“Expect the unexpected”. Never has this been more relevant than in 2023 where the world continues its pandemic recovery, yet new challenges present themselves as we see conflict in Eastern Europe and, post Brexit, the UK faces a shortage of labour putting incredible pressure on certain sectors where staff are already nearing breaking point. Being prepared for risk builds resilience across an organisation yet many emerging risks were not predicted and this disrupts the traditional model of risk identification, mitigation, management and transfer. Matt James, client director – head of education at Aon, explains how organisations can respond as risks morph and new threats emerge.
COVID-19 was a huge wake-up call for many organisations. As much of the world was forced unexpectedly into lockdown, it made everyone think about their risk exposure and the importance of resilience.
Resilience is all about ensuring an organisation can cope with risk, whatever form it takes. It requires an organisation to be aware of current risks but also alive to new ones that may emerge, whether that’s a pandemic, an extreme weather event, a cyber attack or something we’ve never seen before.
As well as constantly reviewing and updating the risk register, resilient organisations are agile and able to adapt their plans as a result of new threats. Acknowledging a new risk and exploring how existing risk and insurance programmes may be affected is key to being prepared and resilient.
The pandemic is a perfect example of a risk that came completely out of the blue but, even as normality returns, we’ve seen a handful of risks emerge that few would have anticipated. These include the war in Ukraine, the energy crisis and widespread industrial action. Adding these – and any new risks as they emerge – to the organisation’s risk register and adapting business continuity planning and insurance cover to minimise their impact is essential.
Power cut
To illustrate this, we look below at the potential impact of power outages and energy disruption as an example. Over the past six months, we have worked with some of our clients, including in the higher education sector, around how a power outage might affect them and whether their insurance would transfer any of this risk.
With this risk, there are two key considerations:
- Proactive risk mitigation to avoid interruption if power is cut or rationed
- Potential transfer of risk to insurance policies
Risk mitigation
Your risk mitigation process should ensure your business continuity plans are updated to account for a power outage scenario. This will take into account immediate risk mitigation measures but also longer term strategies that could help to manage the risk.
For the immediate measures, consider the potential effects of a power outage. What might the losses be? How much could be salvaged and for how long? For example, well-insulated freezers and fridges have some resilience but it does vary so be sure any plans include this information.
This exercise should also identify critical services, such as freezers for ongoing research projects or sleeping accommodation for students in any properties you own or manage. These services will need to be prioritised in any plans.
Longer-term strategies to tackle this risk involve installing back-up power. This is something we have explored with establishments, although demand means there can often be significant waiting times for electrical engineers to carry out this work.
Similarly, organisations investing heavily in solar and battery back-up power to take advantage of the faster pay-back period due to higher electricity prices, are encountering lead times of up to 18 months for installations.
This risk mitigation process can lead to cost/benefit exercises to explore some of the new operational costs an organisation faces and inform decisions around where investment is made.
New business continuity plans should also be rehearsed. This will stress test them and enable you to make any necessary changes.
Risk transfer
The other part of building resilience is risk transfer to insurance policies, although this is often considered the last resort. Organisations face many risks that will be uninsured, making robust risk mitigation the key part of any resilience strategy.
Power outages are a good example of this. Whether or not insurance cover would respond depends on the nature of any power outage. Where it’s a deliberate act by the government or power companies to restrict or ration supply it’s unlikely to trigger the material damage or business interruption sections of policy wordings.
Where the power outage leads to an insured peril such as a fire, cover would be down to policy interpretation. This could get incredibly complex.
In these instances, it may be more prudent to treat this risk as uninsured and to apply a heavier weighting on risk mitigation strategies.
Remaining resilient
Ensuring your organisation is resilient is a continuous process. The energy crisis could turn out to be a nonstarter, forgotten as something nobody even considered emerges to cause disruption.
This constantly evolving risk landscape means it’s essential to horizon scan and be prepared for anything that may emerge. And there’s no one-size-fits-all approach to this: every organisation is bespoke, both in terms of the risks it faces but also its critical services and priorities.
To understand the risks and the critical services across the organisation, risk managers must be engaged with every department. These connections help to identify potential risks at an early stage as well as giving greater insight into the risk mitigation measures that can protect the organisation.
Involving representatives from across the organisation in business continuity planning also helps to build organisational resilience by creating a culture where risk is proactively managed.
The pandemic and recent energy crisis has shown us that it’s impossible to predict what risks the future may bring but, a robust approach to risk management and business continuity planning can create a culture where the response to a new risk is fast and effective.
More information
Aon can support your business continuity planning and risk management exercises to help your organisation build resilience. Speak to your account manager or contact Matt James at [email protected] to find out more.