Australia is at a turning point in its coronavirus recovery process. It is no longer in full crisis mode and in most states lockdown restrictions are being eased. As such, businesses need to start a new phase of adaptation so they can successfully operate in a climate that is more like it was before the pandemic, but which is also very different to life before COVID-19. The economy is fragile: it is vital that economic activity recommences. With this in mind, how can businesses plan for this new environment, which is characterised by so many unknowns?
On 24 June 2020, SAI Global and Governance Institute of Australia held a virtual roundtable with senior risk and governance practitioners on the topic, ‘bouncing back from adversity in the time of COVID-19.’ The roundtable discussion addressed the need for organisations to stay operationally resilient in the ‘new normal’ and explored what this might mean in practice. It also reflected on how prepared risk professionals felt as they were going into the crisis, and what they have learnt from their lockdown experience. Most importantly, it was an opportunity for risk professionals across a range of industries to share personal stories and experiences from the first three months of COVID-19 restrictions and to learn from one another.
How prepared were you?
The discussion started with a poll to ascertain participants’ risk-readiness going into the pandemic. Seventy-five per cent of participants said they were somewhat prepared and 25 per cent said they were incredibly prepared.
‘Pandemic’ was a risk that some organisations were managing. Despite this, businesses were not sufficiently prepared for the magnitude of the crisis they would face and the impact it would have on their operations. Business continuity plans weren’t as detailed as they needed to be. This led to organisations and governments being blindsided by the coronavirus outbreak.
Many participants felt that the rapid onset of the crisis was one of its notable features, which made it hard to judge the point at which there was in fact a crisis that needed to be managed.
Stakeholders are looking to risk professionals to have a recovery plan in place with hard measurables, concrete assurances and timings.
Pivot, adapt and thrive
Risk and compliance professionals face uncharted waters as they try to understand the post-lockdown operating environment (although at the time of writing Victoria is grappling with a second lockdown) and there is uncertainty about how well the national economy will recover. Stakeholders are looking to risk professionals to have a recovery plan in place with hard measurables, concrete assurances and timings, which as the group discussed, are all impossible to give. The SAI Global COVID-19 Risk Arc offers one potential roadmap to recovery framework to help engage with stakeholders, helping companies to articulate their recovery plan and maintain trust. But fundamental challenge businesses now face is to successfully emerge from crisis mode into a different, but more recognisable, operating environment. Many will need to pivot in order to stay operationally resilient adapting their business model to suit the new circumstances. A cultural change will also be required, moving away from managing costs and mobilising the workforce moving away from this ‘anxious paralysis’ — and moving towards restarting the business by engaging its workforce and extended value chain.
Defining and understanding the ‘new normal’
The ‘new normal’, which refers to the post-lockdown operating environment, is understood to be a grey area and perplexing concept in and of itself. Participants debated whether the ‘new normal’ is when there is a vaccine (which could be at least a year away) — and how that shift could alter our perception of workplaces and spaces after working remotely for this duration. Another argued that the idea of the ‘new normal’ could be redundant if it involves referring to how things were done pre-COVID and measuring change from there. But the unpredictability of this virus, and the implications it carries as restrictions ease mean that there is ongoing risk of disruptions with second waves and an ongoing rollercoaster of potential future lockdowns.
When to go back to the office?
For the majority, the possibility of going back — or not going back — to the office was central to defining the ‘new normal’. In particular, the group was keen to understand how to make long-term remote working a success, possibly alongside a partial return to the office. The lockdown period has demonstrated that remote working is feasible: in many cases employees have been more productive at home, and attendees were most concerned about the issue of overworking at home, with burnout and mental health core risk issues with their workforce. Questions circulated about how businesses will manage the risk and compliance issues (finance, WH&S, mental health) to support the individuals that wanted to remain working from home or in a hybrid model — are businesses offering allowances for staff, and how is this being managed? How is leave loading balancing out? We know that some organisations are cancelling leases; how are staff being notified of these changes and how are their own lives impacted by this? We heard amongst the group that small stipends to cover internet and electricity was being offered at some organisations.
Many organisations are planning a gradual return to the office: some attendees shared their plans. One participant felt the risk profile is currently too high to return to the office. Others were prioritising employees that need to work together. One participant expected some of their workforce back in the office from July. Most attendees had carried out staff surveys to find out how their employees want to work post-lockdown, confirming that a one-size all approach to returning to work, does not work for every business. In most cases, responses appeared to mix with a mixture of employees wanting to continue working from home full time, wanting to be back in the office full time, and some even wanting a hybrid model. Participants predicted a hybrid model being implemented in most organisations.
The discussion covered some practical issues that need to be addressed to make long-term remote working a success. The technology that is used should be appropriate, accessible and made available to all staff, who should receive training where necessary. Technology should also fulfil relevant regulatory requirements, such as call monitoring in a call centre. Data management and document security cannot be forgotten, and solutions need to be found for keeping documents safe.
Reworking culture for a remote environment
Maintaining a semblance of workplace culture in a new virtual working environment was concern for everyone in the roundtable. For some, culture had been overlooked in favour of operational and logistical challenges. Some participants felt remote working made it harder for teams to work towards a common goal and others felt it hindered the creativity of spontaneous brainstorming. We know how important workplace culture is — the recent banking royal commission is a reference point to what could go wrong. Business performance was the top of everyone’s mind moving into the ‘new normal’, with almost everyone voting in favour of this as a top priority. Questions were floating amongst the group around how organisations can successfully implement an output-based approach for a remote workforce, without sacrificing culture or potentially creating a dangerous one if there’s lack of oversight and control. While there are no clear answers to this — the group seemed to agree conclusively that an outputs-based approach is the only way to manage a remote workforce moving forward.
