Perspectives: The business world’s journey to resilience

A 400-meter container ship veered sideways and lodged itself in the bank of the Suez Canal, choking off one of the most critical trade thoroughfares on the planet and hampering global supply chains for a week. A rare, severe ice storm in Texas knocked out a power grid designed to contend with much warmer temperatures, causing loss of life and property damage and disconnecting a market of nearly 30 million people from the nation’s economy. Rampant ransomware attacks have held companies hostage, disrupting their businesses and threatening their data.

These events have essentially nothing to do with each other, however they are all bound by the enormous pressure they have placed on businesses to reevaluate their resiliency. Especially against the backdrop of the ongoing COVID-19 pandemic, organizations require a forward-thinking approach to their risk strategy, one that will help drive preparedness and build resilience to known and unforeseen hazards.

Resilient companies are able to anticipate risk, minimize losses and quickly resume business following an event, gaining a competitive advantage over less-prepared peers. Yet, how many companies are truly prepared for the next supply chain shock, extreme weather event or major cyberattack?

Resiliency is an essential priority for businesses that hope to be successful in an unpredictable 21st century economy.

It’s difficult for governments, businesses and other stakeholders to prepare for every hard-to-predict risk. But ignoring events doesn’t make them less likely to happen, and the impact of being unprepared can be devastating. 

Understanding how companies assess their risks and what measures they are taking to mitigate them is crucial in understanding where we are on the resilience journey. To further that understanding, Marsh developed the Risk Resilience Diagnostic, a survey that examined the impacts and interrelation of key risks across core business areas. Among the more than 1,000 companies surveyed, our research found consensus about the importance of the specific emerging risks examined and broad agreement on the need to better prepare for them. 

But the Diagnostic also found disparities in the perception of and response to the threats posed by the six risk areas: pandemic; cyberattack; emerging technologies; climate change/environmental, social and governance risks; regulatory changes; and geopolitical risks. 

For example, while 75% of respondents believe their risk management and insurance buying processes are aligned to their long-term growth strategies, only 25% have a comprehensive process in place to evaluate and model the impact of these emerging risks on their business. 

The findings suggest a significant perception gap, with organizations’ risk management functions prioritizing short-term threats over those that are high severity but lower frequency. This potentially leaves them vulnerable to immediate and long-term disruptions to their operations, assets and revenue streams.

We identified four common behaviors for the journey toward becoming more resilient: anticipating important risk issues, connecting risk management to business strategy, avoiding gaps in the perception of preparedness; and measuring relevant data. 

A company that anticipates risk expects the unexpected. More than just having a crisis management plan in place, it looks farther and digs deeper. One thing we saw during the pandemic was that even organizations with robust business continuity plans struggled. Why? In many cases they didn’t fully anticipate how widespread and long-lasting the damage from a pandemic could be. 

Resilience also involves fully integrating risk management with an organization’s operations and strategy. Failing to do so can limit the ability to develop effective responses. Most organizations we surveyed do not adequately connect resilience planning with their long-term investment strategy. Those that do make the connection are taking a step toward mitigating financial exposure, reputational damage, business interruption and other losses. 

For any journey, it’s important to clearly see the path ahead. In terms of resilience, this translates to needing an accurate perception of organizational preparedness. A false sense of security can halt an organization in its tracks. We found a gap between how organizations view risk importance and how they perceive their own preparedness: Companies often overestimate their ability to respond to and recover from a given risk. 

The final behavior on the path to resiliency is to measure what matters. In this era, there is no shortage of data and analytics, but applying metrics consistently is a stumbling block for many companies, according to our research. We would have expected that risks that companies rated as important or highly important would be met with an appropriately high rate of modeling and forecasting. However, only a minority of companies are doing so, and most of those are only performing it in select areas.

There is a considerable mismatch between the understanding that great risks face our economy and businesses and the measures being taken to prepare for them. Closing that gap requires a significant investment in research, planning and preparation for events that have become all too common. However, they are necessary steps businesses must take to compete and succeed in today’s dynamic, unpredictable global market.

John Doyle is CEO of Marsh.