Like a phoenix from the flames: GRC (virtual) Supper Club takes flight

​The first virtual Supper Club – minus the food – kicked off with our host Lee reminding us why we had swapped the swanky confines of The Groucho Club for a video conference at the kitchen table: PPE facemask, suit and tie certainly isn’t the norm at our live events. ​With all the pleasantries taken care of and a quick virtual cheers, it was time to let our first esteemed speaker take the floor - or screen in this case – to give us their expert opinion on our chosen topic: will Covid-19 lead to a reframing of Operational Resilience in the boardroom?

Dr Sandra Bell, CEO The Business Resilience Company
Sandra has over 30 years’ experience working in organisational crisis management and resilience – including a spell blowing stuff up in the name of science. She started with a bang by explaining how businesses should manage operational disruptions; that they must be able to prevent, adapt, respond, recover – and learn from the challenges faced.

So how has Covid-19 impacted crisis management? To say we are experiencing complexity in the risk landscape at present is an understatement – from widespread economic uncertainty to hyperextended supply chains. Operational disruptions are, therefore, spiralling into strategic, financial and even existential threats to the organisation. Without effective resilience programmes in place, a business’s strategic options are limited, depriving them of the skill, will and grit needed to survive.

What about lockdown restrictions? These draconian measures have forced wholesale changes in the way businesses operate. Unfortunately, organisations that have failed to implement agile operational resilience programmes – from homeworking at scale to sourcing alternative suppliers – have been left counting the cost. For example, the rapid adoption of new technology needed to facilitate remote working at scale has opened the door to risks such as GDPR, compliance and cybercrime.

This brought us back to the all-important question: will Covid-19 lead to a reframing of Operational Resilience in the boardroom? Sandra thinks it will. To achieve this, she believes business continuity, disaster recovery, risk management, security and normal operations must be integrated under the operational resilience umbrella – and they must work together across three fronts: strong leadership and culture, robust yet flexible operations and a support network.

Michael Rasmussen, GRC Analyst and Pundit
GRC Supper Club was GRC Lunch Club for our second speaker, Michael Rasmussen who joined us from the US. Michael began by explaining how the Covid-19 pandemic is fundamentally a health and safety risk, and how its rapid spread echoes the chaos theory – only the butterfly has become a bat in this context. The escalation of the global health crisis has seen it spawn a multitude of other risks: economic, IT security – is the digital blender in the home office a doorway into your company’s data? – workplace harassment, fraud, bribery and corruption…the list goes on.

Traditionally organisations have managed these risks in separate silos. Consequently, some issues receive more attention and have more resources directed towards them than others. For example, our obsession with IT security – undoubtedly an important consideration in the digital world we live – has led to a blinkered approach that’s caused us to lose sight of other important issues like health and safety and environmental risk.  

The Covid-19 crisis is likely to focus more attention on operational resilience across industries, leading to a more integrated approach that brings business continuity and operational risk together. But why hasn’t this happened sooner? Some risk professionals are claiming that the Covid-19 pandemic is a black swan. However, Michael believes that anyone claiming it was an unforeseen event is probably making excuses for their lack of planning and foresight – after all, global pandemics are nothing new.
​
Take the Titanic for example. The captain (the ships CEO if you will) and the ship’s designer fuelled press reports that it was “unsinkable” – so no one questioned why there was insufficient safety equipment onboard. Unfortunately, this confidence couldn’t prevent the ship from sinking on its maiden voyage, resulting in a huge loss of life. How often are businesses overconfident when it comes to risk? Don’t adopt a ‘what could possibly go wrong’ approach, plan for every eventuality.

James Green, Dir. Risk Advisory, SAI Global
The seven-hour time difference meant our second speaker in the US was armed with a fresh coffee, rather than a pint of bitter like Lee – and this showed in his clarity of thought. James believes that business continuity in the pre-Covid-19 world was merely a box-ticking exercise. Rather than developing and implementing meaningful programmes, organisations were simply producing piles of risk documentation that was gathering digital dust. This created a disconnect that prevented them from mitigating risk effectively and devalued business continuity.

The Covid-19 pandemic has catapulted business continuity from the hypothetical to the actual. So, why did so many so-called experts fail to mitigate what has become a very real risk? By failing to integrate business continuity and operational resilience, they were only capable of focusing on what had just happened and preventing it from happening again. But this reactive approach isn’t resilience. The time has come to be proactive, by preparing for what’s coming next and helping the business grow in the process.

​Panel Q&A
Unfortunately, lockdown restrictions meant it wasn’t possible for the evening to end with a good old knees-up – as is usually the case.

​Instead, we brought all three speakers together on the screen for a Q&A session about some of the salient points they had discussed – along with Thomas Croall, Business Resiliency Lead at Skyscanner.