Risk Management Strategies for Small and Medium Enterprises (SMEs) to Survive in the COVID-19 Economy

Identify, Assess And Manage The Risks

Here are the key steps to success:

The first step is to identify and understand risks which are very unique to your business. The best way to do it is to use the existing risk management principles to make improvements as per your current needs so that you will not only weather the present COVID-19 crisis, but also get back to high performance quickly.

What are the Risks to Identify?

The biggest risk is COVID- 19. Infection to those who may be at risk may include your staff, visitors to your business facility, cleaners, contractors, etc. Other risks may include disruption due to social distancing, plummeting employee productivity, tensed supply chains, recession, unemployment, investment pull-back and civil unrest.

Apply the principles of Risk Management to identify the risks

If you already have a risk management practice in place, you can use its principles as shown below as ready reckoners, or you can start following the tried and tested practices.

Enterprise Risk Management (ERM):

Systematically helps identify, assess and monitor a wide range of risks (e.g. strategic, financial and legal risks) and the need to find mitigation strategies.

Operational Risk Management (ORM):

Provides insights on how to catalog operational risks and associated details in a common risk repository called a risk register, and link risk appetites to business objectives which can enable assessments of risk to calculate inherent and residual risks and help in creating risk mitigation strategies.

Digital Risks:

These can occur due to risks associated with enterprise technologies and third parties. During this time of COVID-19, risks can come even from social engineering scams.

 

Business Continuity Management:

Plan and execute a centralized approach to business continuity and disaster recovery (DR) management across organizational functions, to improve response time during critical events, and more.

Internal Audit Management:

Provides insights on risks including risk assessments and define action plans to remediate issues and monitor them to closure. How to Assess Risks Steps to follow are:

• Risk identification which follows event identification and precedes risk response

• Develop assessment criteria

• Assess risk interactions

• Prioritize risks as per their probability, vulnerability and speed of onset. You can define these under four criteria like high/some/small/very little probability.

The next steps in risk assessment steps include risk analysis, risk evaluation, risk communication and risk response. Risk assessment helps in reducing operational risks, improving safety and performance and achieving objectives

 

Develop Mitigation Strategies

Depending on your industry, company size, location, and other factors, you can make a wide range of preparations. Your risk response should be driven by the decision of risk acceptance, reduction, sharing, avoidance or complete elimination of each risk. Below are some common areas that will help you plan your risk mitigation:

• You can consider moving your budget from fixed cost to variable spending. Reconsider the rent on office space as more employees are working remotely.

• Cash is king for businesses – it’s wise to cut down unnecessary spending or expansion plans to conserve the cash.

• While focusing on the operational elements of risk management such as taking care of people, having them work from home, it is also critical to think from the viewpoint of compliance by publishing clear HR policies, data security policies, confidentiality and other policies

. • You may choose to shift toward the localization of your supply chain so that you can be immune to the increasing protectionism and risk aversion due to a recessionary climate.

• Digitization: More than ever before, digitization is getting a real push, and everybody is on a fast forward mode to experiment with digital channels into every aspect of their business. But this calls for more investment in the cloud, data, cybersecurity and digital risk management.

• Increase supply chain resilience: While it is good to localize supply chains, it is required to build capabilities in your supply chain to respond to unexpected events quickly or return to the earlier supply chain as soon as possible or innovate to get to a better state.

• Be sure to connect and maintain repositories of all risk mitigation activities, procedures and controls in one place to make it easily accessible when needed.

• Put internal controls in place to mitigate risks. For example, in the context of COVID-19, simple controls may include hand washing, cleaning and social distancing, etc.

 

Do Remote Auditing

After you have put all risk mitigation strategies and controls in place, you need to do auditing to check if all is working well. But during this restrictive time, you will have to adapt to remote auditing as it is a quick and efficient way to assess and minimize errors, and enable significant savings on time and effort. The use of audit functionalities on smart devices has been greatly transforming the changing audit landscape.

• Replicate face-to-face working environments with virtual environments including phones, computers and services.

• Capture organizational communication processes when defining remote auditing

• Virtual storage of records (shared or isolated)

• Broadcast messages – video conferencing, teleconferencing, email or group meetings

• Prepare well before virtual meetings to ensure every dialogue for decision making is covered and before concluding the meeting, clarify action items, owners and deadlines.

• Have a central location that contains an up-to-date contact list with email, phone numbers with work time or work shifts.

• Set up online audit scheduling, format and checklist.

• Use desktop sharing features extensively as necessary for reviewing records, procedures, documents, audit trails, procedure reviews, recording meetings, video conferencing and audio conferencing.

• Use asynchronous communication such as SharePoint offices

 

Put a Business Continuity and Recovery Strategy in Place

Whether you already have a business continuity plan or are putting a plan in place now, consider addressing COVID-19 in the plan. A continuity plan calls out the critical and time sensitive applications, vital records, processes and functions to be maintained, as well as the personnel and procedures necessary to do so, while the entity is being recovered. It needs to have six major components: data critical analysis and data back-up plan (DCA & DBP ), Business Continuity Plan (BCP), Emergency Response Plan (ERP), Contingency Testing Plan (CTP) and Disaster Response Plan (DRP) Here are a few important steps to follow while creating a plan:

• Find and analyze business continuity strategy requirements and document them.

• Review issues related to business recovery, technology and non-tech recovery issues for each support service.

• Identify, analyze and document alternative recovery strategies.

• Compare internal and external solutions assessments of risk associated with each optional recovery strategy.

• Assess suitability of alternative strategies against the results of a business impact analysis.

• Effectively analyze business needs criteria, and the objective of planning and evaluation method.

• Senior management must be aware of the cost/benefit analysis of recovery strategies and recommendations from experts.

Despite the uncertain times we’re living in right now, with a risk management and business continuity plan in place, you won’t miss a beat. One thing that’s special about businesses that have a robust risk management plan is that they will get through the difficult COVID-19 crisis, will have a V-shaped recovery curve and bounce back faster than others.

Stay Safe & Stay Alert