IRM Covid–19 Global Risk Management Response by Institute of Risk Management

Institute of Risk Management

Institute of Risk Management Covid–19 Global Risk Management Response Resilience, Risk & Recovery

Contents Foreword

Introduction

Sector impact - from IRM’s network of SIGs Charities SIG

Cyber SIG

Energy SIG

IOR England & Wales Chapter – perspective from IOR/ Operational Risk

Financial Services SIG

Health and Care SIG

Infrastructure Risk SIG

Nuclear Industry SIG

Operational Risk SIG

Risk and Complexity SIG

World view - IRM RIGs and Global Ambassadors Cambodia, Vietnam and Laos RIG

China

East Africa RIG

India

Ireland RIG

Pakistan RIG

Qatar RIG

South Africa RIG

United States of America

IRM Qualifications

Foreword The role of risk management is to help organisations achieve their objectives in an uncertain world. Firms everywhere are obliged to report on the principal risks to their business, and what they are doing to mitigate them. In 2020 the world has been turned upside down as a long observed, although perhaps insufficiently managed, risk – global pandemic – has become a massive live issue. The Institute of Risk Management (IRM), which educates the world’s risk professionals, recently conducted a survey of its global community to find out how the profession viewed the crisis. Nearly one thousand people worldwide, from all sectors and regions of the world, responded. Please click here to see the report. The survey found that 98% of respondents were still working in their risk roles, indicating that risk was considered a function that could and should be kept going at full strength when organisations come under pressure. Accordingly, 94% of respondents believe that the current pandemic experience strengthens the case for risk management. Those who have studied or trained with us will be familiar with the principles, tools and techniques of risk management, business continuity and crisis response that can be deployed to help organisations prepare and respond to situations like this. This document adds to the survey, we’ve asked our global network of Special Interest Groups (SIG) / Regional Interest Groups (RIG) and our Global Ambassadors for their on the ground view of what’s happening in their sector or region. I’d like to thank them all for taking the time to send us their valuable contributions. Preparedness is key, effective risk management and business continuity plans now kicking into place will play a pivotal role - some less risk mature organisations will be in unchartered territory which will sadly, inevitably, lead to some businesses folding as has been widely reported. Many companies do not survive a moderatesevere global risk event like the Covid-19 virus. We are now deep in a phase of response and recovery. As risk professionals we are skilled at framing and understanding these difficult policy choices. One of the challenges for risk managers will be to ensure there is a balanced, proportionate and common sense approach. A core principle of risk management is to learn from experience and improve; there will be lessons from the experiences of dealing with the challenges of Covid-19 which will result in improved resilience and better risk management in the future. Professional risk management will deliver the resilience that organisations will need to emerge and recover from the pandemic crisis, the role of the risk manager has never been more important. Stay well and safe. Iain Wright, CFIRM, IRM Chair

Introduction I’d like to thank all the IRM RIGs, SIGs and Global Ambassadors, whose responses are outlined in this report, for devoting their time and energy to provide these very valuable and thoughtful insights, and in such quick time. As with the global survey of members which Iain mentioned above, this survey of the IRM RIG and SIG leads highlights the very important role that people in the risk profession are playing in managing the Covid-19 pandemic and its impacts. From their engagement in the initial phases of crisis management and business continuity response to their current involvement in scenario assessment and planning within a Covid-19 and post Covid-19 world, risk professionals are demonstrating their value. Risk professionals are trained to have an enterprise-wide, and indeed an industry-wide perspective which appreciates complexities and interdependencies, and this perspective has been invaluable in the current environment. I’m very proud to know that the IRM is unique in being able to capture the views and perspectives of risk professionals worldwide. We continue to encourage the sharing of good practice and knowledge through our network of RIGs and SIGs worldwide and I hope this survey provides some valuable insights, lessons and ideas for you and your organisation.

Rahat Latif Chair, IRM Special and Regional Interest Groups Committee

The views expressed in this document do not represent the IRM as an organisation but the authors in their professional capacity. 4

Sector impact - from IRM’s network of SIGs Charities SIG Roberta Beaton of the Nursing & Midwifery Council, Steve Brown, Alzheimer’s Society, Alyson Pepperill, CFIRM, Arthur J Gallagher and Anita Punwani, CFIRM, IRM Director The immediate impact of Covid-19 revolves around loss of fundraising channels leaving charities unable to deliver vital/core services (sometimes in place of government), through to charities having to postpone funding programmes and divert existing funds to the Covid-19 response. Whilst the NHS and other ‘emergency’ charities are doing well from people’s generosity, major charities that rely on face-to-face fundraising and/or income from charity shops have dwindling revenues. Major charities like Cancer Research have announced that their research will be set back by years. Charities are in a precarious position. While public trust is improving due to the sector’s response to the crisis, many feel the pinch and can do little to counter the circumstances. Key considerations are: > Whether staff are furloughed, working from home, or continuing to work face to face with people, how to support and manage their health, safety, and wellbeing is a top priority > Planning to recover to the ‘normal’ will involve similar considerations > Re-setting strategic planning and budgets for the new normal in a very changed landscape > The impact on volunteers (often in high-risk groups) and staff with children if there is a new surge The sector plays a major part in supporting vulnerable people, as well as the wider community. There have been some remarkable success stories, for example, the Nursing & Midwifery Council mobilised a remote workforce in days (including contact centres), amended regulatory rules, deprioritised non-essential services, and recruited thousands of retired and student nurses to the NHS. Other examples: > Alzheimer’s Society switched from face-to-face to online support (e.g. Singing for Brain choirs) > Others offer online creative and wellbeing support > The Samaritan’s and Mind increased capacity > The Trussell Trust ramped up foodbanks Charity risk managers have stepped up and with a ‘can-do’ attitude, skills and networks supported the sector response. Going forward, risk management will be an essential part of long-term planning, as well as playing a greater role in organisational preparedness and crisis management.

Lessons learned: > An increased emphasis on continuity planning, IT testing and training is important. How quickly and successfully you respond to a crisis is often down to having a process for making decisions at pace > Smaller charities will benefit from access to greater support on continuity planning from sector bodies and others > Regular communications are vital to ensure stakeholders understand the response. Regardless of size, understanding your stakeholders is critical and our website contains a useful guide to Stakeholder Mapping As a risk professional, you have techniques to draw on to support the organisation amid the crisis and to take it into recovery mode. You have the confidence to offer opinions and guidance and act as a subject matter expert. You understand the complexity and interdependencies of risks and how to assess impact across the organisation not just in a departmental silo. Sadly, some charities will not survive Covid-19, and others may need to make significant changes, so the future sector landscape may well look very different. The landscape is likely to involve more competition, a reduction in services, and changes in societal trends. Those that survive will need support from funders to continue in what will be an economically challenging environment, which may well lead to the scaling back of strategic ambitions.

Cyber SIG Magdalena Woloch, CFIRM Cyber risk a key heightened risk during this pandemic and is showing up in Board packs in Q2. Many companies are in the process of assessing their cyber risk profiles in the full work from home operating environment which seemed to have happened overnight. Activities including trading, customer service, recruiting and financial statement preparations are all being done from home. Although working from home wasn’t entirely foreign, it was never so wide spread and in many cases was not considered (or tested) in business continuity plans. There are some notable risks that have come to the forefront of the cyber risk conversation: > The increase in volume in working from home, has created many vulnerabilities as many firms acted quickly to get the hardware availability in a short period of time to enable business as usual to continue as seamlessly as possible. Most cyber security programs were already mature due to the heavy regulatory focus, but vulnerabilities have been found. The volume and nature of malware and phishing attacks is one of the key concerns. IT security functions are taking action by increasing their own internal campaigns to ensure staff make active decisions around their clicking activities > The United Kingdom’s National Cyber Security Centre (NCSC) and the United States Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) has issued a joint advisory warning that “an increasing number of malicious cyber actors are exploiting the current Covid-19 pandemic for their own objectives. In the UK, the NCSC has detected more UK government branded scams relating to Covid-19 than any other subject.” Although they also state from the data seen to date, the overall levels of cyber-crime have not increased > The constant need for communications through meetings, catch ups , quizzes and even weddings has shown a huge opportunity for growth for online communication platforms like Microsoft Teams and Zoom. These security platforms are being closely and publicly scrutinized for their security capabilities as companies and people privately adopt the platforms > In the social media landscape, we are seeing campaigns of misinformation about the virus. Facebook, Google, LinkedIn, Microsoft, Reddit, Twitter and YouTube have issued a joint statement that they are “jointly combating fraud and misinformation about the virus, elevating authoritative content on their platforms, and sharing critical updates in coordination with government health agencies around the world” > Third party and supply chain cyber risk has also been a popular topic over the last few years which has is also heightened. We can liken this issue to the need for everyone to wear a protective mask to protect others they connect with from catching the virus With this increased risk, IT cyber security teams are working around the clock to ensure that risks are mitigated. As we aim to ensure we are protected, we continue to innovate and use technology to help solve problems. Opportunities for innovation have appeared most notably in the tracing apps that may soon be worldwide in their use, these especially have cyber security related challenges. Challenges such as the European Commission lead #EUvsVirus aiming to develop innovative solutions for Coronavirus related challenges are also appearing and may prove to be helpful. We will soon see how the world will change post this crisis, cyber and technology will surely be included as a notable risk and opportunity from which will see many lessons learned.

