Damage limitation: dealing with disaster

Change / 01 May 2010

When disaster strikes, are you ready to respond or do you panic like a rabbit in the headlights? Drawing up a risk management strategy and developing focused counter measures is essential if you are to avoid a catastrophic outcome, says Cath Janes

Being in control goes with the territory when you rise through the management ranks. So imagine if that control was ripped from your hands by a disaster of headline-hitting proportions. Suddenly, you’d have all the responsibility but no say, you’d be forced to make tough, public decisions and you’d be first in line come the fallout. So is it any wonder that risk management has become a must-have for managers?

 

If you aren’t switched on to how risk management can help your business, you’re missing a trick. It can make you look at how the business works which in turn helps you deliver better processes, become compliant, avoid disruption

Paul Hopkin, technical director, the Association of Insurance and Risk managers

It goes without saying that business is risky. You don’t need to look much further than the recession for proof. But risk management starts when you stop leaving that risk to chance, understand how it could affect your organisation and what action you will take should disaster occur.

Look at the global flight chaos in the wake of the Icelandic volcano, Toyota’s mechanical failures and the damaging blaze on the Cutty Sark mid-renovation. Each has had a devastating impact upon the businesses, as well as the lives involved, and risk management can go far in mitigating that impact.

“How a crisis feels doesn’t hit you in the heart or gut until it happens to you,” warns Mandy Rutter, clinical consultant and business manager at Axa Icas, the risk management specialist. “We’ve dealt with companies struggling with the impact of the London bombings and retailers whose employees had guns held to their heads during raids. So risk management is about looking at the potential of a crisis and being ready for it.”

Live and learn

It isn’t control freakery. Businesses face risks that are sudden, unpredictable and beyond anyone’s control. What can be controlled, however, is your response and that can make or break your survival.

In fact, implementing risk management could be the difference between a disaster-struck CEO being a decisive and reassuring leader or a dithering and panic-stricken fall guy. Which would you rather?

“Small businesses internalise risk because it is part of what they do,” says Carolyn Williams, head of thought leadership at the Institute of Risk Management. “Yet, as a business gets bigger, it needs a more formal process because functions and responsibilities become divided. Some sectors are great at this, such as nuclear industries or food security, but others are not and it is only when something goes wrong that they understand the value of planning.”

One man who can vouch for that is Stephen Archer, director of business consultancy Spring Partnerships. As former communications director of the Cutty Sark Trust, Archer handled the devastating fire that struck the ship in 2007 when the £23m project literally went up in smoke.

“We just weren’t prepared,” he says. “There were contingency plans for restoration, construction or funding problems but not for anything on this scale. It was the biggest crisis I have ever had to deal with.

“Looking back I think we handled things well. We decided to engage with the media, never issue a ‘no comment’, open dialogue with stakeholders and face the problems the fire raised.

“It taught us so much about how to react to such extreme circumstances, though, and it also taught us the speed with which events can take over. We had to work and even run 24/7 and that’s when you see what good risk management is all about. It’s not an experience you’ll ever forget.”

Risk list

So how do you put risk management into practice? Far from being a bolt-on it needs to become part of the business culture. It must be supported by every employee as well as led by example from the top. It also needs to have its foundations in a policy which outlines tangible responsibilities for every employee as well as accountability and definite procedures to be followed in the event of a crisis.

Central to all of this is the risk register, a living document that prioritises the risks a business faces along with the likelihood of them occurring, the type of risk involved, the severity of potential impact, counter measures and the employee responsible for managing this risk.

David Law is the chief risk officer for the Olympic Delivery Authority (ODA) and is responsible for managing the potential pitfalls facing the 2012 Olympic Games. “Our overall Olympic programme has 35 projects and each of those is led by someone who identifies and manages their risks. We, at the top, then engage with those risk functions to mark thirty or forty priority risks before looking at the top twenty in depth to keep an eye on them.

“One of our greatest issues is our deadline. There is no flexibility in the date of the Games so we manage the risk of timing issues by incorporating a cushion into timescales. So, if we have 1,000 days to complete a project, we aim to do it in 950 days instead.”

All of which raises several issues. Firstly, the ODA’s risk register is the granddaddy of all risk registers and usually the size of this is proportional to the business. You’re not going to implement measures against terrorist attacks if you’re a one-man band. It also raises the question of whether risk management is just common sense.

It’s true that we consider risk every day as a matter of course, so does this need to be formalised? The answer is yes if you want to secure the future of your business, believes Paul Hopkin, technical director at the Association of Insurance and Risk Managers.

“If you aren’t switched on to how risk management can help your business, you’re missing a trick. It can make you look at how the business works which in turn helps you deliver better processes, become compliant, avoid disruption, limit operational risks, protect buildings, protect staff and plan for how you will function in the future.

“It needn’t be onerous and it gives you the foresight you need to survive. It’s the biggest lesson to come out of the current global crisis. It really is only when the cards fall around you that you realise how strong your ability to manage risk really is.”