Pandemic Challenges: How to Balance Resilience and Profitability

Pre-pandemic, higher corporate profits were often delivered by under-investing in internal controls and minimizing any operational process redundancy. During the pandemic, inadequate redundancies for unexpected shocks has led to slowdowns or shutdowns of many activities - including healthcare provisions, automobile manufacturing and food availability. Post-pandemic, for markets to return to an acceptable risk level, institutions will need to improve operational resilience by investing heavily in costly redundancy plans.

However, post-pandemic resilience does not necessarily have to come at the expense of profits. Indeed, when money is allocated to strategic resilience activities, profitability increases over the long run. On the other hand, there is certainly a tradeoff between profitability and resiliency for non-critical business processes - whether they are legacy or in the innovation stage.

Let's take a dive deeper into this rationale, and examine the six steps required to evaluate operational resilience.

Figure 1: Operational Resilience Evaluation - A Six-Step Approach

Step 1: Agree on What's Critical

It's often a few critical economic functions that drive most profitability, have the largest customer impacts (e.g., on service interruption and value of data) and demonstrate the firm's importance to market and financial stability. Successful organizations will reevaluate frequently.

Step 2: Map Critical Economic Functions

Dependencies and potential points of failure must be uncovered. This can be determined by evaluating internal people and hand-offs; external infrastructure; internal systems and operations centers; vendors for process outsourcing (such as customer credit and SDN assessments); customer service/call centers; and suppliers.

Step 3: Develop and Rank Scenarios

Where points of failure are identified, determine whether they are internal or external to the organization, and evaluate controls to determine if likely outcomes are acceptable. If not, enhance the internal control or create failover processing redundancies.

For example, if an automated data privacy control fails, evaluate the secondary controls and implement training for a manual process. The extra layer of control and redundancy may appear expensive with respect to O&M costs, but is priceless in terms of averted regulatory fines, minimized customer impacts and stable brand value.

Figure 2: Rank the Scenarios and Define Remediation Plans for Each Potential Failure

Step 4: Stress Test the Potential Failures

The potential failures in critical processes must also be viewed in times of stress. To achieve this, we must create scenarios for points of potential failure in the critical economic functions, while also determining if the potential failure is in the organization's internal control or depends on external variables.

Scenario-based testing often relies upon questionnaires, simulation, expert tabletop exercises and thematic reviews. It is therefore important to understand both internal factors and known-versus-unknown external factors.

Figure 3: Test the Resilience Plan

Step 5: Communicate Priorities

Internal and external stakeholders must understand the pecking order of the firm's economic functions and activities. This means developing a stakeholder map, as well as a communication approach for each priority.

Step 6: Analytic Replication

To ensure outcomes are well-understood and acknowledged, good scenarios need to be evaluated and tweaked frequently from different angles. External inputs are critical, as is the crowdsourced wisdom of a broad base of employees.

Figure 4: Resilience Safeguards Profitability for an Organization's Critical Economic Functions

Parting Thoughts

The aforementioned six-step approach to operational resilience can help a firm determine which of its economic functions are truly critical. After this has been established in a post-pandemic environment, an agreeable risk tolerance can be set, and no trade-off between resilience and profitability will be needed.

Brenda Boultwood is an independent risk management consultant. She is the former senior vice president and chief risk officer at Constellation Energy, and has served as a board member at both the Committee of Chief Risk Officers (CCRO) and GARP. Previously, she was a senior vice president of industry solutions at MetricStream, where she was responsible for a portfolio of key industry verticals, including energy and utilities, federal agencies, strategic banking and financial services. Before that, she worked in a number of risk management, business roles and as the global head of strategy, Alternative Investment Services, at JPMorgan Chase, where she developed the strategy for the company's hedge fund services, private equity fund services, leveraged loan services and global derivative services. She currently serves on the board of directors at the Anne Arundel Workforce Development Corporation.