Energy SIG Alexander Larsen, CFIRM, Chair The energy industry has been heavily affected by Covid–19 over the last few months. With many organisations having supply chains which rely heavily on countries which have been significantly impacted by Covid-19, as well as relying on people working remotely and on shifts (including fly-in / fly-out), it has become increasingly difficult to meet the challenges of progressing projects and maintaining operations at optimum levels. The lockdowns globally have also seen a major decline in demand for oil and gas which has resulted in an unexpected demand shock, placing downward pressure on prices. The decades-low price levels we are currently witnessing are compounded by the problem of an additional fall in oil price due to the recent OPEC+ group failing to agree on managing output (whilst there was finally an agreement, oil prices have since continued to plummet and have seen negative values for the first time in history). According to a recent survey conducted by the IRM Energy SIG, when asked which events energy companies have been most impacted by over the years, Covid-19 and the current oil price slump came out on top. When further asked what has been impacted the most, respondents highlighted three key areas including completion of existing projects, major financial loss and as a result, potential viability of the organisation. Additional concern comes from the fact that the previous economic crisis of 2008-09 was considered the third most impactful event in recent times and with a crisis of similar or greater magnitude expected to hit again in the coming months. With this in mind, the energy industry is facing three of the worst events of modern times all hitting at the same time. This does not bode well for the remainder of the year and all expectations are the impacts will continue to be felt into 2021. Risk managers are important now, more than ever, and need to step up to the plate and show their value in helping organisations survive and thrive into the future. For a start, risk managers need to be considered a critical part of decision making, providing management with up to date risk information in order to improve the quality of decision making. This may include identifying KRI’s specific to the current crisis that should be monitored closely over the coming months. Quantitative Risk Analysis should be conducted where possible in order to support decision making too. With projects being impacted greatly, it is also down to project risk managers to ensure that value engineering and risk management activities continue to work on solutions to move projects forward. Organisations need to prepare for recovery too and risk managers also play a vital part in supporting the strategic planning process (whether it be diversification, re-invention or cost cutting) by running scenario workshops, identifying risks to any proposed strategies and undertaking risk analysis of those strategies (providing an indication of likely deviations from the plan). Risk managers can even set Key Opportunity Indicators providing management with the optimal time for purchasing, starting up projects, or entering new territories, something that management rarely receive from a risk management department and may help in changing perceptions from that of risk management as the bearers of bad news, to a more positive view. Certainly, based on the recent IRM energy survey, 90% of companies plan on revisiting and updating their risk management and business continuity plans for the future, indicating that companies realise now, more than ever, the importance of risk managers. Risk management is more than just process and procedures. It requires various skills (quantitative analysis, presentations, facilitation, communication, culture building), knowledge (global standards, risk management approaches, organisation) and experience (industry, risk, major events). Having the right training, education and hands on experience equips risk managers with the necessary tools to excel in these times of crisis. Additionally, networks of risk managers gained through training and education also ensures there are always other experienced professionals to continue to share and learn from.

IOR England & Wales Chapter – perspective from IOR/ Operational Risk Dr Jimi Hinchliffe, Chair Covid–19 has had a truly global impact, highlighting the interconnectedness of the modern world. It has caused both supply-side and demand side shocks. The supply side may recover relatively quickly, but demand may take time to recover as big increases in unemployment, businesses failures, and a general loss of consumer and business confidence will supress demand for the foreseeable future. A longer-term consequence of the Covid–19 crisis may be increased fragmentation of the global economy as countries become more inward looking and seek to build increased self-sufficiency. Increased fragmentation may impair the recovery from the economic damage caused by the Covid–19 crisis. The impacts of the Covid–19 crisis on organisations are both direct (e.g. closure of premises, loss of staff capacity, home working etc) and indirect (on customers, suppliers and vendors). With social distancing measures set to remain for some time, firms will have to adjust to a ‘new normal’. Until such time, firms will have to continue operating with a significant proportion of their staff working from home and manage heightened operational risk (including cyber, information security and conduct related risks). When staff do return to the office, they will need to find new ways of working that are consistent with social distancing requirements and may be faced with staff who are reluctant to return to work. There will need to be more collaboration, robust governance and careful management of concentration risks (including in third party suppliers). Maintaining operational continuity of important business services will be critical and firms will need to ensure they have ‘Plan Bs’ in place where the usual methods of delivery are not possible. Operational risk managers broadly considered the impact of a pandemic in modern times and the anticipated extent of the required cross-border and national government response. Many firms did consider pandemic scenarios and as such this is certainly not a Black Swan event as some have suggested. However, it’s clear that many firms considered the likelihood of a pandemic to be remote and did not anticipate the scale of impacts we’ve seen in many countries driven by an extraordinary policy response to Covid–19 e.g. shutting down entire economies and lockdowns. The retail banks also could not have anticipated being required by governments to develop and deliver emergency loans to millions of businesses temporary closed by the Covid–19 response, which exacerbated existing operational challenges of delivering core banking services with reduced staff capacity. However, whilst it would have been difficult to anticipate or predict the nature and scale of the Covid–19 crisis, and the government responses, these ‘radical uncertainties’, as coined by Mervyn Lewis and John Kay describe them in their recent book “Radical Uncertainties”, are inevitable and firms must ensure they are resilient to them. The trend of the last decade to remove redundancy and eliminate spare capacity on grounds of improving efficiency has made organisations more vulnerable and fragile to Covid–19 - like shocks. Boards and senior management, in partnership with Operational Risk functions, have a key role to play in improving operational resilience so that in future organisations can better withstand and absorb similar shocks. As was indicated in the recent IRM survey on the Covid–19 response: https://www.theirm.org/news/irm-survey-risk-management-response-to-the-pandemic/

Although firms could have done better in considering and preparing for pandemic scenarios (1/3 of respondents didn’t consider pandemics or anything similar as relevant to their organisation, and 1/5 of those who did consider a pandemic didn’t do anything about it), many firms, based on the survey, seem to have coped by using BCM plans and home working contingencies. Most firms in the survey established crisis management teams with Operational Risk Managers playing a key role. However, it remains to be seen whether we will see a spike in operational risk incidents due to the crisis, as intense pressure on firms’ systems, processes and people, coupled with less effective controls, including in relation to home working, increases the likelihood and potential impact of failures (including those due to weakened detective controls). Operational resilience was already a hot topic before the Covid–19 crisis and will dominate in operational risk for the foreseeable future. The UK regulators published proposals in December 2019 (following a Discussion Paper in 2018) which will have the effect of elevating operational resilience alongside financial resilience. This is not only a priority for regulators in the UK, but under the auspices of the Operational Resilience Working Group at the BCBS, will be a global regulatory priority. Delivering regulatory requirements and expected outcomes on operational resilience will require a partnership between operational risk functions and risk owners and should leverage existing frameworks and tools of operational risk management (rather than creating duplicative new frameworks and repeating the mistakes made by many firms in the UK on conduct ‘risk’ following the Global Financial Crisis). Covid–19 is causing impacts across the spectrum of risks, including operational, market and credit risk. A key learning from the GFC and Covid–19 is the importance of having a sound understanding of risk that is not siloed but holistic and integrated across all risk types. Operational Risk increasingly performs an umbrella role for Non-Financial Risk (NFR) by bringing together numerous risk silos, including regulatory compliance, people risk, financial crime, fraud, cyber and vendor risk management under an integrated and consistent risk framework with common language and tools. ERM in turn brings financial and NFR together under one risk umbrella under the oversight of the CRO. The IRM’s professional training courses in ERM are an ideal way to gain the necessary skills and knowledge that can then be applied in practice. The Institute of Operational Risk Certificate in Operational Risk Management (CORM) also provides an excellent foundation in operational risk management.

