Most of the focus of more than 900 audit and risk leaders, surveyed by Gartner, is on assessing the impact of coronavirus on organizational operations and controls, as well as revising and executing the company audit plan. Just 4% of respondents reported that updating the board was their primary focus at this time, while 21% reported executing the audit plan as the top priority (see Figure 1).
?Many enterprise risk management (ERM) teams are finding that the board and executive teams are postponing risk committee meetings and are not getting exposed to risk-based insights on the impact and opportunities associated with the crisis,? said Dan Herd, vice president in the Gartner Audit and Risk practice. ?These teams need to be proactive, getting ahead of committee meetings with relevant, business-focused agendas that demonstrate the value ERM provides in a stronger internal consultant role to the executive team in the midst of such uncertainty.?
While many organizations had included a potential pandemic as one of their top risks, few anticipated the severity of COVID-19?s impact to their operations and health of the business. ERM teams report that crisis management generally has been successful in terms of keeping employees safe and moving to a work from home environment, but organizations are struggling to manage the downstream effects of the crisis, such as disruptions in their supply chain, additional productivity-related concerns, and other third-party considerations.
Altered Risk Landscape
There was a consensus among survey respondents that coronavirus had dramatically altered the risk landscape most organizations face, introducing some very fast-emerging issues. Impacts, such as a rise in mandatory/voluntary work from home, shift in customer behavior, preparedness for cost optimization, and third-party or supply chain risk all have accelerated or changed priority.
ERM teams are monitoring several implications of working from home becoming the new normal, such as cyber security risk, shifts in productivity, and how they can operate an ERM program remotely. For example, they are evaluating how to run a risk workshop while everyone is working from home.
ERM teams are speaking with risk owners to determine how the risks they own have changed and if their mitigations are effective. ?Audit and risk leaders need to distil this information and use it to focus discussions with the board and senior leadership around the near-term business impact of these risks to ensure the enterprise response is updated to reflect the current environment,? said Herd.
Immediate Actions
The tactical measures that most ERM leaders are taking immediately are:
- Updating risk assessments to account for changes in risks such as third party, supply chain and cybersecurity, and ability to execute remotely
- Working with senior leaders to ensure the organization does not adopt a disproportionately risk averse posture
- Working with senior management to ensure cost optimization decisions account for risk and potential impact
- Updating communications to the board and management with specific risk-based insights surrounding near-term COVID-19 impact and recommended actions steps
Lessons Learned
Another way the ERM team should seek to demonstrate value and leadership during this crisis is by liaising with the numerous teams managing different aspects of the crisis.
?ERM should use its unique position having an enterprise-wide purview to extract lessons learned from the teams involved in managing the crisis,? said Herd. ?These lessons include understanding the efficacy of business continuity and crisis management plans, interdependencies, and emerging risk sensing and assessment practices.