The role of the manager has become even more important during COVID-19, as there is a greater onus placed on them now, to engage and support with not just their own team, but members of the broader organisation. Daily check-ins, afternoon drinks, are just some efforts being implemented by organisations to ensure the wellbeing and mental health of staff. There are silver linings in everything: some of these initiatives have given senior leaders in attendance greater opportunity to learn more about their teams than prior to lockdown. One could argue that the need for upskilling people managers in the art of communication could be invaluable investment during this pandemic.
A leadership challenge
One attendee argued that addressing the issues raised by the idea of returning to the office post-lockdown is a leadership challenge as well as a risk and compliance challenge. Chief executive officers are striving for a one-size-fits-all approach. However, this won’t work because everyone has a unique experience of lockdown. The starting point for planning a return to the office shouldn’t be an assumption that everything was perfect before, because for many, it wasn’t. For this participant, leadership requires a flexible mindset, which balances can-do attitudes on the one hand with extreme conservatism on the other hand. In addition, there is hope that the attitude at a board level would change off the back of this pandemic. The assertion that board members question the price of risk measures too often and this pandemic has now provided reference points to quantify future needs, and perhaps change attitudes at the top.
The discussion covered how consumer behaviour might change as lockdown restrictions are eased with trust being a large issue for consideration. One participant observed that despite lockdown restrictions, consumers still want to shop in person. One participant shed light on the retail sector taking a risk-based approach to operating post-COVID, asking: how much money do we want to spend on safety measures, or on creating the perception that we’re safe? Participants also considered how shops reopening might affect online sales which have surged during lockdown. The elephant in the room is that digital transformation has happened quickly for some industries — retail being one of them. Will traditional brick and mortar stores stay afloat post-COVID? Will Australia see a completely different consumer landscape once this is all over, and how will it affect other links in the chain?
Leaders are beginning to recognise what their core business is and are focusing on it to maintain operational resilience.
What does the road to recovery look like? Every industry might have a different story, as will the businesses in each state based on their own regional restrictions. Towards the end of the discussion, the group looked at the issues that risk and compliance professionals should consider as they plan for recovery.
Board risk perception
Participants agreed that boards will continue to be transitory and reactionary in their response to the pandemic. There is a small window now, while boards perceive the risk be high, for some significant changes to be made to the way companies operate. Risk and compliance professionals need to take advantage of this opportunity.
The fundamental challenge is for boards to understand the value of risk management in preventing unplanned events and avoiding reactionary crisis management. As one participant argued, there is now measurable evidence to demonstrate why risk and compliance — and the cost associated with it — is important. Despite this, the group concluded that planning for another crisis would become less likely as boards start to feel the economy has recovered, making the risk associated with a future shock seems less significant.
The group hoped the pandemic would trigger changes to the current model of national critical infrastructure. One participant argued that the onus should be on its owners and operators to, of their own volition and at their own cost, implement resilience measures to be better prepared for next time. The group also addressed recent suggestions that manufacturing and critical services should be brought ‘back home’ in response to supply chain issues. There was scepticism about whether this would happen in practice.
Technology, connectivity and security
According to one attendee, the basic control environment for an organisation has been challenged by lockdown operating conditions. One participant described experiencing constant cyberattacks for the last six months, saying they are getting more sophisticated. Training in cybersecurity should be considered for all staff. There are also data governance issues to take into account: for example, do your licences for critical technology cover the whole workforce? One participant from higher education mentioned the importance of inclusivity when it comes to technology being utilised during working from home — as some providers are not accessibility and do not meet Australian standards, something that many organisations might be overlooking.
One participant asked what we would have done to manage the impact of coronavirus if the internet had failed. He argued that a loss of connectivity should be included in new business continuity plans because if that happens, everything that has been implemented to deal with this crisis would become redundant. The group discussed the extent to which the government should intervene to guarantee connectivity, with one participant arguing for a balancing act between government intervention and letting market forces play out.
Which lockdown practices will you retain?
One participant argued that a crisis crystallises what’s truly mission critical. The question is as much about what organisations will stop doing as it is about what they will continue doing.
Engagement with staff
One priority for the risk professionals in attendance, is maintaining engagement with staff and focussing on employee wellbeing and mental health. If restrictions allow for it, some organisations will be bringing people in who might be struggling, back into the office first — identifying those that live alone are on the high-priority list and in greater need of socialisation.
Linking risk to strategy
The pandemic presented an opportunity to reassess the way companies across Australia are run. Leaders are beginning to recognise what their core business is and are focusing on it to maintain operational resilience. Asking questions around what is adding value versus what is not, with the purpose of eliminating practices that no longer suffice, will continue moving forward.
What can organisations do differently next time?
Upon reflection, there seemed to be a consensus that leadership was in the spotlight of how to do things differently. It was argued that leaders should be more assertive, recognising the significant risk of COVID-19 and dealing with it in a proactive (not reactive) manner, highlighting that many were too slow to admit that this was an unravelling crisis even before restrictions were put in place. Leaders need to have more confidence in the abilities, systems, frameworks and practices across the as this would result in a greater outcome. Additionally, leaders need to believe in their culture and avoid speaking too much time talking rather than doing — a point that should apply to all aspects of decision-making.
As you can see from the roundtable discussion notes, several themes have emerged. Leadership, trust, employee wellbeing, and business performance management are all factors contributing to the way we adapt and react in a COVID-normal world. To maintain operational resilience, risk and compliance professionals are now looking at addressing risk factors like business performance management and remote culture, leadership soft skills, employee wellbeing, and technology, that businesses need to address quickly to continue on a successful road to recovery. Even though this journey will not linear, it was invaluable to gain knowledge and expertise from others within the field to learn how their organisations are adapting and responding to COVID-19.