Financial Services SIG Maria Singende, IRMCert, Risk Manager at Barclays Bank and Keith Webb, Director of Consulting, Business Risk at Xcina Consulting As with most other industries, Covid-19 has taken no prisoners in financial services. The impacts are broad and varied. Financial and crypto markets in free fall, potential widespread credit defaults, insurers potentially forking out for business interruption or just general resilience issues especially where there are dependencies on third parties both local and foreign. Financial services firms are continuing to support firms and individuals, albeit in a very disrupted way, through transactional banking, savings, loans, insurance, mortgages, and complex electronic payments infrastructure that together underpin domestic and international activities. Let’s take a few examples. Banks are increasing the availability of loans while at the same time bracing for significant credit-card losses as cash-strapped customers may be faced with rising unemployment, furloughing, and salary cuts. Similarly, insurers are supporting customers while facing uncertainty around potential outlays for travel or business interruption. Some impacts may even create opportunities to further the digitalisation of current processes that have so far evolved slowly. In addition, governments around the world have announced significant emergency funding initiatives for people and companies. These funds will be distributed through existing electronic financial payments architecture. Covid-19 is testing how resilient the FS sector is. It remains vital for individual firms to assess their own capability and capacity for operational resilience and mitigation strategies. Firms have activated their resilience plans, triggering urgent risk responses to all risks, including ones in relation to third-parties which are critical dependencies for many firms. Key considerations include: operational resilience and business continuity; cyber-security and data security; and continued regulatory compliance. Enterprise-wide risk management frameworks in financial services firms have been instrumental in helping firms manage these considerations in alignment and to respond appropriately. For instance, banks have seen huge drawdowns on facilities. Risk managers with the right qualifications and experience are helping in the close monitoring of the risk profile to inform important decisions on risk appetite as well as what action to take around liquidity and capital adequacy. Risk assessments, monitoring and reporting have proven crucial for these firms. Firms’ contingency scenarios have never planned for something with so much disruptive effect. There are significant changes and challenges – some shared, some specific. Examples include: care arrangements for family, parents and children; remote working; virtual meetings; relative isolation; working arrangements; and working hours. As a result, banks are already facing massively increased demands for emergency loans. For example, NatWest (the UK’s biggest business lender) reported that they have received nearly ten times as many calls as usual from firms that are struggling.

The challenges faced by the FS institutions show that there are lessons to be learnt: > Alterations to resilience plans and the testing of them. This includes preventative measures and the capabilities in people, processes, technology and culture > A greater understanding of the dependencies around third parties and the sensitivities in relation to resilience strategies. This includes a clear understanding of key business activities and accurately identifying the key risks and mitigation strategies > The need to ensure there are effective frameworks to identify risks, set minimum expectations for controls, and plan for critical systems and processes failing eventually > The importance of maintaining adequate liquidity and having diversified portfolios > An understanding of the importance of front office activities, and the ability to quickly adapt to protect assets, employees and customers ensuring there is a good balance between automation and manual activities. > The need for highly skilled people with diverse specialisms and professional qualifications that bring pragmatic approaches to solutions

Health and Care SIG The current situation brings to mind a quote from Lenin: “There are decades when nothing happens, and there are weeks when decades happen”. It certainly feels like we are in the latter position, especially in the health and care sector. The major impact of Covid–19 on the health sector has been the requirement to prepare at great pace and with urgency for a huge and uncertain increase in the number of patients suffering from the virus, to ensure that they receive the treatment and care required, with reduced numbers of available staff, who have also been directly impacted by the virus. This has been undertaken in conjunction with maintaining other critical medical services, albeit some of these at a reduced level to provide the capacity to cope with Covid–19. It has required speedy development of contingency arrangements, for example, in the establishment of the new Nightingale hospitals and rapid reorganisations within hospitals, to provide additional capacity. Risks have also manifested in the supply chain, including in constraints to the availability of medical equipment, for example ventilators, and the provision of personal protective equipment to keep staff treating patients safe. There has been an increased emphasis on digital solutions (for example more use of online consultations and changes to the NHS 111 service) and the sharing of data in a secure, reliable and timely manner, to enhance the system’s response to the crisis. These same pressures are likely to continue over the next 3-6 months, at least, the extent being dependent on how the virus and its impacts develop, with the possibility of further waves of infection as the current “lockdown” is potentially adjusted. An important emerging area of risk already receiving attention is the number of people who may become seriously ill as a result of delayed treatment or identification of non-Covid–19 conditions during the current crisis and the capacity of the health and care system to provide the care required, especially in the event of further waves of Covid–19. There will necessarily be a review of how well we have responded to the crisis at a suitable point, including how well risks had been identified and managed, in which the effectiveness of risk management will be an important element. There are lessons to be learnt more immediately, in which risk managers can be of assistance, and if effectively managed will demonstrate the value of professional training in ERM. I would highlight the following broad risk themes requiring attention in this respect: > An increased emphasis on resilience and contingency planning, in particular supply chain resilience. > The consequences of financial disruption and a likely recession on the availability and prioritisation of funding; and on wider health outcomes > The impact on mental health of the actions taken to manage the current crisis, amongst health and care workers and the wider population > Consideration of methods to achieve a more integrated and holistic solution for the provision of social care > Impacts of the crisis on the provision of other medical services, for example, dentistry > Innovating to maintain the increased digitisation of health and care services > Increased requirements for the secure and timely sharing of reliable data, whilst continuing to protect the privacy of personal data > Balancing continuing pace in delivery with the operation of effective and proportionate control frameworks

Infrastructure Risk SIG Darren Mullan, CFIRM, Former Chair Obviously, the specific risks facing each construction project will depend on the nature, size and location of the project but, in general, three key risks will include: 1. Productivity Whether construction projects have been able to continue during the current Covid–19 crisis, or intend to recommence at some stage in the future, productivity will be affected for some time into the future. This reduced productivity may be caused by: > Reduced workforces being allowed onto to the construction site > Constraints on how staff access/egress, or move about within, the construction site > How welfare and canteen facilities are used > The introduction of different working practices to maintain social distancing The key area of uncertainty, and thus challenge for the construction projects, will be the understanding of and acting on: > The degree to which productivity is affected across different parts of the site/project > How long this impact will last > Probably most importantly, who will be liable for the cost and time consequences of both the impact itself and the recovery plan 2.

Supply of equipment, plant and materials

A second key risk will be the obvious disruption caused to the supply of construction equipment, plant and materials - especially as more and more of the construction supply chain is global. These problems could by caused by a number of potential issues anywhere across the end-to-end supply chain; for example the manufacturing factory may be shut due to local government regulations, maybe the goods are be sitting in a seaport or airport which has been similarly shut down, or maybe the equipment is still on a previous construction site and has not been released. Again the key challenge for the construction project will be to: > Accurately understand and forecast when current orders for delayed equipment, plant and materials will arrive > Explore potential mitigation, such as re-sequencing construction activities > Consider the potential for a Covid–19 ‘second wave’ and the need to pull future orders early, increase equipment leases, or increase local inventory levels for critical materials > Agree a revised Programme, and how to deal with potential extensions of time and who pays for any additional mitigation actions

Sustainability of the construction sector

The third, and arguably the most difficult to understand, risk is the impact on the longer-term sustainability on the construction sector, across contractors, engineering consultants, employers, etc. These impacts: > Will obviously include pressure on cashflow, ability to get finance and credit, and mobilisation of resources > Could affect current, as well as future construction projects > May be the secondary result of a problem on another project This risk is difficult to assess, and will probably have to rely on the use of early risk indicators/precursors such as: > Reported problems on other projects (e.g. where a party is late paying invoices or where a contractor is not fully mobilised) > Evidence of low staff retention, redundancies, or frozen recruitment > Delays or problems getting performance bonds and insurances However even if an area of risk is detected, mitigation options will be limited by the nature of the construction contracts. Across the three key risks listed above, or in fact other risks being caused by Covid–19, risk managers can help to tailor and apply the following advice: > Whatever role you have in the construction project (e.g. employer, engineer, contractor, project manager, etc,) and whatever type of contractual form you are operating under, it is important that all parties in the project proactively take steps to: > Inform each other of actual, or potential, impacts > Creatively consider what can be done to mitigate any impact > Respect the relevant clauses of the construction contract, when it comes to notifications, as well as assigning liability for extensions of time and associated costs. The key challenge is to foster the right behaviours and culture to support early identification, acknowledgement and mitigation of the risks. > The medium-term impacts of Covid–19 are still uncertain, and therefore it is as important as ever to use scenario analysis to guide initial recovery actions as construction projects emerge from the current crisis. As a minimum considering both the: > Best-case scenario, which may reflect a quick V-shaped bounce back to same conditions and environment prior to the Covid–19 crisis > Worst-case scenario, which may be a slow L-shaped recovery profile - maybe never fully recovering to

the conditions and environment prior to the Covid–19 crisis For each scenario, have a co-ordinated set of funded actions, but also have clear ‘go/no go’ milestones to allow all parties to reflect on how the recovery is actually taking place and allow you to review and adjust your planned actions. > Acknowledge that as we restore construction projects, the impacts of the Covid–19 may be lengthy and potentially enduring, and ultimately result in ‘new normals’, such as: > Revised industry-standard construction methods and lower productivity levels > The need for different suppliers, longer lead times, and locally-held inventory levels for equipment, plant and materials > Differing contract forms and constraints, covering issues such as performance bonds, insurances, invoicing terms and schedules, allocation of time and cost relief, etc. It may be appropriate to review and amend how risk is allocated within construction projects, both for future projects or possibly where current projects are still at an early stage. Ultimately if the risk profile has fundamentally changed, the allocation of this risk exposure may need to change if the longer-term sustainability of the project, and the commitment of all parties, is to be maintained. By using professionally trained and certified risk managers, organisations can assure themselves and their key stakeholders that: > Their risk identification, assessment and management tools and techniques are aligned with international best practice > The key risk management outputs, upon which key decisions will be made, will be robust > Any critical areas of uncertainty will be identified, so that appropriate confidence levels can be applied.

