Page 23 - Risk Management Bulletin Jan- Mar 2022

RMAI BULLETIN JANUARY - MARCH 2022

purpose, roles and responsibility (individual as well as challenges, understand the interconnectedness and
collective ) and skilling and upskilling at all levels (i.e come up with collective solution. The recovery and
Board, Senior Management and operating) resolution may be required to be done across the sector
to address issues like complete lockdown. If required, a
The approach adopted needs to be continuously new framework can be developed to bring the third
reviewed to tackle disruptions and a routine needs to party within the regulatory ambit.
be developed to address resilience of critical /
important business services. Transparency in Conclusion:
regulatory reporting and disclosure of threats to the Operational Resilience extends beyond business
critical / important business services. continuity planning as it includes man made threats
like cyber-attacks, third party failures, natural disasters,
Regulator level: and geopolitical risks. Resilience needs to be
The Regulator has an important role to play by setting recognized as a separate risk and managed accordingly.
standards, indicating best practices, and developing It requires not only to build on capabilities but embed
stress scenarios considering the common challenges systems & behaviors so that the organization can carry
faced across sectors and geographies. Mapping of sector out its mission and implement its strategies in the face
dependencies is required to reflect on the common of any disruption.

Businesses troubled by huge confluence of risks
No US business leader, risk manager, insurance broker, or underwriter would have anticipated having to handle
a global pandemic (lasting two+ years), a supply chain crisis, a severe talent shortage, a war in Ukraine (and
the geopolitical fallout), economic inflation, and an increasingly unstable global climate - ALL at the same
time. When quizzed about whether he'd ever seen a global risk landscape like this before, Riskonnect CEO
Jim Wetekamp (pictured) gave a tentative "yes and no". He used the example of the US subprime mortgage
crisis from 2007-2010, which contributed to the 2007-2008 global financial crisis. This occurred around the
same time as several major natural disasters, which triggered significant supply chain disruptions.
"At any given moment, organizations - depending on what industry they're in - are always feeling impacts
from multiple directions, and they're trying to juggle across preventative, corrective and detective risk
management. I don't think that's unique or new," said Wetekamp. "What is new, in our recent memory, is
having a long-running risk event (a two+ year pandemic) at the same time as a major military environment
(Russia's invasion of Ukraine).
"The accumulation of correlating issues that have now had a compound effect - it does make this risk
landscape unique. I think COVID-19 is a big contributor to that, in terms of where it left us from a supply
chain resiliency standpoint, from a talent shortage, from consumer and economic demand, from freedom
of travel, in a lot of those things - and now add in uncertainty on inflation and geopolitical [tension] and this
moment is definitely feeling a bit different."
As the risk landscape has grown more complex, organizations have turned to technology, like Riskonnect's
enterprise risk management (ERM) software, to better understand their risk profiles and bolster their risk
management capabilities.
"In the past 12-18 months, more organizations are starting to use this technology because they value
transparency of their risk information, and they need to integrate it into multiple functions in their business,"
Wetekamp explained. "They need to understand their insurable risk landscape, along with their operational
risk, their financial risk, and their compliance risk because they all have these overlapping factors.
"If that process is going to be done recurringly - either quarterly, monthly, or even weekly - companies are
looking at the risk environment right now and saying: 'I need to refresh this data that often in an environment
where my employee turnover is 15-20%, my consumer demand is fluctuating, and my third-parties are at
risk of natural disaster or inability to get to the supply chain.' If they want to see this data in as near to real-
time as possible, they need to bring it into a common system to manage risk."

21