Risk Advisory By Jeremiah Ndhlovu
To … not prepare is the greatest of crimes; to be prepared beforehand for any contingency is the
greatest of virtues. (Sun Tzu)
The Euromonitor International had a caption “Commodity Market Outlook Q1 2024: High
Uncertainty Amid Soft Economic Outlook and Geopolitical Risks”, dated 29 th February 2024, on its
website. Messages like that of the Euromonitor International above spell hopelessness for entities
that are caught unaware by negative occurrences, which they ostensibly do not have control over.
Such entities’ expectation would be that the uncertainty would be brief, so that they return to the
usual operating environment. Any sustained negative occurrences may lead to entities ultimately
ceasing operations. The key questions, from a risk management review, is that “can entities do
anything to continue operating when faced with such uncertainties, which are supposedly beyond
their control?” The response to this question on the affirmative as entities can do something to
better their chances of survival even when faced with uncertainties seemingly beyond their control.
Remember, one response strategy to risk is mitigation. For any risk occurrence that is beyond an
entity’s risk appetite, and which cannot be avoided in an entity’s thrust to prosper, some mitigation
measures need to be applied to ensure that the residual risk is reduced to within the entity’s risk
appetite. The scope of this article dwells on the rationale of formulating, and the impact of,
contingency plans on entities’ critical operations.
For many entities, risk management is mainly related to implementation of control activities to
mitigate risks that are related to usual or normal operations. Risk management is, however, more
critical in situations that are less routine, especially those so pervasive that they have a potential of
ceasing any entity’s operations. The main challenge with such non-routine occurrences is that they
occur so unexpectedly that affected entities would not be aware of the ideal response(s) and, more
often than not, the entities’ responses are triggered by panic rather than well thought out measures.
This is mainly due to the sense of urgency to curtail the impact of the uncertainty. The risk
management field has identified some of those impactful occurrences and frameworks have been
recommended, e.g. disaster recovery plans (DRPs) for the information technology (IT) field and
business continuity plans (BCPs). The DRPs and BCPs are, however, mainly premised on usual
operational scenarios like non-availability of IT infrastructure and applications, premises, and
people. An entity’s continued existence can, however, be curtailed by a host of other inexhaustive
factors, including sudden incapability to meet operational costs, which might be the case arising
from depressed commodity prices in the market. So, in addition to DRPs and BCPs entities ought to
identify all those other factors with a critical and pervasive impact on the entities and ensure that fit
for purpose contingency arrangements are formulated.
Developing contingency plans is a critical process for each entity. It calls for consideration of
comprehensive operational and stress scenarios to ensure that adequate contingency arrangements
are put in place well ahead of any occurrence of disruptive events so that responding to such
uncertainties when they occur will be a matter of implementing a well thought plan.
A critical risk management principle of reverse stress testing becomes handy is developing scenarios
that assist with assess an entity’s level of strain when the actual results are compared to the
expected thresholds or limits. Reverse stress testing allows an entity to identify and assess
circumstances that would lead its business model or critical process or activity to become unviable.
Assessment of actual results or performance to the critical breakpoint point allows an entity to build
in interim triggers that will allow it to start responding to the drift towards the unviable position
before the critical break point has been realised. Such level of scenario analysis and stress testing
allows entities to reflect on the most idle responses in the event that such scenarios or stress
conditions materialise. A contingency plan can, therefore, be formulated based on the results of the
scenario analysis and stress testing exercises.
Developing a contingency plan is the first critical step as the business environment is very dynamic.
Due to uncertain nature of future events, assumptions may be used to buttress some of the
contingency plans that entities formulate. To ensure that the solutions in the contingency plans are,
and remain, fit for purpose, the plans need to be periodically tested to provide comfort that they will
work when the need arises.
Set strategies and performance metrics do not always materialise due to reality differing from
assumptions used when coming up with the initiatives. Entities, therefore, need to build agility into
their operating frameworks, and contingency planning becomes very hand in this regard.
To ensure agility and overall resilience of entities, it is imperative that all the factors with significant,
and usually pervasive, impact on the entity are adequately evaluated through scenario analysis and
stress testing. The results from the evaluation should be used to formulate a customised
contingency plan that can be effectively utilised in case of a disruptive event related to critical risk
factors. This will enhance chances of entities remaining functional even in case of significant
operational and financial occurrences.
As stated by Teal Swan, “a contingency plan doesn’t just protect you from being blindsided by
adversity. It also protects you from focusing your energy towards adversity”. Let’s consider areas in
our businesses that warranty formulation of customised contingency plans.
About the Author
Jeremiah Ndhlovu is a Certified Expert in Risk Management (CERM). He has acquired extensive risk
management insights in the mining sector through outsource projects including enterprise risk
management, combined assurance, process and controls standardisation, internal auditing and
external auditing.
This article is for information purposes only.
