To start with the obvious, the global coronavirus pandemic is very clearly a rapidly evolving, complex, multi-factor event with significant downside potential over both the immediate short and medium-longer terms. Consumer behaviours and attitudes, financial markets and the political, fiscal and regulatory response are all developing at pace with little certainty or predictability. Firms need to be thinking and acting with similar dynamism to manage the here and now and plan effectively for multiple future scenario pathways. But how to do this in an informed way?

Earlier affected countries

In the absence of meaningful past scenarios (COVID-19 is increasingly being viewed as unprecedented compared to recent previous outbreaks such as SARS and swine flu), the practical experiences of firms in regions hit earlier by the virus may be invaluable, even though the lead time may only be a matter of weeks or (at best) months. In this context, Vicky Yu, a compliance professional in China, provides just this insight in her recent paper “Risk management during the coronavirus outbreak.”¹

Three important themes are explored in the paper:

• “An emergency management system is essential” - For UK firms this offers a reminder (if one were needed) that business continuity management should now already be in effect or very shortly needs to be.
  
  Most mature firms should have a plan specifically designed for pandemics/epidemics and the senior crisis management team should be meeting regularly to discuss a growing list of live and emerging operational issues that the virus is creating. This includes, for example, how best to communicate with staff, customers and other stakeholders (such as third parties), implementing measures to limit the spread of the virus on company property and planning how to maintain the operations of the business if working arrangements need to change significantly from the norm.
• “Following up on government regulations can be challenging” - New government measures (e.g., travel restrictions, school closures, etc.) may be announced with little forewarning and the timeframe over which firms and their employees then need to react to adjust or comply could be exceedingly short. In these circumstances, Yu stresses that it may be necessary for firms to put additional resources and expertise into support functions such as compliance and human resources (HR).
• “HR compliance needs to be strong” - Like any other function, HR will need to be able to manage through sick leave, self-isolation and social distancing measures (such as significantly increased working from home). However, HR will also need to contend with an increased workload stemming from:
  • An influx of employee questions (to which giving a definitive or positive response may not be possible)
  • A greater monitoring and reporting ask from management
  • Providing direct support to affected employees
  • More generally needing to work more closely with senior management and pretty much all first line and second line functions.
  To be effective through this period, HR teams will need strong, supportive leadership, clear direction from the senior management team and flexibility to adapt as the needs, circumstances and expectations of staff change.
  
  Of course, there are obvious parallels to other functions that can also be expected to be simultaneously affected by a fall in available resources and experience an increase in workload (much of which will be time sensitive), such as customer services and IT.

Government, central bank and regulatory response

Expanding on the second theme, getting ahead of new regulations, temporary laws or edicts or requests for information are aided significantly by looking at what other faster moving countries are doing. This could be particularly valuable in the UK where, following scientific advice, the government has not yet adopted the same measures (such as school closures) taken by other countries on the basis that these may not be effective at this point and could ultimately be counterproductive. Therefore, the measures taken in other countries should usefully inform a view of potential next steps in the UK or the alternative strategies that may need to be adopted if the initial plan proves to be ineffective.

One such example is the circular letter published by the New York Department of Financial Services (DFS) on 10 March, which asks all US insurers regulated by the DFS to submit their risk management plans around the coronavirus as soon as possible (and in no later than 30 days). Law firm Debevoise and Plimpton has produced a useful summary of the letter , which expects the risk management plan to cover both managing disruption to business operations and an assessment of the impact of adverse market and economic changes on a firm’s reserves, profit and liquidity.

One such example is the circular letter published by the New York Department of Financial Services (DFS) on 10 March, which asks all US insurers regulated by the DFS to submit their risk management plans around the coronavirus as soon as possible (and in no later than 30 days). Law firm Debevoise and Plimpton has produced a useful summary of the letter,² which expects the risk management plan to cover both managing disruption to business operations and an assessment of the impact of adverse market and economic changes on a firm’s reserves, profit and liquidity.

The Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) have almost certainly already been in contact with at the least the larger firms in the UK financial sector for a similar update on preparedness and risk assessment. However, all firms would do well to scan for pronouncements like this from regulators in other territories. Not only so that they are well prepared to satisfy any similar requests from the local regulator, but also because these requests very often provide a very helpful guide to inform the completeness of a firm’s response plan.

It is worth noting, however, that whilst certain governments or regulators moving faster than others or adopting different approaches might be useful at a local level in terms of assessing what could happen next, several sets of different (potentially conflicting) advice does create a headache for firms operating internationally.

Scenario analysis

I have highlighted the need for more agile decision-making and, in my view; the present circumstances demand a corresponding pivot to more streamlined, nimble risk management processes. However, this is also not the time to put to one side the very risk management tools that have been designed for the sort of adverse, uncertain scenarios like the one presented by the coronavirus pandemic. Yes, that means rerunning parts of the Own Risk and Solvency Assessment (ORSA) and refreshing scenario analysis; we may well be just at the beginning of the crisis and even considering the spread of the virus in isolation suggests multiple potential ways the situation could develop. Please see the chart below.

International organisations, public institutions and industry bodies are already providing the information and access to domain expertise that is necessary to inform updated risk analysis directly relevant to the coronavirus. For example, on 2 March, in response to coronavirus pandemic, the Organisation for Economic Co-operation and Development (OECD) published a revised economic outlook,³ which contained revised forecasts for economic growth in 2020. And the Department of Health & Social Care’s coronavirus action plan⁴ provides insight on the UK government’s view of a “reasonable worst case scenario” including the potential for a fifth of employees being unavailable to work during a peak period of infection.

Operational resilience

A final thought, in December 2019 the FCA, PRA and Bank of England published their joint Consultation Papers on Operational Resilience,⁵ the consultation period of which closes on 3 April.

Whatever the measures that are ultimately implemented, the coming months will inevitably see a large increase in coronavirus cases here in the UK, and this increase will have severe direct and indirect consequences on every firm’s operational capability. With those consequences will come an unfortunate and unwelcome chance, at some point in the future, for firms to properly (rather than theoretically) assess just how resilient they are.