The COVID-19 crisis has exceeded resiliency mechanisms the world over, while it also shifted thinking, as seen in the widespread recognition that it caught everyone unprepared. Although some companies had “pandemic” on their risk register, they never really thought about it, defined it or exercised it in drills or war games.

Senior leaders now have a heightened understanding of pandemic risk. However, the problems it has wrought are overwhelming. Businesses are caught up in recovery, return to market and balance sheet protection — in other words, survival. Most are not preparing for a second wave or the next pandemic. Companies need to be agile, but agility is not easily achieved, especially in organizations that have not examined why they were caught unawares or prepared for the next catastrophic risk.

Rush to Recovery Risks Blindspots

As they reopen, businesses also need to prepare for the possibility of future trouble. The degree of uncertainty businesses face now is almost as great as it was eight to 10 weeks ago. COVID-19 opened our eyes to new considerations, for example, the need to expand the definition of high-risk employees to include those with high-risk individuals in their household or close contacts. 

We have learned and overcome so much in our collective responses to COVID-19 that there is now a sense of comfort as we embark on “recovery.” But that comfort stems from an illusion of control. As business leaders rush to reopen, or states lift restrictions despite rising case counts, it is important to understand all the potential pitfalls of recovery. With so much focus on immediate steps necessary to reopen and to begin scaling operations, many companies are not asking questions about the long term: What is my risk profile in this new environment? How has it changed? Will the assumptions I made yesterday hold tomorrow?

Forecasting the Second Wave

In the immediate- to mid-term, companies should be preparing for a possible second wave of infection, either in the U.S. or globally. As political appetite for sustained restrictions wanes, companies may be forced to make difficult decisions, including slowing their reopening plans, or even shutting back down. Fears about the pandemic may also heighten absenteeism, creating workforce barriers to reopening. 

Resiliency through times of uncertainty requires that, rather than waiting for conditions to worsen, companies should build operational and strategic agility into daily operations. Critical to agility is anticipation — the ability to forecast future operating conditions. Companies don’t need to be fortune tellers, but they do need to constantly envision various risk scenarios and build game plans to address those myriad situations.

At its core, strategic risk forecasting is no different from other forward-looking exercises, such as contemplating an M&A transaction. In that instance, a company would need to assess that transaction against different assumptions and possible outcomes: What if the M&A is successful? What if integration goes poorly? What are the risks and upsides in different situations? Such exercises are common in financial stress-testing yet rarely applied more broadly to risk management across the enterprise. 

Consider a hypothetical scenario surrounding a second wave of COVID-19, using a financial stress-test approach. The list of questions will vary based on each company’s situation, but the broader strokes include:

• What will it mean for my company if the second wave starts in October versus starting in January?
• What if the U.S. experiences the second wave before other geographies, receiving less warning and lead time than we did with the first wave?
• What if we have 90 days — instead of 180 — to understand the potential effects and scale operations?
• How do workforce impacts vary under different timeline scenarios?
• How will it affect my B2B relationships from a downstream perspective?
• What are the conditions that would necessitate slowing down our reopening or contemplating shutting back down? 

Organizations need to widen their definition of what risks are, and risk professionals need to consider what they have overlooked.

Understanding different scenarios will allow companies to begin modeling financial impacts and make decisions around the way they allocate risk resources or risk capital. For instance, if India or another country central to your supply chain were to experience a sustained surge, the impact may be significant, perhaps crippling. Are you planning for that? 

While this is done regularly with operating and capital expenditures, many companies are not taking the same approach to strategic risks like the pandemic. One reason is that companies often are not creative in how they approach the question of what constitutes risk. Companies have traditionally understood workforce risk as a direct employee risk; a pandemic forces them to contemplate the broader communities in which employees live. 

Organizations need to widen their definition of what risks are. Rather than focus on the traditional “bubbles” on a risk register heat map — such as property and casualty risks — risk professionals need to consider what they have overlooked. This includes risk areas not previously imagined and the “grey space” between individual risk topics where risks may converge, be interdependent or become greater than the sum of their parts. 

The biggest lesson learned from the past three months is the need to build risk forecasts that account for even previously unimaginable events. Yet many organizations continue to look at risk in a discrete and reactive way. 

The “New Normal” Means More Than Masks

Building agility, entrenching resiliency, and embarking on risk forecasting exercises require expenditures of time and capital, both human and financial. In many ways, agility — the ability to anticipate and preposition resources to proactively adjust to changing conditions — is the counter to efficiency. Considering that so much of the global economy, especially in the last 25 years, has focused on maximizing efficiency through just-in-time delivery, it is not surprising that so many organizations lacked the resiliency to absorb the shocks that COVID-19 created. 

Just as we all recognize that our personal post-COVID-19 lives will be quite different, companies must evaluate whether they can afford to return to old risk management practices. Having so viscerally experienced exogenous shock in the last several months, business must now redefine what materiality means in terms of risk. They need to develop metrics that allow them to make the right measurements. For example, measuring risk aggregation and interdependencies across the value chain can help companies understand the degree of contingent business interruption risk they face. Resilience metrics can help determine how much stress an organization can withstand at individual points in the value chain. Early warning, crisis event metrics can help organizations navigate the initial days of a crisis. Agile use of data means that when data indicates a problem, such as a growing second wave, preplanned decisions can lead to swift action.

How well organizations respond to COVID-19 today, not simply by surviving but by thriving, will define how they survive the next great systemic shock.