Reducing Risk Should Start with Crisis Management
All commercial and public sector organisations are required to reduce the risk in their operations at all levels- on the factory floor, in the distribution depot, at the retail outlet or in the community service building. Yet the list of risks faced by organisations today is growing and includes fraud, technology failures, sabotage, terrorism and increases in ‘compensation culture’.
The regulators of many industries- the Civil Aviation Authority (CAA), the Financial Services Authority (FSA), the Federal Office of Communication (OFCOM) et al- are duty bound to ensure that they set appropriate guidelines to ensure that risk is minimised across organisations over which they have jurisdiction. For example, the identification and measurement of operational risk is a real and live issue for modern-day banks, particularly since the decision by the Basel Committee on Banking Supervision (BCBS) to introduce a capital charge for this risk as part of the new capital adequacy framework (Basel II). The British standard on business continuity BS 25999 is a more generic standard that establishes a process that helps manage risks associated with the smooth running of an organisation or delivery of a service, ensuring continuity of critical functions in the event of a disruption, and effective recovery afterwards.
For banks and other financial institutions, Basel II extends the definition of the management of risk from market and credit risk to include operational risk, which it defines as the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. Such risks extend from the bombings of 7 July in London, to the losses suffered by rogue traders, for example at Societe Generale and Barings. Globalisation and deregulation in the world economy, and particularly within the financial markets, combined with increased sophistication in financial technology, have introduced more complexities into the activities of banks and therefore their risk profiles.
Add into the mix strategic and reputational risk, which is the risk associated with a bad decision and the loss of standing in the public eye thereafter, such as BA’s Terminal 5 problems, and you have such a broad range of potential losses that getting a handle on them all and accounting for them is a truly daunting task.
There are a number of tools that can help in assessing and managing risk. These include software for:
Which of these is the most important? All are significant but the latter is the most important. Planning tools take time to implement- and a crisis could happen tomorrow. Having tools in place to minimise the impact of a crisis when it strikes seems the most logical first step. Crisis management tools allow banks and other organisations to ensure that the crisis team, which will include senior management whose day job will be generating millions of pounds profit for the bank, are up and running very quickly, completely aware of their duties when an incident happens. It will also help to ensure decision-making is based on factual information, not rumour or conjecture, and accelerate the decision making process, plus reduce issue resolution time. Additionally, it facilitates a consistent means of capturing and distributing vital information across departments, offices, and geographies, and provides evidence to internal/external inquiries and for demonstrating to regulatory bodies the effectiveness of their crisis management processes. It also assists in the drive to meet British and international standards and gives tamper-proof audit trails that can be used for organisational learning and feedback into crisis plans.
This last point, learning lessons from past mistakes, is very important. In early January 2007, senior executives at BP were left reeling at the criticism of its procedures at American oil refineries following an explosion at the firm’s Texas City refinery, which killed 15 people and injured 180 in 2005. On the day of the publication of the ‘Baker Report’, which BBC business editor Robert Peston called “very meticulous and extremely savage”, BP’s shares fell by 1.5%, wiping more than £1.5bn off the value of the company. Four days after the reports publication, BP announced that Lord Browne would stand down as chief executive, 18 months earlier than initially planned. One major criticism in the report was BP’s failure to learn from past mistakes, notably those from its Grangemouth facility in Scotland, which date back as far as 2000. In the early summer of that year, a series of dangerous incidents occurred including a fire and a power failure which disrupted production.
Banks have sophisticated continuity processes and crisis plans in place. However, in our experience, they rely on more traditional systems and processes- phones, whiteboard, flipchart, or email- to manage a crisis. These can be inefficient and hinder the distribution of vital information; things can get lost or details may not get passed on. The inability for all members of an incident management team to effectively share information and collaborate can seriously impact its ability to respond effectively. What is required are systems that facilitate the easy collection and distribution of information, in order to facilitate an effective decision-making process in emergency situations.
Catastrophic or not, during an incident it is vitally important that senior executives, departmental heads and the crisis management team can quickly and effectively assimilate all the facts in order to make the best possible decisions in difficult circumstances. When time is of the essence, easy access to accurate incident records is paramount. As information is gathered, it must be validated and distributed to staff on a ‘need to know’ basis, without delay, so that action can be taken. Tools such as these are vital to the recovery of a business and to ensuring that lessons are learned.
It might be impossible to mitigate against all risk in the operations of business and the delivery of public services. When things go wrong, however, it is important that organisations have the best tools to help their crisis teams to speed up the recovery of the business, and to learn lessons so that bad practices are not repeated. The latest software can help achieve this and its use should be an integral part of any crisis management plan. Its adoption can lead to the protection of corporate and executive reputation and, most importantly, highlight operational deficiencies that can be eradicated, thereby preventing the recurrence of past mistakes.