The COVID-19 pandemic revealed a new set of risks many organizations did not foresee. Amid the evolving economic landscape, companies large and small must deal with uncertainty in operations, finances and regulation. These abrupt changes provide an opportunity for risk managers who adapt to the new environment to build more flexibility and resilience going forward.

Even before the COVID-19 pandemic, business interruption was already one of the top risks facing organizations. In Aon's most recent Global Risk Management Survey, business interruption was listed as the fifth most pressing issue for North American risk managers. However, some of the other top risks, such as economic slowdowns and cyber threats, also tie directly to business interruptions. The collateral damage of COVID-19 has accelerated concerns about business interruptions, cyber threats and economic slowdowns.

Managing risk exposure from business interruptions effectively requires a comprehensive approach. This guide aims to provide you with a step-by-step framework to help understand some of the emerging risks businesses face, mitigate those risks, seek program efficiency, limit operational volatility, and pursue a sure footing in the future.

Understand the Emerging Risks

With the fluid nature of COVID-19, one of the challenges to organizations is how to resume business and bring employees back to a safe workplace. After the pandemic's initial shock, risk managers are now tasked with worksite returns and reopenings in an uncertain regulatory environment.

Planning for business continuity must include monitoring local, state and federal regulations that change rapidly while keeping employee and customer safety concerns top of mind.

Organizations may need to reassess their organization's business continuity management program to account for those emerging risks. A comprehensive business continuity management program should define the threats that could harm business operations and exercise the controls in place to determine whether those risks are acceptable.

The reassessment process starts with interviewing key stakeholders and participants in the program. Emerging risks, such as supply chain disruptions caused by the pandemic, may need to be examined and planning documentation updated. The review should include:

• Communication protocols among management, staff and external stakeholders.
• Business impact analysis and risk assessments.
• Contractor and service provider contingencies.
• Business continuity and disaster recovery plans for individual units.
• Training materials, procedures and guidelines.

Risk managers should identify areas of vulnerability from emerging risks that could disrupt operations and the extent of potential losses, as well as the probability of an occurrence. Rigorous exercises and probing hypothetical scenarios can help assess an organization's ability to weather a business interruption and can then help it improve efficiency and productivity.

Mitigate COVID-19 Disruptions and Emerging Risks

A better understanding of the risks associated with COVID-19 can help organizations rethink how they will deal with business interruptions. Often that means risk managers should consider how the future of the work that they do might change to make their organization more agile and resilient.

Talent planning and exploring workforce cost options can address certain of the potential impacts of COVID-19 and other significant disruptions. For example, employers should plan for scenarios about how a rise in COVID-19 cases may affect employees who are furloughed or facing shift reductions. Cost-optimization models are vital to helping organizations determine the appropriate steps to take.

Emerging risk mitigation should include an element of compensation planning. How will significant business interruption affect an organization's talent cost? Will any layoffs or salary reductions be based on tenure, employee performance or compensation benchmarks? How should an organization use business-as-usual attrition, retirements and hiring freezes to control talent costs during a disruption?

As organizations plan for and address emerging risks, human capital considerations should be a top priority. Planning should inspire confidence in the workforce that employee health and safety are paramount and that an organization's human resources policies and programs will provide the necessary support.

During transitional times, effective communication is essential. Organizations should carefully consider how they share information about COVID-19 and other potential business interruptions. They should identify the most effective communication channels for the workforce, whether it's email, internet, intranet, text messaging, video conferences, instant messaging, mobile device notifications, printed material sent home or on-site printed materials. Employee demographics and data should help organizations evaluate effective communication channels.

On the financial side, organizations should consider risk engineering, risk financing and change management to handle business interruption risks. Any gaps identified by an emerging risk reassessment should be evaluated as to how they fit into an organization's risk appetite, then the organization should determine whether to retain those risks or transfer them with insurance coverages.

Maximize Risk Management Program Efficiency

Given the economic uncertainty, the cost of risk management programs is a crucial focus for organizations across all industries and sizes. Meanwhile, interest rate fluctuations and rising premiums have made cost efficiencies more challenging to achieve.

