Kathy James, Senior Associate and Sue Harvey, Partner at Campbell Tickell, discuss the important role Risk and Assurance will play in building resilience in a COVID-19 world.
Risk Management
As we all recognise, we’re living in unprecedented times.
It’s probably not that helpful to point out that infectious diseases were on the World Economic Forum’s 2020 risk register, with an above average impact – but still below extreme weather, cyber security and biodiversity loss.
At Campbell Tickell we regularly review risk registers for dozens of organisations, yet we’ve not seen a severe pandemic featuring prominently on any recently. But who remembers the 2010 Swine Flu outbreak? That did appear on several risk registers. If memory serves us well, the main control was a bottle of hand sanitiser at the reception desk. Happy days!
But before we jump to the conclusion that the absence of a pandemic from most corporate risk registers invalidates the discipline of risk identification and mitigation, we must acknowledge that many of the active and strengthened controls for existing risks have undoubtedly contributed to the resilience of some well-positioned organisations. In the housing association sector, for example, the past attention paid to the risks associated with liquidity, development and sales are certainly paying ‘dividends’ in the face of this new threat.
What can we do now? How do we need to think differently? How can we build and extend resilience to meet the coming challenges in the economic outlook, new ways of working and possibly what we value most?
We need to be flexible in how we respond to emerging and crystallising risks. But when we have a bit more breathing room, we need to start considering how best to prepare our organisations to come out running on the other side.
So, with all that in mind – what should your risk register be focusing on today?
Risk identification
A little like Brexit, we suggest it may be helpful to think of COVID-19 as the trigger for increasing the impact and likelihood of existing risks, as well as causing new risks to be added to the Board-monitored risk register, particularly risks relating to:
- Health and safety of residents, staff and the wider community
- Support needs of vulnerable residents, particularly in care homes
- Reliability of income streams, including rents and sales income
- Financial resilience, including stress testing, liquidity and golden rules
- Delivery of the development programme
- Service delivery – both day-to-day housing management and essential repairs
- Financial stability of partners, suppliers and in the extended supply chain
- Continued deliverability of transformation programmes and IT roll-outs
- Cyber security
Boards, Committees and executives need to remain abreast of changes to immediate, longer-term and emerging risks, potentially de-prioritising some that have been overtaken by events. They will increasingly rely on the register being kept ‘live’ as a key source of assurance.
As an aside, we have found that bespoke automated risk management systems can reduce the burden of keeping all parties informed and provide ‘real time’ assurance that risks are being actively managed.
Controls and mitigations
In a crisis, decisions need to be taken quickly. Indeed, the Campbell Tickell Housing Association Chief Executive WhatsApp Group discussions show agility being a major contributor to organisational resilience. Normal governance arrangements and decision-making processes based upon consensus and formal responsibilities can simply be too slow.
Yet we need to ensure that existing controls are operating effectively and that others are enhanced to respond to the changed environment. How can we provide Boards and other stakeholders with assurance that the organisation continues to be well run, without burying everyone in unwanted detail?
Different ways of working and the uneven impact of the virus across the population may require some controls to be strengthened, extended and augmented. These are some of the actions that may merit your consideration:
- Reviewing customer data and intelligence to understand where new support needs and financial challenges may emerge.
- Ensuring websites clearly signpost tenants to advice and assistance, be that sources of financial support, foodbanks and domestic violence helplines. As well as warning of any known scams.
- Increased frequency of budget recasting and cash-flow forecasting.
- Increased use of ‘what-if’ analysis to understand the impact of a wider range of assumptions in the face of extreme uncertainty (for example: for rent arrears, voids, and bad debts as well as those regarding the pace of development and expectations of sales income).
- Reviewing the robustness of financial controls, especially around procurement and payments systems.
- Re-evaluating existing delegations between Boards and Committees, Boards and Execs and between different staff teams. Are there ways of distributing decision making that can improve agility without weakening controls and accountability?
- Checking the ease-of-use of the intranet / SharePoint, so that key policies and procedures can be readily accessed when asking the person opposite is no longer an option.
- Ensuring HR advice and support to staff is addressing sickness, well-being and mental health as well as bereavement. With extra attention for those operating in challenging environments, but also celebrating extraordinary efforts and effective contributions.
‘Building resilience’ – Campbell Tickell
Assurance
With so much else to focus on, Internal Audit (IA) may be seen as a low priority activity. But used appropriately it can provide much needed assurance that agility is not endangering resilience.
Questions you could be asking yourselves include:
- Does the IA programme need refocusing? Are there areas where IA could or should be deferred? Equally are there some areas where the Exec, the Board and its Committees need further or more frequent assurance e.g. the impact of widespread home working on IT security and financial controls.
- Are the required internal audit resources available? The retained firm may have furloughed or sick staff and so may not be able to deliver the previously agreed programmes. For those organisations that operate internal IA teams, these can be similarly hit with resource challenges.
- What are your contractual commitments and to what extent can they be varied?
Building resilience
In conclusion, whilst risk management and internal control may appear to some as low priority distractions right now, in practice we are instinctively making new risk assessments and strengthening controls as we rapidly roll out our new operating models and shift our organisations’ priorities.
Risk management, if streamlined and focused, has an important role to play in supporting agility and building much needed resilience in these troubled times and beyond.
To discuss further, please contact Sue Harvey on: sue.harvey@www.campbelltickell.com
Read more on risk and assurance topics here.
| Campbell Tickell is an established multi-disciplinary management and recruitment consultancy, operating across the UK and Ireland, focusing on the housing, social care, local government, sport, leisure, charity and voluntary sectors.
We are a values-based business and firmly place the positioning of our support and challenge on helping organisations to attain change that is well thought through, planned and sustainable. At CT, we want to help organisations create the landscape within which we ourselves would like to exist: fair, inclusive, diverse, engaged and transparent. We build from our values in how we approach all our work as a practice. Find out more about our Risk, Audit & Assurance services. |
