven’t necessarily had to think about before,” he said. “Naturally, you start to think further into the future. We certainly see more of that now but not everybody is there yet. You tend to find that organisations that are more advanced in that thinking have experienced an acute shock themselves - and we all have through COVID but some have been impacted more than others. The same goes for Ukraine, and for organisations operating in high-risk environments, or markets that are undergoing big transformational changes, or where there’s lots of innovation or competitor action going on. It forces you to think slightly differently to businesses that are relatively stable in their operating environments.”
Crask highlighted that multiple factors influence an organisation’s focus when it comes to risk and the particular flavour of resilience they tend to apply within their organisation. These include but are not limited to the characteristics of the business, and the market and industry in which it’s operating.
The plethora of challenges stacking up against businesses represents an opportunity for them to think and act more proactively regarding resilience measures, but Crask also warned of the very real danger of complacency setting in. Having lived through several major crises, he said, businesses must not slip into thinking that this survival means they don’t need to continue focusing their attention on these pressure points.
“You’re only as good as the last crisis you dealt with rather than the next one that’s just around the corner, so it takes constant preparation and constant planning,” he said. “And taking a look at risks more broadly as opposed to just crisis management arrangements, I could see a situation where some organisations may find it more attractive to deprioritize high-impact, low-probability risks because they haven’t got the resources to manage everything.”
This is where a more integrated approach to risk and resilience can work wonders, he said. Because at the broadest level, when doing resilience planning, the concern is not as much the individual risk as its potential impact on your organisation. Looking at the risks on a risk register, there aren’t that many different types of impact so organisations can manage a lot of those high-impact, low-probability risks through good preparation and good resilience planning.
“But you need a mind shift away from assuming that those things will never happen towards one that is more open to a future that where these risks will happen, hopefully not frequently, but they will happen,” he said. “And if we get to that point, then we will place more effort and more emphasis on being prepared for a broad range of events.”
A good example of this integrated approach is currently playing out in the regulatory environment, he said. Both the FCA and the PRA’s approach to operational resilience in the banking sector is centred on encouraging banks to assume that disruption will happen and plan accordingly, a powerful shift that other industries would also benefit from. Evaluating what the future for resilience thinking looks like in insurance, Crask said he believes that the future looks pretty bright.
“The reason for that is because we have a hugely increased profile,” he explained. “And we’ve got senior people plugged into and actively asking for support on these kinds of issues. Because of both of those things, it’s attracting more investment. More investment means employing more people, more people equals diversity of thought, which equals continuing to evolve the thinking further. So, yes, this is a good place to be at the minute.”
