Fuel shortages, major flooding, and evacuations of critical facilities such as hospitals as a result of superstorm Sandy have placed a corporate focus on contingency planning — and on having the resiliency to stay in business after such a disaster.
“Everybody is going to be out there resetting the level of resilience they want to target, because [Sandy] was much worse than anybody thought it would be,” says David Ingram, executive vice president of reinsurance broker U.S. Willis Re. “Who would have thought anything would shut down New York for a week?” he adds. “I’d like to find anybody who would have said that was a possibility.”
Companies are now asking what their corporate objective should be on resilience, says Ingram, who leads a group in development of enterprise risk-management standards for the Society of Actuaries and the American Academy of Actuaries. “My sense is that before, everybody was looking over [his or her] shoulder to see what everyone else was doing. The thought was to do better than average and they would be OK — because with a lot of these extreme events, investors give the companies a pass” on the effectiveness of their contingency plans.
What that means, he explains, is the company ends with a passing grade. But what it should be asking is whether it could ultimately survive such a disruption.
Looking at the gasoline shortages and long lines associated with Sandy, Ingram notes that companies need to be examining their own ability to bounce back from such a crisis — and to do that they need to measure the resiliency of their region as well. For example, if gasoline isn’t available because of supply chain or electrical issues, “a whole host of other problems present themselves,” he says.
Managers look at whether “a disaster will put them out of business,” says Ingram. “But what they are used to asking is whether the competition will put them out of business.”
Another consideration is that managing such a risk must include a combination of insurance and resilience planning, rather than relying on insurance alone to take care of the problems.
An example of resiliency planning surfaced during Sandy. A number of companies “thought they had things taken care of,” believing their employees could work from home in a disaster, says Ingram. But the two days planned for the disaster typically turned into a week, on top of the fact that many employees did not have electricity for their laptops and could not recharge their cell phones, and at the same time were dealing with damage to their own homes. Companies need to rethink their strategies in order to stay operative after a disaster, he says.
In the end, corporations that do set up a resilient foundation “may wind up being the most successful companies in their sectors,” Ingram points out. With the gasoline shortages, for instance, “if you were somebody with a flexible distribution network and could bring gasoline in from outside the region and you had gasoline distributors with generators in the New York, New Jersey area, you could have sold as much gas as you could haul in. It’s a matter of thinking those things out in advance.”
An example of a resilient company, he says, is Wal-Mart, which demonstrated that during Hurricane Katrina. He points out that rescue and rebuilding operations were staged from Wal-Mart parking lots. “That was because the Wal-Marts were open,” Ingram explains. “This was the case, not by luck, but because the company had made being prepared for storms a major priority. Besides the business, they got a huge amount of goodwill in that area.”
A New Look at Risk Categories
Loren Padelford, executive vice president and general manager at Active Risk Group Plc, an enterprise risk-management software provider, notes that companies have long focused on “pet risks.” These are risks with a high likelihood of occurring, in areas in which people have an interest, and come at the expense of the “unlikely” risks that can do the most damage, he says. The problem with pet risks is that “they aren’t the ones that cause the real issues, because everyone’s aware of them,” says Padelford.
Because of a proliferation of “superstorms” and other disasters, however, organizations are shifting their focus toward being aware of and planning for the low-likelihood, high-impact events: “The things that are unlikely to happen, but should they happen, it would be catastrophic,” Padelford says. “Five or 10 years ago, those would never have gotten onto the board’s radar, because someone would have questioned the 100-year chance of that happening.”
From a disaster-recovery and supply-chain perspective, companies now realize they need “at least a skeleton plan in place” for low-likelihood but dangerous disasters, he adds, which is “precisely what Sandy was, a very low-likelihood event, but with very high impact.”
But the disaster-recovery plans most firms have aren’t specific enough, Padelford says. “They list succession of power and things like that, but this is too broad.” Instead, companies need to ask exactly what would happen if they have a flood, a terrorist attack, or extended power outages. “Or what happens if their one supplier of that one product goes under?” he asks.
An example of the latter risk, he says, faced Syncrude Canada Ltd., which mines oil sands. The company transported the oil sands to the refinery on a two-and-a-half mile long rubber conveyor belt. But the company “had a big realization when the only company in the world that made the rubber for the conveyor belt went bankrupt,” he says. “It cost Syncrude $6 billion to retool.” After the fact, when company executives looked at how they could have prevented the loss, “one of their executives, seeing that the entire rubber-manufacturing company was only worth $100 million, asked, ‘Why didn’t we just buy them?’”