A year ago, the COVID-19 global pandemic impacted millions, shut down the economy, and has permanently closed thousands of businesses worldwide. A year later, businesses that have survived developed new strategies for operating with limited customer contact while implementing a series of isolating, sanitization, and health procedures. Companies are starting to see the light at the end of the tunnel while commerce is working toward placing the pandemic in the rearview mirror. But what risks lie ahead as we approach a post-COVID business climate and a new era of risk? What approach might serve the business best to identify and prioritize those risks quickly?
Businesses in a post-COVID reality may face the common threats we have come to know as natural, human-made, and technological. However, a deeper dive identifies terrorism, radical extremism, malicious cyber activity, pandemics, civil unrest, cancel culture, vaccine passports to participate in commerce, discrimination, and the destruction of business property which can lead to loss of life, employee injury, negative psychological impact, loss of customers, higher employee turnover, supply chain constraints, loss of confidence in government, and bankruptcy. The world has become uncertain, and no longer can we use the past as a particular predictor of future stability. Businesses of all sizes that use risk identification processes and risk management processes have an opportunity to build resiliency which offers safeguards against those risk-related hazards which could have devastating impacts. Practicing risk management allows any organization a systematic approach to business decision-making while protecting the businesses' reputational, fiduciary, operational, and safety concerns.
There are several approaches to risk management which businesses have an opportunity to use. Many of these approaches can be searched across the internet, and many of them were presented at the DRJ Spring 2021 conference. A basic approach to risk management which any size business can use includes the practice of putting into place the following minimal framework elements:
- Risk identification
- Risk quantification and frequency
- Risk severity categorization
- Risk prioritization
- Control identification
- Risk mitigation
- Planning and practicing
Risk identification can be as easy as writing it down. A business owner might ask, “What are the risks [my] business faces in today's volatile climate?”
A methodology commonly used to define risk is a tool called the hazard profile. The hazard profile is displayed typically on a spreadsheet and is segmented into the following cells:
- Type of hazard or hazard description
- Frequency or occurrence in years
- Severity
- Detection
- Risk priority number (RPN)
Let us examine quantifying risk using the risk priority number. The risk priority number is mathematical calculation rooted in safety engineering and lean methodology used in determining risk failure potential for mechanical applications. Still, here it has been adapted to assess hazard potential of risks which could impact commerce. The risk severity and numerical value correlation are as follows:
The risk frequency is recorded by how many times the hazard has occurred annually or in the last 5, 10, 20, 50 and 100 years. The risk frequency numeric value correlation for the calculation is as follows:
The risk’s detection predictability is numerically correlated as follows:
Calculating the RPN includes multiplying the severity by the frequency, by the hazard's detectability/predictability (RPN = Severity x Frequency x Detectability/Predictability). The RPN's calculated value is interpreted as the higher the value, the higher the hazard's risk potential. The hazards with the highest RPN numbers are the risks which should be prioritized first for mitigation or abatement.
Risk management in this new era of resiliency in a post-COVID environment will require a creative but familiar approach to risk identification and prioritization. The simplest way to start a framework is to write down the hazards which present a risk or threat to the organization. Additional ideas for managing risks may also include determining root causes of issues, avoiding or mitigating hazards with adverse consequences whenever feasible, developing contingency plans, and monitoring the hazards identified. Using a simple risk management framework will help any size organization build toward a more resilient system and future.
