As 2024 begins, the Professional Services Practice’s Keith Tracey reflects on the upheavals of 2023 and solutions that may be useful in the current professional service firm risk environment.

Welcome to the “Polycrisis” where historian Adam Tooze comments, “economic and non-economic shocks” are entangled “all the way down”. Permacrisis, Collins English Dictionary word of the year for 2022, is an extended period of instability and insecurity.

It feels like currently we are experiencing both.

We have had an inflation shock and an energy shock. There are increasingly fractious relationships between countries and geopolitical tensions are high, with a prospect of interconnected conflicts. Added to these stresses is the manifestation and future threats of climate change.

This fundamental uncertainty goes beyond traditional risks, over which one may have some control. These megathreats are less easy to identify and assess. The traditional risks are still there of course and need to be managed. What can one do to address this uncertainty?

Risk Perception

The perception of risk and the relative importance of individual risks clearly varies between organizations. To give two examples of perception, a CFO may focus on the risks to cashflow. Costs are somewhat predictable and therefore cash flow is the key measure. The CISO would of course be focusing on other risks, but they may be interrelated, thus emphasizing the need for a multidisciplinary approach.

What would a politician say? Artificial Intelligence is in news and of course this is a broad issue with consequences for employment and society. A Professional Service Firm would also focus on AI risks, but through a different lens. Another example of differing risk perceptions is the exposures relating to environment, social and governance issues, and their required responses.

What Risks

It is the season for the publication of risk surveys. What can they tell us? Some of the risks identified have been around for a while but are now more severe and have a higher probability of occurring.

Looking at one list we see the usual suspects cyber and digital disruption. Following that we see a list of risks that have always been with us, but perhaps in today’s world are a bigger threat, including talent retention and skills, and changes in laws and regulation. These may require a different approach as the consequences become more severe.

Commonly identified are macroeconomic and geopolitical uncertainty, digital disruption and new technologies.

Recency bias is clearly on display each year in these survey results.

What are the Solutions?

Here are four areas to build on.

1)   Risk Identification

A straightforward conventional exercise can be supplemented by a number of enhancements that should extend its horizon and scope. Consider scenarios and root cause analysis. A PESTEL (Political, Economic, Social, Technological, Economic and Legal) exercise is a productive tool in today’s world. What are the potential effects on clients and revenues?

Two additional variations might be:

• List the top 10 risks from a survey such as World Economic Forum or Aon’s Global Risk Management Survey and go through them assessing exposure and what mitigation could be employed.
• Map the value chain and crucial points of risk. Build mitigation from that analysis.

2)   Risk Appetite Statement

This is a phrase that is thrown around but is very powerful when well executed. Powerful statements can be used to set out approaches to risk, such as, “we have no tolerance for”, or “we are willing to accept a degree of risk here”, or “we have systems in place to manage this risk which is an inevitable part of the business”.

3)   Business Continuity

Are some risks too big or remote to plan for? Response planning will be used to mitigate the risk. Business continuity, operational resilience, crisis management and disaster response are required. COVID was predicted but nobody was prepared.

4)   CRO Role

The CRO sits across functions and is not just managing the downside elements of risk. By participating in the firm’s strategic discussions, the risk appetite can be developed that balances risks and rewards.

Final Thought

Always remember, the most disastrous risk consequences often arise from a failure of ethics or fundamental values.