At the onset of COVID-19, almost 40% of businesses had failed to regularly test their risk and crisis plans, an Australia-wide survey of almost 400 governance and risk professionals and senior executives has found, leaving them exposed to major risks.  

According to the Governance Institute of Australia’s (GIA) second annual Risk Management Survey, only 11% were regularly running scenarios around risk events to test how organisations and employees would respond.

GIA CEO Megan Motto said being actively prepared for risk was “a major priority”, in light of the global pandemic after an extreme summer bushfire season. 

Motto said: “COVID-19 has exposed some significant gaps in many organisations’ crisis management and business plans.”

The report, sponsored by accountants and business management firm PKF Australia, was based on an online survey of 399 governance and risk professionals and senior executives mainly in Australia.

Conducted in March 2020 at the start of COVID-19 in Australia, it showed 60% of respondents considered damage to brand or reputation among the top five risks over the next three years, while 59% were concerned by the effect of policy change and regulatory intervention.  

Cyber-crime also featured strongly in the top 10 risks – 50% of respondents nominated that among the top five risks, followed by talent attraction and retention (48%); disruption and failure to innovate (44%); economic shock (40%); employee conduct (39%); and risk from increased competition (37%).  

Motto said the survey offered the latest insights into Australian organisations’ risk landscape. “Risk management issues have been pushed high up the agenda for so many organisations. It has been an extraordinarily difficult year with new risk challenges being thrown in the mix almost constantly,” she said.

The survey found staff conduct, including corruption, bribery and harassment-discrimination issues and legislative and regulatory change (and intervention), were currently the best managed risk issues as more than 50% of respondents rated their management of those issues as “excellent” or “very good”.  

But risks associated with talent attraction and retention, including risks around visa rule changes for foreign workers; threat of disruption, including technological disruption; failure to innovate; the risk around environment and economic shock, including climate change risk, were issues that had the highest number of “fair” or “poor” ratings at more than 35%. 

As COVID-19 unfolded, GIA returned to its survey respondents, asking more questions about the crisis to gain a greater understanding of the effects on Australian companies and how they were coping.

Because of the extremely difficult operating environment at the time, the response rate to the additional questions was lower than the original survey and only 48 responses were received.

But GIA said the answers offered “a valuable insight” to the challenges Australian businesses faced when responding to COVID-19’s effect on their operations. They also indicated strengths and weaknesses in respondents’ business continuity plans and crisis management capabilities when dealing with the pandemic.

Less than half, 44% of respondents, felt their business was “somewhat prepared” for the COVID-19 impact, while 28% agreed their business was well prepared and similarly, 28% said their businesses were not well prepared.

Only two respondents specifically mentioned pandemics being included in their business continuity plans.

Of those who said their businesses were not well prepared, most cited lack of working from home (WFH) policies or capability as a reason. Conversely, those who felt prepared often cited the ability of their workforce to work remotely as the main reason.

Of respondents who felt they were only somewhat prepared, some said while they could work remotely, they had not anticipated the scale of that requirement, brought about by the pandemic.

Some respondents referred to resistance to remote working in their organisations, or an over-reliance in their business continuity plans on carrying out face-to-face business.

Another reason failing to be prepared for the COVID-19 impact was from businesses dependent on functions the crisis had restricted, eg international travel or face-to-face delivery of products or services.

Similarly, those who felt they were somewhat or well prepared to deal with the crisis, cited working practices well-suited to remote working, eg not client-facing.

Many believed having business continuity plans helped to be prepared for the crisis. One respondent said previous crisis management carried out in the wake of the December bushfires had put them in a better position to react to the virus impact.

Reserve funds were the other recurrent theme informing respondents’ sense of how well prepared their businesses were for COVID-19’s impact.

Lack of reserve funds was cited as a reason for feeling unprepared, while a respondent who felt their business was well prepared cited highly liquid investments; another mentioned having reserves in place.

GIA said once societies began to emerge from the extreme restrictions currently in place, companies would need to consider what they have learnt from the crisis and how to inform their operations and business continuity planning in future.

There were some suggestions the period could force a permanent shift in working practices, perhaps characterised by different attitudes to WFH and other innovative ways of working.

“Whether that will happen in practice remains to be seen. It would certainly be interesting to see how respondents feel about the impact of the virus on their organisation’s way of working and risk management strategy in a year’s time.”