Nuclear Industry SIG Kathryn McCloghrie, CMIRM, Chair, Head of Corporate Strategy at Sellafield Ltd The nuclear industry has two characteristics which make it different from other businesses in this time of Covid-19. One is that nuclear sites are not things which we turn off and walk away from and the other is that the provision of baseload electricity is just as important now as at other times. For these reasons, our sites remain open and we have had to address the balance of risk associated with maintained minimum operations whilst minimising the risk to the workforce. We had business continuity plans in place for some critical activities, and we have mature emergency response and crisis management arrangements to respond to events. All of these have enabled us to respond promptly and prudently to the changing situation. We have worked hard to apply our knowledge and experience from control of radioactive contamination to managing the spread of the virus, both invisible and both potentially spread through touch or airborne particles. Unfortunately our sites are also quite small and congested and we have pinch-points for access control and radiological monitoring, making it more challenging to maintain social distancing. The industry is relatively small and tightly knit and we have global networks of operators who are very familiar with sharing learning from experience. These networks have been ready in unusual times to give us support and benchmarking opportunities. Nuclear sites also have close ties with their local communities, and we have been working closely with local resilience agencies to ensure that we can maximise our contribution. In the early days of lockdown, the supplies of PPE which we normally maintain have been carefully assessed so that we can release as much as we can to support local health services, whilst maintaining the appropriate levels for our own safety requirements. We also have large numbers of volunteers amongst our workforce, helping deliver services but also making PPE, and deploying some of our specialist skills. Examples include deployment of design capability to utilise 3D printing to manufacture PPE to meet the required safety standards and GIS mapping capabilities being deployed to help local responders. The fact that we are closely linked with local responders in business as usual times has made it easier for us to link into standard arrangements. We are largely working from home, meaning that we have had to increase our IT capabilities significantly to maximise the effectiveness of remote working; however when we return to a ‘new normal’ we will have learned a lot about how to make this work and understand where we might choose to make this a routine part of our business. In addition, as we re-start projects and plants which have been quiescent for an extended period, we will have different risks to manage and we are working hard on planning for re-start in a controlled and phased manner. Our risk teams are working with different areas of the business to understand the uncertainties and identify both threats and opportunities. We all know that the future will be different, although we don’t know what it will look like. Our risk professionals are contributing to scenario planning and horizon scanning, looking ahead to the period post-Covid and the threats and opportunities we may encounter.

Operational Risk SIG Paul Saunders, co-Chair The Operational Risk (OR) SIG has skewed membership towards the Banking Sector, which has seen well publicised and reported effects from Coronavirus. One thing we haven’t seen reported as much is how the sector is going to deal with being politically encouraged to shift its risk appetite. For example there will be businesses in need of finance (with or without government support/guarantees) that would not normally have met banking institutions lending policies currently in place. Whilst focusing on the Banking Sector, as alluded to above, the sectors ongoing financial support for businesses (negatively affected by the Governments restrictions to combat the pandemic) will need to go on for a sustained period of time. Potentially under terms that would have not have been normal for banking institutions before Covid–19, this in turn will put pressure on the Banking Sectors capital and operational processes. As a SIG that focussed on operational risk (and regulation), the key operational considerations we see are in respect of whether there will be a return to what we thought was normal working practices, or whether Covid–19 will have a lasting effect. For example remote working may now become the normality for some organisations, who have had to implement this and realised unforeseen benefits as a result. The role of OR Manager therefore is going to be brought more into focus as a result of this crisis, with a particular onus on Operational Resilience (including management of third parties). Thinking around this area of risk needs to be embedded in an organisations culture, to ensure that if/when another event with similar impact occurs, we have learnt the lessons from what we are currently working our way through. More information is available on the topic of Operational Resilience from the SIG chairs/members if required. It goes without saying that the more OR trained individuals there are in organisations the better, through the 1st, 2nd and 3rd Lines of defence.

Risk and Complexity SIG Michael Bartlett, co-Chair Covid-19 has clearly upset all our standard rhythms and caused disruption to physical plans - as well as anxiety to people affected by the explicit hazard or its indirect consequences. As a classic crisis management scenario, we have seen the phases of ignorance, disbelief, individual panic alongside organisational inertia, then over-reaction until a new (albeit forced) equilibrium is attained. The next few months remain uncertain: will the current state hold steady and evolve as assumed or are more seismic shifts to come? What is fascinating to see in the current state is that there are many opportunities to re-evaluate what is important and to benefit from shifting priorities. It will be interesting to see if there is a notable reduction in transport-related injuries and fatalities and what effect the reduction in pollution had on health and the environment. The simple delight of being able to walk around suburban streets without fear of being knocked over cannot be underestimated! There is a massive opportunity for individuals and organisations to reflect on what a new paradigm might look like rather than a reversion to pre-Covid plans and priorities. For infrastructure, this would suggest a radical look at the current philosophy of office working and creating energy-consuming infrastructure primarily for commuting. Over the last 10 years there has been a gradual shift to home working but our response to Covid-19 has demonstrated we can undertake far higher proportions of essential work without leaving our homes than previously thought possible. Surely this should influence transport plans to provide continued encouragement and hence reverse the spiral? Risk managers are well placed to use the next few months to facilitate scenarios for (a) how long the current state may last (b) how the current state could evolve (same, better or indeed worse - maybe a new virus strain emerges) and (c) what might the new paradigm look like for our business - how can we capitalise on what we have learnt so far? Secondly, our response to Covid-19 has illustrated that blind pursuit of capitalist growth where investment in people and support functions is pared to its elastic limit has not been the priority. It has become evident that we must invest adequately in the basic essentials and allow for some “redundancy” as much in organisational structures as in physical structures. This is a strategic parallel of the endemic risk management conundrum: what level of investment is prudent now to reduce possible future risk? At a macro-level, the risk management community has the potential to provide intelligent advice on the real risks of future paradigm-changing events whether Covid-2x, other low probability events or, probably more pertinent, the effects of climate change which is the longer-term catastrophe for all our societal norms. The other facet which professional Enterprise Risk Management (ERM) leaders are well placed to consider is how the Covid-19 experience might suggest a new way of risk management thinking. We can acknowledge that current methods which focus on a team’s subjective identification and evaluation of risk do not effectively consider generic risks or complexities/ interactions. An alternate approach would be a blend of three components: 1. A generic risk profile based on project characteristics 2. A specific set of true causal risks identified by project experts but evaluated by risk experts 3. A model of cumulative impact that reflects that the interaction characteristics of risks are far more influential than the discrete items themselves

