The global pandemic has provided an enormous shock to businesses and, for many in the mid-market, fundamentally tested their ability to deal with crisis and disruption. Indeed, according to Grant Thornton's IBR data, 42.2% of global respondents think they will need to improve crisis management processes after the COVID crisis.
But those businesses with robust governance and contingency were able to respond to disruption more quickly and, in doing so, minimised their exposure to risk and improved their reputations accordingly. As businesses look to the future and attempt new initiatives, a proactive risk and governance approach can successfully deliver innovation and growth.
There is often a tendency to look upon risk and governance as solely defensive measures. Often focused on compliance - and aimed at avoiding negative consequences – the benefits of good governance is frequently overlooked.
Eddie Best, global co-leader of business risk services and partner at Grant Thornton UK, says: "It's actually about creating value. It's as much about the upside and making sure programmes are successful as it is about managing the downside.
"It's about supporting customer-facing initiatives, but also bringing technical rigour. It means asking questions from a security perspective, for example, or thinking how is data being handled.”
Good risk management and governance come from appreciating that they are intrinsically linked to new business initiatives and operations – not an afterthought to them. “You look at the opportunity and cover off the risk management piece that goes with it", says Best.
Victor Sekese, group chief executive at Grant Thornton South Africa, says: "Boards have been challenged; in the board's minds currently are two things: (A) survival now, and (B) survive beyond COVID-19. And they're starting now to deal with the key issues. The pandemic is forcing businesses to go beyond lip service to their governance frameworks and compel them to go back to basics."
It comes down to the board setting its strategy and risk appetite and then cascading that approach through the business successfully, through delegating authority, and implementing appropriate processes and reporting around key investments and programmes, and making sure the technology environment is robust.
Best says: "It's nothing more than good commercial business management. The best-run businesses, typically have the CEO, board and management teams continually looking at all these aspects refreshing priorities, strategy, comms, so that they're keeping pace with what's going on."
In the past, businesses would develop a plan and perform a refresh and review with the board quarterly. Today, companies need to do that more regularly. "If you don't keep your eye on the ball, someone else will eat your lunch, or the economy takes a dive or government policies changes. The pace is fundamentally different and much more tech-driven.
"Those thought processes around sense checking your strategy, and your priorities are almost a daily, real-time imperative now."
Businesses need to keep track in real-time through the use of technology. They should embrace powerful tools that distil complexity and provide data through dashboards, such as monitoring highly complex supply chains. But Best says technology is a double-edged sword. It does enable quicker, often better decisions but it comes with its own cost, complexity and risk.
"At a programme level in the past, decision processes would follow a waterfall approach where you have a structured plan with stage gates, and go, no-go decisions. Today, people are moving into the agile methodology where there is less structure. People come together for scrums, make decisions and then have shorts bursts of activity. It's a more informal but nimble approach to delivering key programmes.
"However, you don't see so many programme management officers as you used to, which can be a good thing because it enables pace. The downside is that there's not as much visibility and sometimes not enough rigour to decisions. Basic things like interconnection between different project streams sometimes get missed. When people run at pace and take away layers of governance and documentation around some of these projects, mistakes can happen."
Technology has a role to play in that, but a lot of it still comes back to human action and decisions and behaviour. It's not that one way is universally better than another, but instead that each project requires assessment and striking a balance to provide the best outcomes.
"Culture is fundamental," says Best. "If you look at the major frauds and errors, it mostly comes down to poor behaviour, judgement and culture."
"If you remove some of the checks and balances and you encourage people to go in a certain direction, you shouldn't be surprised when they overstep the mark, and do things that are inappropriate in pursuit of profit or whatever it might be.
A culture audit can bring to the surface some of the beliefs and behaviours within the management teams that enable people to act badly and take unnecessary risks.
"Culture is not an accident. You determine the culture you want. And some drivers deliver that around strategy, leadership, people management, and the process within the business so that you hire the right people, you train them the right way, and you reward and promote them in line with the culture you want in the business."
COVID-19 is disrupting many businesses, including their working practices and the way they sell products and services. Transformative innovations – both operationally and technologically – will play a key role in recovery but business must assess whether their risk management and governance processes are still fit for purpose. Do remote teams, for example, need extra layers of governance to ensure they are not pressured into behaviours that may betray best principles? While businesses must nail down the crisis management aspects they must also retune their processes to ensure they deliver on their strategic goals.
Speak to your local Grant Thornton adviser to discuss any aspect of risk and governance in your operations.
