The risks and impacts to include in a recovery strategy

03 July 2020 Consultancy.eu

Now that Covid-19’s first crisis dust has settled, and companies are getting to grips with their crisis management plans, the time has come to look beyond business continuity and focus on a longer-term recovery strategy. Kate Robinson and Niels Willeboordse from Protiviti outline the risks and impacts which should be taken into account.

It is unlikely that business will return to normal in the short term, making it important to have a recovery strategy in place. This strategy should provide a realistic roadmap for recovering the business operations and it should be supported by clear operational and financial targets. Performance against key targets should be periodically assessed to track the recovery process and validate appropriateness.

The planning and execution of this recovery strategy should be driven by the analysis performed in the business continuity phase. This means that a recovery strategy should prioritise mobilisation of the essential business functions, having regard for operational capacity in the immediate period after the crisis event and target operational capacity (based on the revised financial forecasts).

At the helm of the recovery strategy should stand a Crisis Manager who understands the business (including the supporting functions) and is able to identify risks and operational impacts that result from measures or targets taken to weather a crisis event. This leader should be supported by a team of delegates from across the organisation: the Crisis Management Team. 

Crisis Management Team

The Crisis Management Team (CMT) should be able to identify risks and the operational impacts of those risks, in order to define short-and long-term targets and measures to enable the organisation to weather the crisis with minimal negative operational and financial impacts. 

A multi-disciplinary view is essential because it allows for a bird’s eye view on impacts. For example, while finance may seek to cut costs and roles, taking these measures too far with cross-functional alignment could lead to understaffing and client issues. 

Financial impact

In the event of a large-scale crisis which impacts the broader economy, such as the Coronacrisis, there is undoubtedly an impact on an organisation’s financial viability. Financial impacts may be direct (through declining customer demand or customer delinquency) or indirect (e.g. through supply chain inefficiency or macroeconomic pressures).

In the aftermath of such an event, it is necessary to develop an outlook on the financial impacts, this should include revisiting annual budgets, forecasts and expectations regarding customer delinquency. The finance department, working with the CMT should develop appropriate cost saving measures to preserve the financial position of the organisation (whilst preventing short sighted decision-making). 

Effective cash management is essential to stay afloat. This is especially relevant when organisations or their customers/suppliers are dependent on debt facilities (either via banks or via customers/suppliers). If working capital is an issue, it makes sense to look into alternative financing arrangements in times of crisis. 

Read also: Ten measures for cash control during times of crisis.

With regard to the longer term, finance leaders should assess the impact of a crisis on long term budgets and business plans. If there is a material financial impact it may be necessary to reconsider any growth or investment strategies which are not directly aligned to preserving the essential functions of the organisation. 

Crisis Management Framework

Operational impact

In an ideal scenario, an organisation performs a Business Impact Analysis (BIA) and risk assessments twice annually. The purpose of these assessments is to identify critical business functions and their related risk exposures. The output of such assessments should include BCPs and risk management practices which protect and preserve critical business functions.

However, in the event of a crisis such as Covid-19, the output of this analysis also provides a benchmark for assessing the crisis impact. Armed with an overview of critical business functions, a systematic assessment of how these operations have been impacted should be conducted, identifying what level of output is required and what resources are needed to maintain required output levels. It is important to recognise that the critical functions of an organisation will likely include both core (profit driving) and support functions.

IT impact

Many businesses are highly dependent on IT to support their operations. Failure to perform adequate BIAs as a component of ‘business as usual’ operations may result in the need to quickly implement workarounds or significant IT infrastructure changes to accommodate for instance remote / alternative methods of working or changing customer demand.

Naturally this can result in unforeseen operational (e.g. supply chain failure) or information security risks (e.g. use of unsecure technologies). When considering measures to mitigate the operational challenges imposed by a crisis event it remains essential to apply risk management procedures.