World view - IRM RIGs and Global Ambassadors Cambodia, Vietnam and Laos Saman Bandara, SIRM, Global Ambassador Vietnam, being a country whose economy benefits largely from foreign direct investments particularly from Japan, Korea and the rest of the developed world (unfortunately, these countries primarily had a severe impact from the Covid–19), will start seeing the impact on its economy, in the short-run and long-run depending on how the above investing countries are able to manage the crisis, which is yet to be seen. On the other hand, it is worth considering the way in which the country has so far handled the crisis which I think should deserve a special mention and I also think they deserve a round of applause from the rest of the world to appreciate the efforts taken to contain the spread of the virus. Sharing the border with China and closer to Wuhan which was the epicentre of the crisis, and so far only with 326 cases as of 26th May, and not having a mortality so far with the grace of the God, Vietnam seems to have come a long way in managing the spread of the virus in its communities. As media reports indicate, and my own knowledge about the tough efforts to get people stay at home by other countries around the world, Vietnam was able to implement a very effective social distancing program which it was able to get people to embrace with relative ease thanks to the Government’s effective information sharing mechanism through digital media. Although the Covid–19 prevention and detection still remains a moving target as we speak, I would like to list the following factors that in my view have made Vietnam’s success in controlling the crisis to date: 1. Early actions by the Government by implementing a strong contact tracing program and a quarantine program with travel restrictions 2. Closure of schools at the early stage of the pandemic 3. Effective dissemination of the Covid–19 related information through digital media in order to the message to reach the public and the awareness campaigns over the digital media 4. Effective social distancing program that was implemented together with recommendation of wearing masks at public places Talking about the companies coping with the situation, most of the companies have taken the “working from home” concept seriously and also the efforts to maintain the physical distance at the work place by creating a flexible working arrangement without really implementing a full hard shutdown as per the recommendation of the Government. This particular mechanism ensured a continued functioning of economic activities without fully closing everything down to bring the whole economy to a halt. This is a time that tested the risk appetite of everyone including the authorities. This was an issue for which risk appetite had to be extremely small and sensitive. I think that the message was cascaded down by the Government to private sector who took that seriously at least from what has been seen so far. Everyone knew that this is a time where nothing can be taken for granted. Risk awareness of the countries around the world both in terms of public health and the economic impact was very well seen based on their responses to the crisis and the way in which countries have been able to manage the crisis so far. Economic impact on corporates is yet to be seen as the situation is still unfolding. It’s certain that the companies that had strong risk management practices would better be able to withstand the economic shock that was brought by the crisis. For example, companies that have robust risk policies may have bought insurance policies to cover business interruptions and such companies would be able to recover some of the losses from the event. 20

China Jason Qian, IRMCert, Global Ambassador The insurance perspective The ultimate financial impact to the general insurance and reinsurance sectors are still to be revealed in the next couple of months, subject to actual progress of the pandemic. Claims figures probably would be the most eye-catching. Traditional catastrophes are usually natural disasters and geographically contained. Impacts of Covid-19, direct and indirect, are globally disruptive across almost all economic sectors, which is accompanied by chain of reactions and evidently lasting for quarters. Consequently, some of the players might have to switch its core concern from P/L to protecting its capital, solvency or rating, subject to is net exposure linked to Covid-19. From top line perspective, negative premium impact is expected due to shrinking economic activities though there could be growth in certain lines like cyber risk due to increase of demand. For lines which still heavily rely on face-to-face interaction, decrease of premium would be purely because of long time lockdown. Another factor people need to bear in mind is the impact to investment return as majority of the sectors have now been impacted. Loss of operational effectiveness might also have long term potential impact. Certain strategic projects may really need delivery at the right time. The very first thing to consider would be the health and safety of employees and clients - should they have to come to our site for necessary services. As time goes by mental health of employees should be considered as important as their physical condition. Operational resilience: Being able to work and collaborate remotely via multi location – more specifically for Covid-19 lockdown scenarios is at the heart of many CEOs thought processes during this period. The insurance industry must maintain certain level of continuous operations, even at the most difficult times, as the clients may just need the services the most. This would be both internal technical investment and infrastructure and reliability of the basic network/3rd party services (e.g. WebEx). Cyber/data security is another concern when remote working becomes business as usual while traditional firewall and security countermeasures might not necessarily cover all the aspects of the “new normal”. Beyond that, COOs might need to balance between caring for employees and data security as some of the business data might have to be accessed on-site purely due to security reasons. Operational efficiency would be another consideration as people at least need to get used to the new working approach/environment and get the best out of it. Effectively, and efficiently, paying out valid claims would be the key for insurance industry to support the community, in particular for those small and medium businesses hit most by the pandemic. Also, we may realise that it might not be just pure financial support that matters during the crisis – e.g. you might not be able to get the essentials even if you have sufficient funding. The insurance industry may be able to further look into the loss/impact data it can collect from clients across sectors/territories and then work with communities/governments to see what kind of mechanism beyond funding itself that can be helpful for similar challenges in the future. This could be contingency supplies jointly supported by the industry, early warning mechanism as value-added service, etc.

East Africa RIG Dorothy Maseke, CMIRM, Chair On the 12th of March, 2020, Kenya became the 11th country in Sub Saharan Africa to confirm its first case of coronavirus. The Government’s response was swift and in a matter of days all public and social gatherings were banned, in-bound travel from high-risk countries was restricted, schools were closed, and within two weeks of the first case being reported, a dusk to dawn curfew was imposed. Shortly thereafter, movement restrictions into and out of high-risk counties, including the capital city, Nairobi, were imposed as measures to contain the spread of the virus. The Government’s response has indeed yielded some fruit, and 55 days after the Coronavirus outbreak was declared a pandemic, Kenya has had 490 confirmed cases, 24 deaths and 173 recoveries. However, the government still faces the challenge of compliance; not all are taking the government directives seriously. Such behaviours could jettison the government’s immediate response which was to delay the spread of the pandemic while giving it time to strengthen its healthcare systems. Like in many countries, the social distancing directives have also been costly to the economy at large, affecting production and demand across most sectors of the economy. The World Bank, in its latest reports, projects that Kenya’s GDP will decelerate in 2020 with the economic growth projections remaining highly uncertain at the moment. The report predicts a growth of 1.5% in 2020 in the baseline scenarios with a potential downside scenario of contraction to 1.0 % if Covid-19 related disruptions persist. The Central Bank of Kenya also expects GDP growth to contract significantly, revising its estimate for 2020 from the initial 6.2% to 3.4%. Aside from the Covid-19 threat, the horn of Africa is facing an extremely alarming and unprecedented threat to food security and livelihood due to the major locust invasion because it coincides with the early beginning of the long rains and the current growing season. The full impact of the locust invasion to the economy, yet to be fully confirmed and quantified, will only be appreciated at the next harvesting cycle. The effects of the pandemic are not monomorphous. The horticulture and floriculture sector is severely affected due to limited flights and reduced demand in major markets in Europe and Asia. Conversely, the vegetable and fruit exporters are experiencing a surge in demand due to harvesting disruptions in markets in Asia and the Middle East, but they are unable to meet this demand due to the decreased air freight which continues to be a constraint. Horticulture, floriculture, tourism and hospitality are major foreign exchangeearners and these sectors will continue to bear the brunt of this pandemic into the foreseeable future. Sadly, the most affected are the poorest and most vulnerable households. The government has to strike a balance between delaying the virus spread through the enforcement of restrictions while at the same time protecting the vulnerable populations, many of whom rely on small scale agriculture in the rural areas or work within the informal or “jua kali” sector in the urban setting. The informal sector employs over 80% of the Kenyan working population. The numbers reported so far are still relatively low compared to those in the developed world– an indicator that we might be suppressing the curve so far. While the outcome is far better than has been predicted by the various models run by experts, it remains difficult to predict the eventual outcome. What is for sure is that we have been disrupted. Is it all doom and gloom for Kenya? Certainly not! Although Covid-19 brings with it many challenges, it brings with it many new opportunities. Kenya boasts of being Africa’s Silicon Savannah, referring to its vibrant tech ecosystem. With a mobile penetration rate of 91% (compared with Africa’s 80% mobile penetration), internet penetration of 84%, a supporting ICT policy environment and the leading mobile based fintech platform on the continent, M-pesa, it is not a wonder that technology is playing a key role in ensuring resilience in this post-Covid era.