Organizations are taking a more disciplined approach to underwriting in the commercial risk transfer market. There are more opportunities to focus on coverage control and cost efficiency:

• Better technology: More organizations are adopting AI-driven processes, such as machine learning, to improve operational efficiency and manage their supply chains. These tools have improved supply chain management by linking businesses through networks, accessing new suppliers and enabling companies to store essential data digitally. However, interconnectivity and interdependency have made organizations more vulnerable to cyber attacks, which have emerged as a major cause of business interruptions. Risk managers should understand the trade-off between efficiency-producing technologies and cybersecurity vulnerabilities.
• Improved claims management: Organizations can help reduce the financial impact of events through pre- and post-loss design and implementation. A diagnostic review of loss history and all current claims management programs, including carrier, third-party administrator and adjuster contracts and internal processes, can help an organization find operational efficiencies and reduce the cost of claims.
• More use of captive insurance: Captives can allow companies to transfer or retain risk in a cost-effective way. We anticipate seeing an increased use of captives to meet the growing challenge of risks that affect business disruptions. They are becoming an increasingly dominant component of balance sheets as the market hardens and premiums increase. For business interruption protections, organizations must do their homework first. Captives are an advanced option for many risk managers.

These tools provide options to help organizations maximize the efficiency of their risk management programs so they can focus more on limiting their risk exposure.

Limit Risk Exposure From Business Interruptions

Though many organizations have a dedicated risk function when they reach a certain level of complexity, limiting risk exposure should be a priority for all enterprise functions. This is especially important when recovering from business interruptions.

Risk managers should drive the conversation to understand changes in operations that may result in new risk exposures and insurance requirements. Often creating a cross-functional recovery committee can help organizations grasp their total risk exposures and risk appetite coming out of a business interruption and over time.

The COVID-19 pandemic has provided an excellent opportunity to understand how a catastrophic event can disrupt all levels of an organization. Using this event as a learning tool, risk managers can anticipate and effectively manage their exposures. For example, let's look at some of the tactics an organization would assess for the pandemic's top operational risks:

• Rethink supply chains by relying on local and shorter supply channels to limit business interruption exposure.
• Review any policy wording changes, such as terms, conditions, warranties, exclusions, limits, and sub-limits, implemented by insurers at renewal of existing coverages.
• Analyze how risk exposures are measured by carriers, looking for ways to achieve premium refunds or reductions.
• Monitor employment practices liability for potential impact due to direct and indirect claims related to COVID-19.
• Keep an eye on any fiduciary claims generated by dropping or eliminating an organization's retirement plan match because of pandemic-related business interruptions.
• Communicate with all insurers the financial stability of the company to avoid any unnecessary assessments or collateral calls.
• Make sure current employees understand their options for returning to work.
• Discuss with insurers and brokers the likelihood of significant litigated actions against employers because of COVID-19.

When risk managers have a handle on the exposures their organizations face, they can help limit them and plan for the future more thoughtfully.

Plan Ahead for the COVID-19 Era

The COVID-19 pandemic has shown the agility risk managers must have within the broadening scope of business interruptions. The good news is that they are not alone. We have built a multi-level approach to support organizations dealing with disruptions from COVID-19:

• As a service to the risk management community, use our COVID-19 Business Recovery Decision-Making Tool Kit to revamp your response plan and existing business continuity strategies.
• If your organization requires help with identifying gaps in its strategy, Aon consultants are available to evaluate business readiness through the enterprise and develop ways to improve operations and risk management.
• Coming this fall, Aon will have refined the best practices for managing business interruptions such as COVID-19 based on studying the actions of multiple stakeholders, including government, healthcare systems, commercial real estate managers, COVID-19 test manufacturers, insurers and employers during this crisis. The Aon Return to Work Champions Consortium will offer evidence-based recommendations to help mitigate liability risks from the pandemic.

The road ahead may be uncertain, but you are already on better footing by reevaluating your organization's risk exposures.