Tuesday 6 October 2020

Five Lessons for Operational Resilience from Covid-19: The Goldilocks Approach

Earlier this year, Crescendo Advisors undertook a survey of the insurers’ lessons learnt from managing Covid-19 disruption.  This was based on in-depth discussion with 24 senior stakeholders with a turnover of about £120bn.  We covered readiness before Covid-19, how the crisis was managed and lessons for the future.

In parallel, regulators were consulting on requirements for operational resilience.  They do not plan to require firms to meet them before the end of 2021.  This is then the time to think in earnest about implementation.  One aspect of the requirements is learning from events like Covid-19.  We thought that we would review our findings and identify what we can learn for the implementation of operational resilience. 

Broadly speaking we identified two contrasting views.  Some saw Covid-19 as an unprecedented event and thought that there was little that could be learnt for the implementation of operational resilience.  Others were concerned that the industry’s success at keeping the show on the road could give an impression that operational resilience is not an issue.  We do not subscribe to these views and identified five practical lessons, which is more consistent with the Goldilocks approach – not too little, not too much.

Lesson 1:  Do not assume that you will get the same advance warning for the next operational resilience event  

While few firms anticipated a pandemic of the scale of Covid-19, firms had a 6 to 8 weeks before lockdown to prepare, which many used very well to prepare for the inevitable lockdown and social mobility restrictions that were anticipated.  Our survey suggested that industry readiness would have been very poor absent these preparations. 

Looking ahead, it is unlikely that in the type of operational resilience scenarios that are more likely in the future, e.g. system failures, firms will have such a luxurious amount of time in which to enhance your resilience.

Lesson 2: Invest in crisis management as part of operational resilience preparations

Operational resilience requirements rightly focus on governance, planning (identification of key business services, setting tolerance and analysis of resilience in severe but plausible scenarios), and enhancing resilience where it falls below the agreed tolerance. 

However, when an operational resilience event takes place you will also need a well-oiled crisis management capability.  Participants who chanced to have tested crisis management capabilities before Covid-19 noted the benefits from that.  It is important to review and test your crisis management capabilities (e.g. war games) as part of the implementation of operational resilience. 

Lesson 3:  Working from home (WFH) is useful but challenges your potential back-up

The ability to work from home was a key aspect of the response to Covid-19; at the same time recovery sites proved to be not very useful in this scenario.  This has also led to a wider discussion about the role of the office and the possibility of home being the new BAU. But if WFH is the new BAU, what is the back-up for the next operational resilience event? 

Lesson 4: Think about scenarios and stress testing in an integrated manner

While insurers considered scenarios before Covid-19, few anticipated a pandemic of this scale with all of its financial and economic implications.  Looking ahead at the development of scenarios for operational resilience, this raises a challenge about the importance of consistently considering the financial and operational implications of scenarios in ORSA and operational resilience.

Lesson 5: Outsourcing of key activities is likely to be a challenge for operational resilience

Participants identified outsourcing as an area where they would like to spend more time monitoring performance.  Where outsourcing was material, the experience of Covid-19 was mixed. Interestingly, good performance during Covid-19 in outsourcing was associated with a business rationale going beyond cost savings or managed as an integral part of the business.

These are industry lessons.  But what lessons can you extract from your own business experience of managing Covid-19?  We encourage you to formalise the lessons learnt exercise.  You may learn something new or unexpected about your business. But more generally the exercise can inform wider decision making; one insurer had a clear vision that their Covid-19 lessons learnt should feed into a strategic review. At the very least it will support your operational resilience planning and delivery.

This post has been written by Isaac Alfon (Managing Director) and Shirley Beglinger (Advisory Board Member) from Crescendo Advisors.  It is based on a presentation to ORIC’s Covid-19 Industry Group.

Crescendo Advisors (www.crescendo-erm.com) is a boutique risk management consultancy.  We would be happy to share an overview of the findings from the Covid-19 lessons survey.  We can also support your efforts to both learn lessons from Covid-19 using the tools we developed for this survey and implement the regulatory requirements for operational resilience.

Photo by João Cabral from Pexel