The government has initiated a cash-transfer mechanism to vulnerable households using the leading mobilebased fintech platform. The pandemic has also accelerated digital transformation initiatives within several sectors and industries with work from home and home education becoming the new normal. As pioneers in the mobile-money field, cash-less transfers and digital money is not new to us, and the pandemic has only deepened its adoption. As the effects of the pandemic appear to be subdued, as compared with other regions, there is an opportunity for capital flight to Africa for as long as we can ensure resilience. This subdued impact also presents our government with the opportunity to put our “house in order” and learn from the experience of external markets. We are in unchartered waters for sure. The extent of the impact of Covid–19 remains greatly uncertain in Kenya, and one is not able to predict what it will look like three or even six months from now. As a matter of fact, the elephant in the room remains this; will the impact of Covid–19 be health-related issues or more on the contagion effect of the economic shocks to the livelihoods of the Kenyan populace. The government, well aware of this, has worked on a raft of economic policies to cushion the vulnerable, and revive the economy when all this comes to an end. What are the key operational considerations for companies in your field? The main operational considerations are premised on two overarching principles. 1. Ensuring the health and safety of staff and other stakeholders 2. Ensuring Business Continuity for operations by taking necessary measures to effectively serve clients and mitigate negative impacts on planned business activities and cash flows Every other process that follows takes into account these two objectives. From my observation, I have noted that a key element of this exists in determining the minimum viable business model and that includes a determination of core processes, products and customer groups. This, in addition to ensuring that the organisation is able to serve the customer and support its staff through the various cycles of change brought about by Covid–19 is paramount. In a world of information clutter, getting out relevant, consistent communication is key to ensure that institutions minimise reputational risks. Acknowledging that indeed there may be difficulties in meeting the optimum operational needs of the businesses due to numerous constraints that the pandemic portends, consistent communication and managing expectations is key. Another important element is the strict health and safety requirements, including social distancing and higher standards of sanitation as well as other emergency response protocols that institutions are now expected to comply with. This goes beyond responsible business practices and established duty of care to now legal and regulatory obligations. Covid–19 should not have come as a surprise to an experienced, trained and qualified risk manager. Although its classification is contentious, it may not in my opinion, qualify as a “Black Swan” event being that such occurrences have taken place in the past and has been researched and documented as case studies in risk management academic material, including the IRM modules. One thing is clear; the risk manager is expected to be a trusted adviser in spite of these unprecedented times. He/she is expected to keep a level head and play an advisory role in a highly uncertainty environment. The risk manager is expected to have mapped out various scenarios and trained its institution on these mostly unlikely and sometimes absurd scenarios. The risk manager is expected to have worked out continuity and resumption plans as they help their institutions build resilience for competitive advantage. After all, good leaders are expected to be prepared to take on the world in all its complexity.

The question to be asked is how did so many of us not see this coming yet over the years, the World Economic Forum has listed the spread of infectious disease as one of the risks in the global risks heat map. Interestingly many did not foresee the impacts that such a pandemic would bring. It should not come as a shock if in the coming years, the environmental and climate change risks that have been long researched, documented and spoken about manifest just as this pandemic. This is a lesson for the future. From what we observe, institutions with well aligned risk management processes and structures are more resilient and will recover faster. The value of a well-coordinated ERM process cannot be underscored in this time. Covid–19 has indeed increased the visibility of business continuity and resilience professionals. As a result we expect a more receptive audience when speaking on risk management and business resilience issues in future.

India Sonjai Kumar, CMIRM, Global Ambassador The impact in India is relatively low compared to other developed countries because the country took early mitigating action such as screening international passengers, closing the international boundaries, wearing masks and national lockdown. The next three-six months will be more challenging because the ‘fire is now in different parts of the forest’ and in the absence of medicine; there could be a high risk of engulfing. As containment is the only prevention, it seems that longer isolation is the only potent mitigation available, but this is expensive and damaging in economic terms. We need to choose. Human resource is the driver of the entire economy, so it’s availability is the key consideration. As long as human resources are not available in all key sectors, the economy will not churn. International dependence for the raw material will remain a challenge till the time, the global economy starts coming back on the rails. Food is the key human fuel, this I think that the country will manage given the vast fertile land in the country; some of the other countries depending on import for food will face real challenges given the world is not churning. I think that there are challenges with the current risk management framework. It’s like defining the boundaries of the game and leaving the players to adhere to the rules of the game. The referee (CRO) can only raise the flag. The development of the risk management world between 2008 and 2019 did not bear enough fruits to reduce the impact. The future time will not give enough time to the human race to learn different risk management techniques after every big event over 10 to 15 year’s time. We need to have a leak proof risk management framework that works in every situation. Having such a framework is more important than a ‘Mission to Mars”; I think, it is more important to have “Save the Earth”. Let’s learn from Covid-19, what stopped the world reacting way back in December 2019 when the risk first surfaced? The emerging risk philosophy clearly says to start preparing when you start seeing risk is coming. It did not even require scanning the horizon, the risk was there? Why our risk management framework does not have triggers when response has to be taken rather than leaving to the decision makers to take a decision? We lost precious time. Barring in the countries where Covid-19 reached in January and February, the world was waiting to spread the fire further and it did. Why don’t our risk management frameworks have buttons which prompt taking immediate actions rather than leaving the actions for the decision makers? It’s like having an immediate sprinkler system as soon as a fire is visible or smoke is there. If we need to protect the world for the next disaster that may come anytime in the presence of global warming, we need to tighten up the risk management framework that everyone must agree as a part of national constitution. The losses to human life and economic cost are enormous, we have to have a sprinkler system and decision making cannot be left to choice. In the month of March, we were heading to a crisis situation and world started doing the crisis management. Why did risk management fail? Risk management should be like a doctor who can prescribe the medicine which patient takes and is not left to his choice. There is definitely a value in professionally trained risk managers in a situation which is catastrophic to the world. On one hand you can apply the tools and techniques that you have learnt but also able to identify the gaps. As I said, a risk manager fails if he is not able to raise the flag at the right time and right place but the entire risk management system fails when flags are not acted upon.

Ireland RIG Eugene Lehane CMIRM, Chair The current and ongoing Covid-19 pandemic presents a major threat to the Irish economy. It has had a major impact across all sectors. The immediate action was to protect the health and safety of the population. Non-essential healthcare procedures were postponed with private facilities coming under State control for the period of the pandemic crisis. Government-imposed restrictions led to the closure of residential, child-care, and educational facilities together with restrictions on business activities. Government restrictions sought to reduce the spread of the virus by imposing limitations on non-essential work, travel, physical engagement and stay at home requirements with cocooning for the elderly. This has resulted in most of the population working from home were able to do so with only essential staff permitted to attend for work. It is anticipated that some form of restrictions will remain in place for months with global action elsewhere impacting on trade and movement. The economic impact has seen many businesses unable to respond fully or recover as they might have from other events, however many have adapted to using technology. Ireland has benefitted from a prior positive economic position however face their most significant economic and social threat since the Banking Crisis (2008) which resulted in an IMF bailout. The Economic and Social Research Institute advised that the general government economic balance, which had been expected to be in surplus at the start of the year, is now forecast to be close to double-digit percentage deficit. Key sectors to the economy have seen significant and continued shortfall and despite financial support measures Ireland will be in recession, Businesses will struggle to survive, and many will fail with several organisations already closed or subject financial control protection as revenues fell or stopped. Sectors essential to the economy including aviation, tourism, hospitality, major events have seen incomes fall significantly. Some have adapted with hotels providing hospital accommodation, food industries provided community support and other adaptations. However, at the time of writing over 1,000,000 people received total or partial income support from the State with additional measures taken to support businesses including payment and grant schemes. The Central Bank of Ireland indicated that small to medium enterprises will need more than €5.5bn in financial support added to which the government has already provided financial support. The Financial sector has been engaged to support individual and businesses in terms of cash flow, mortgage/loan payment deferrals and assistance, insurers committed to supporting prompt claim settlement and premium refunds, as appropriate. Organisations are facing unprecedented operational challenges. The key issues organisations have been addressing include complying with maintaining operational processes and procedures, health and safety, technological resourcing, data protection and measures to support customers and ensure adequate supply chain protections especially for those organisations involved in global trade activities. As an open economy, Ireland is exposed to significant global risks and the implications of Brexit especially where no deal is reached have been exacerbated further by Covid-19 and the potential recovery options, The political environment following the recent General Election has added to the complications and Ireland is currently subject to administration by a caretaker government. However, there is general support for the approach taken to overcome the crisis. As lockdown restrictions ease it is anticipated that the global trade and political environment will change together with societal impact as perceptions to non-economic issues including wellbeing, quality of life, measures of individual success, Individuals have connected/reconnected with family, communities with remarkable support and empathy being displayed to those suffering or exposed through front line activities.

There is no doubt the role of risk management will see a growth in importance and certainly should have the skills experience knowledge and global reach to support organisations to survive, grow and expand. The Institute of Risk Management is well-positioned through its diverse experienced and educated membership to support guide and promote its member organisations and influence other groups to become more resilient in trade, finance, economics, governance, and culture. Boards will have the opportunity to oversee and connect with their organisations and this should lead to a better understanding of risk exposures and how to improve the efficiency/effectiveness of risk management. This should lead to improved decision making and deliver increased certainty to support stakeholder’s expectations. Risk management should not be a functional role or a tool used by other professions, it mustn’t be limited as a function of audit, compliance and financial but an integral framework around which an organisation’s strategy is developed to achieve its objectives to the benefit of its stakeholders, lessons learned must be built into organisation’s genetics to survive negative consequences and take advantage of positive outcomes. In conclusion, risk management provides the ability to look forward and adapt to an ever-changing environment with perhaps a more equitable and considerate approach bringing a more thoughtful culture in business and society. Risk management is best positioned to drive these changes through thought leadership training and education. This is vital to recovery for Ireland and ensure organisations are more resilient.

Pakistan RIG As of May 26th, 2020, there are 56349 confirmed cases of Covid–19 in Pakistan, first case being reported on February 26th, 1167 deaths have been reported whereas 17482 people have recovered. The spread of Covid–19 in Pakistan is extremely worrisome, especially when the country is already facing a balanceof-payments crisis, revenue shortfall, is under a strict IMF programme and challenged by other economic vulnerabilities. A nationwide shutdown is already harming the most vulnerable in Pakistan – including those working in the country’s substantial informal economy, food insecure populations, and those living in slums outside the densely-populated urban centers. The most immediate impacts of Covid on Pakistan has been the -30% crash in the stock exchange and massive capital flight from the country leading to a -10% devaluation of the currency. Over the next few months, we expect lower current account deficit, especially after relief given in the foreign debt repayments. However, lower GDP growth and elevated fiscal deficit are more certain outcomes of the current crisis. State Bank of Pakistan (SBP) has already revised the GDP growth rate to 3% from an earlier estimate of 3.5% for the 2020 fiscal year. The Asian Development Bank also lowered its projected growth rate to 2.6% from an estimated 2.9%, while the World Bank has revised it to 1.1%. Official assessments estimate an initial loss of PKR 2.5 trillion (around $15 billion) to the economy. They also estimate between 12.3 to 18.5 million layoffs across different sectors of the economy in the aftermath of the partial or complete shutdown, impacting mostly daily-wage workers, and those employed in the agriculture sector. 2015 statistics state 24.3% of the population in Pakistan lives below the national poverty line. With the expected layoff figure, the ratio could jump to 40% by June 2020. Even with fewer resources, Pakistan took timely and rigorous measures to combat and control the spread of the virus: > Enforcing strict lock-down measures across the entire country > 35 specially designated hospitals for handling Covid cases with a capacity of 23,557 isolation beds > Setting-up of 35 new laboratories for testing (earlier 15) > 23,557 quarantine facilities in 139 districts > PKR 50 billion ($299 million) has been set aside to purchase medical equipment such as ventilators, PPEs, testing kits > Testing capacity has also been enhanced from 30,000 to 280,000 and is expected to be further enhanced to 900,000 within April > Establishment of Covid–19 Relief Fund to receive donation for the welfare of publics > Social network helplines launched in seven local languages > Using telecommunication sector to create awareness like sharing information through caller tunes, SMS > Contacting suspects of confirmed cases through mobile tracking and pushing them to get their tests done Pakistan has unveiled a PKR 1.13 trillion ($6.76 billion) rescue and stimulus package with a good balance between providing direct assistance to the vulnerable and protecting industry and businesses.

In order to limit the social impact of Covid and ensure food security, the government has temporarily abolished all taxes on food items and has announced a significant reduction in oil prices. A sum of PKR 50 billion ($299 million) has been earmarked for government-run utility stores to ensure the constant availability of food and other necessities. PKR 280 billion ($1.68 billion) has been allocated to ensure wheat farmers do not face cash flows and to ensure smooth wheat procurement. Country’s civil society and business sector are also coming forward to supplement the government’s efforts in this testing time by helping the vulnerable segments of population through private philanthropic efforts. The sudden closure of large industries, small and medium businesses, ports, airports and transport have almost jammed the wheel of the economy. Export-driven industries are severely impacted due to disruptions in the global supply chain, being extremely dependent on imported raw materials. In addition to that, there is a substantial fall in consumer demand due to lockdown across the country. If the already fragile economy of Pakistan falls into a recession, business firms will be forced to either operate below capacity or shut down operations. Industries impacted by the demand shortage or supply disruptions, especially from the manufacturing sector and those with cyclical earnings, will have to review their business strategy and fiscal outlook for the coming months, reassessing their investment decisions, supply chain assurances and hiring requirements etc. Setting the right foundation to kick-start the economy is imperative for the government: > Economic stimulus package containing tax breaks, financial support via utilities, fuel and transport subsidies, concessions and tax refunds to protect exporters and businesspersons > Package worth PKR 100 billion ($600 million) for SMEs, which form close to 90% of all enterprises in Pakistan and generate 40% of non-agriculture employment > SBP’s Temporary Economic Refinance Facility to fuel new investment by offering subsidised loans to the manufacturing sector and Refinance Facility for hospitals at 3% for five years > SBP has also reduced the interest rate to 9%, down from 13.25% earlier Covid–19 has demonstrated the value of ERM and risk preparedness for organisations from all sectors, of all sizes and from all across the globe. The best-prepared organizations will have many business advantages over the less-prepared ones as they minimize the operational and financial disruptions caused by the current crisis. Risk managers are, therefore, at the heart of crisis management activities in the current situation. With their forward-thinking, and focus on scenario analysis and impact assessment, they can help lead the discussion around effectively mitigating risks and grasping opportunities. Information awareness is also key for successful risk management – risk managers can ensure relevant information is disseminated to all the stakeholders in a timely manner so mitigation actions can be taken accordingly. Professionally trained risk managers truly understand the value of being prepared, and the importance of crisis management and business continuity plans. Their methodical approach to risk identification, assessment and response is an invaluable asset that allows organisations to respond to a crisis effectively and make them resilient. Their holistic approach and an ‘enterprise level’ view allows a multi-faceted perspective to risk and opportunity management, something that may be missing in a siloed or haphazard approach to risk management. At our organisation, all three members of the ERM Department are IRM Certified. The contributions from the ERM Department have been critical in the current crisis, from taking the lead in the development of a Covid–19 response and preparedness plan to minimize impact of Covid–19 on employees’ health and Company’s operations, highlighting uncertainties emanating from Covid–19 and discussing how to best manage them and cater for them in our business plans and budgets. 29

Qatar RIG Hatem Elsafty, Chair, Partner - Risk Advisory at Mazars LLC In Qatar we haven’t been subject to a full lock down like other countries. Although all non-necessary shops and malls are closed, businesses are still operating with reduced capacity. However, the construction sector is operating under business as usual since there are many key projects that cannot be delayed (on the critical path for Q2022) in preparation for the World Cup in 2022. Yet the impact is heavier in Qatar, since the global pandemic is associated with a significant drop in oil prices, which is impacting the outlook of many organisations and SMEs and their abilities to survive the impact of Covid–19. The main concern now, is the financial resilience and ability of companies to service the financial impact of Covid–19. Cash flows are now the top risk with the reduced revenues and reduced liquidity. In professional services it seems the impact is not as severe, with most of the organisations in Qatar having appropriate IT infrastructure enabling working from home. So professionals are still able to provide advice and consultation to their clients. However, all organisations in Qatar are now under severe pressure to reduce budgets, impacting consulting services significantly. Audit services are still protected by regulations. However, audit firms are pressured by their clients to significantly reduce the fees. While at first professional services firms will be impacted, there are also opportunities that can emerge from this situation. Many consultants now are focusing their services on Business Continuity Management, and pandemic planning services. Organisations are in desperate need of consultants who can help them manage the financial risk of the Covid-19 impact on their organisations. Which will create opportunities. Also with all organisations enabling faster digital transformation and enabling working from home. Cybersecurity risks are increasing which requires support from consultants and professional service firms to support in this field. Risk Managers have a key role to play in this situation. They have to support and coordinate with senior management response plans, they have to assess the financial risks. The current times mandate moving away from traditional heat map and qualitative risk assessments towards quantitative financial risk assessment models. They must support their organisations in assessing the risks of prolonged lockdown, assessing the risk of reduced revenues and delays in cash collection. Furthermore, with the huge budget cuts pressure on management. Risk Managers must support in assessing the risks associated with budget cuts ensuring that these risks are properly managed. Currently being a risk professional is a great privilege with all of management looking up to us and how to support our organisations in such times.

South Africa RIG Zanele Makhubu, CMIRM, Chair, Director Enterprise Risk Management and Business Continuity in Public Sector The impact of Covid–19 has exposed the level of poverty and inequality in the society and communities. The poor were the most vulnerable as they could not cope with the restrictions due to lockdown. It had impacted their low income to the extent that their basic needs like food, basic hygiene and other necessities quickly ran out and replenishing was difficult. The Covid death rate and number of infected have increased daily with the level of exposure while containment measures are implemented. Supply chain risks increased due to Covid–19 disruption - lack of proper protective equipment and required basic hygiene consumables across the globe were in high demand. This had a ripple effect on containing the spread and attending to the people who needed the assistance the most. The virus has affected the economy and business so badly and its impact is continuing to hit hard as other businesses are closing down. Many people have had their salary cut and lost their jobs, because employers and business were closed especially those who are not providing essential goods and services. The unemployment rate has increased drastically. The three to six months impact will be huge as there is no telling when the virus will be fully contained. As the country goes into the winter season, there is a fear that it will peak during this time as the level of exposure will increase and more cases will be recorded. Extreme caution is required It’s difficult to compare South Africa to other countries as the virus has no favouritism. The impact is the same as the virus is deadly and affects people’s livelihoods. The main concern is to save lives and the virus has taught us to invest in disaster management and disaster risk reduction strategies. Lesson learned is that it is a global phenomenon which needs coordinated efforts and resilience strategies that are well thought of. More awareness and training in the communities is needed and rehabilitation and reconstruction strategies should bring new economic development post-disaster that are sustainable. Our country has a strong disaster management policy and framework, although at the beginning we did not anticipate that the virus would spread so fast globally. The President and his cabinet on realising the seriousness quickly assumed leadership and declared the state of disaster to contain the spread by closing all the borders and grounding the airlines, at the same time instituted the state of emergency by declaring the lockdown with stringent restrictions The consideration for operations was that the companies and government departments that offer essential services were allowed to continue to provide service especial in the health and social sectors. It is critical for risk managers to also equip themselves with skills in the area of disaster management and business continuity management. The outbreak has made risk assessment a prominent skill and most sought after in assisting in mitigating the virus. In our country risk managers are called to lead in advising business and government in terms of risk assessment and business continuity management. Business continuity steering committees chaired by Chief Risk Officers are directing operations and continuity of business to resume operations gradually in line with a risk assessment of the level of exposure. As and when there is a peak /decline in the virus the risk-adjusted strategy is implemented. This has elated the importance of risk management and recognition of its value-add in prevention and proactive strategies. Being a professional trained in ERM gives confidence and trust in the advice that you provide to your organisation. It also advocate for the risk profession to be taken seriously in the organisation. 31

United States of America Linda Conrad, Global Ambassador, Stone Harbor Consulting (NOT Exelon Corp.) It is important to be realistic yet optimistic regarding the impact of this Covid crisis. From a resiliency perspective, this Covid emergency and “shelter-in-place” has been a true test of preparedness for governments, businesses, and for individuals. Leadership everywhere is challenged with leading responsibly, using science and facts, as well as empathy, to drive decision-making while focusing on the needs of key stakeholders. Organizations with strong risk management and scenario planning are able to transition to new business processes, while those without disaster recovery plans are creating work-arounds on the fly. Everyone is making good use of the collaboration technology to keep working and stay connected. All schools are closed, and those that are more agile have moved to on-line learning, while others are emailing assignments. At times the network infrastructure becomes overloaded, but it has been holding up well and enabling companies to transact business. Naturally, the main concern is personal safety. However, the world is seeing the economic fallout from Covid–19. Many service-based businesses are depleting cash reserves and individuals are going through their savings like a hot knife through butter. Small businesses and their owners, in particular, are feeling the weight of the shut down and scores have already begun the process of filing for bankruptcy. Unfortunately, it may take a long time to recover from the economic impact, particularly in certain places like Italy and New York City which have been disproportionately decimated from a human and financial perspective. During these unprecedented times, the world has seen a surge in cyber crime. Companies everywhere have been focused on managing the financial and operational impacts of Covid–19, and cyber criminals are sweeping in. In response, the Cyber Association of Maryland Inc (CAMI) have quickly taken action. Last week, CAMI stood up a Cyber SWAT team and the State of MD has officially endorsed it. On Maryland’s website, there is now a link to CAMI’s website, where a company can contact the SWAT team requesting help. This innovative response, aimed at supporting local businesses in their cyber resiliency, is but one proofpoint of the extraordinary collaboration and public / private partnerships which are occuring everywhere. Other examples of collaboration for the greater good include the many manufacturing and drug firms who are refocusing their efforts toward solving the current crisis by producing essentials like ventilators, hand sanitizer, antibody tests and vaccines. This massive coordination effort, orchestrated by the federal and state governments in partnership with key corporations and not-for-profit agencies, indicates corporate and societal agility. There is a marked increase in resourcefulness, as supply chains have instantly reinvented and redirected their production and distribution channels, and found new ways to collaborate with unlikely partners who are now all pulling in the same direction. As a case in point, one large company is commissioning small businesses who are out of work to make vats of sanitizer for redistribution. It has been a positive thing to see the increased innovation and creative connections that are now occuring. Interesting to note that Isaac Newton did some of his best thinking after being sent home from his studies in Cambridge to avoid the plague, and was quarantined at his parents’ house. The year that he spent away was later referred to as his ‘annus mirabilis’ or “year of wonders.’ He worked on mathematical problems he began at Cambridge, and the papers he wrote at home became early calculus. Next, he acquired some prisms and experimented with them in his bedroom, even boring a hole in his shutters so only a small beam could come through, from which sprang his theories on optics. And finally, right outside his home bedroom window, there was an apple tree - yes, that apple tree - where Newton reportedly sat, was hit on the head by an apple, then better understood theories of gravity and motion.

There has been an incredible outpouring of compassion from individuals, who are giving their time and resources to help others by delivering food to elderly, tutoring children remotely, sewing masks, and showing support for first responders and medical professionals. Charitable and religious organizations have stepped up by offering care packages and opening their spaces to be used by the public, even though their own fiscal situations have drastically deteriorated. It would be ideal if society can take advantage of this global crisis to learn from the dire social needs that are being laid bare and crystallized by this pandemic in both advanced and emerging economies. Many people are trying to be kinder to each other, being resourceful, and trying to keep a sense of humor, acknowledging that we are all being impacted together. The Corona crisis may mark a turning point for the visibility of the risk management profession, as boards, investors and governments re-evaluate business resilience and the enhanced value of risk management. Business continuity and IT disaster recovery plans will be viewed as a critical component of corporate strategy and operational readiness should be more prominent in fiscal prioritization and ripe for additional investment. Studies done by the National Institute of Standards and Technology (NIST) and University of Maryland show that firms with robust IT recovery plans are significantly less likely to be negatively impacted by disruptions due to the additional proactive cyber hygiene put in place in advance. Risk managers can play an integral role in partnering with operations, supply and Executives in scenario planning and modeling options for response and recovery. As a result of Covid, we might anticipate an increase in interest in professions involving Risk Management and business resilience, particularly in the realm of IT and data analytics. As an example, the following positive comment was made during a recent enterprise risk heat map review: “It is quite apparent where credentialed experience and subject matter expertise exists.” Risk Management professionals can be increasingly essential as the world learns lessons from recent experiences on how to better protect society by preparing for risks, responding to emerging issues, and building resiliency. In many ways, Covid–19 has brought out the best in people and companies by restoring a sense of common humanity, and it is heartening to see this global resiliency of the human spirit. The earth is also benefiting from reduced pollution as we all stay home and the world takes a collective deep breath. As we begin to emerge at the other side of this crisis, there is hope that individuals, corporations and governments will take this opportunity to re-evaluate how they spend their time, energy and resources, to establish a “new-andimproved” normal.

IRM Qualifications

Study with us to develop your career, knowledge and network

IRM qualifications include: International Certificate in Enterprise Risk Management

International Certificate in Financial Services Risk Management

Ideal for anyone looking for a solid foundation in the theory and practice of effective risk management. Its two modules explore all elements of risk management using real case studies on organisational risk management, emerging risks and future developments.

Consisting of the same two modules as the ERM certificate. It has been updated in response to international regulatory developments such as Basel III and Solvency II which require that financial services companies and their staff have a broader understanding of risk management.

Digital Risk Management Certificate

NEW Supply Chain Risk Management Certificate

This qualification introduces the concepts of risk This new qualification introduces the concepts management in an increasingly digital era. The of supply chain risk management and equips risk qualification has been designed to introduce learners practitioners with the ability to apply their risk to digital disruption, its causes and consequences management knowledge in a world where value is and to equip individuals with the tools and increasingly added via a supply chain. It explains techniques to apply their skills in an increasingly how globalised outsourcing, specialisation and just in digital world. time production are changing the risk environments for many organisations.

What our students say Vinay Shrivastava CFIRM Risk Management Director, Turner & Townsend Infrastructure “IRM qualifications are a necessary quality benchmark in our industry. I receive dozens of CVs regularly and candidates who are IRMCert/CMIRM qualified stand out for consideration for our roles as it indicates that these individuals take professional development seriously and are committed to a career in risk management.”

To find out more, please visit:

www.theirm.org/qualifications Resilience, Risk & Recovery

Institute of Risk Management 2nd Floor, Sackville House 143–149 Fenchurch Street London EC3M 6BN www.theirm.org

Developing risk professionals

IRM Covid–19 Global Risk Management Response

Articles inside