Planning for 'black swan' events

March 2013 | COVER STORY | RISK MANAGEMENT

Financier Worldwide Magazine

Whether environmental, economic, political, societal, or technological in nature, ‘black swan’ events are almost impossible to predict and often bring massive repercussions. In an age of economic and political interconnectedness, unforeseen events, even in remote locations, can cause havoc for businesses and financial institutions if not managed properly. Traditional crisis management plans, public relations strategies, and supply chain risk management may fall short when these events surface, but organisations must respond or face being overwhelmed. How, then, can organisations prepare for the potentially catastrophic effects of a black swan event?

Impossible to predict

The term ‘black swan’ was popularised by Nassim Nicholas Taleb in his 2007 book “The Black Swan: The Impact of the Highly Improbable”, to describe large-scale random events that are impossible to predict, yet have huge impacts, explains Carolyn Williams, head of Thought Leadership at the Institute of Risk Management. “In retrospect, we might think that we saw them coming, but they are by their very nature unpredictable in that predictions will either be dismissed as too far-fetched or lost in the noise of the range of possible outcomes,” she says. “A useful example might be the explosion of the Icelandic volcano Eyjafjallajökull in 2010 which led to the unprecedented closure of airspace and six days of extreme travel disruption. The field of cyber attacks may be another area where black swans are currently lurking.”

A ‘black swan’, then, is an event or trend which manifests itself in a way that we don’t anticipate or recognise because we are looking for the manifestation within our experiences. While not all such events have negative consequences – for instance the rise of personal computers or the arrival of the internet – very often they bring high-impact, catastrophic consequences. “Humans tend to look at ‘usual or expected’ risks. It is our nature,” explains Carol Fox, director of Strategic and Enterprise Risk Practice at RIMS, the risk management society. “The 2011 events in Japan might be considered a black swan event. Risk professionals knew that, first, earthquakes in the area were likely; second, that Japan had a documented history of tsunamis; and third, nuclear power facilities and population growth along the coastlines increased the potential impact. All three may have been considered separately as ‘expected’ risks. The black swan manifested itself when three seemingly disparate events occurred in the same place at essentially the same time. That was not within our historical experience, nor was it anticipated.” The manner in which such events emanate from outside the boundaries of our everyday perception is one of the factors that makes them so hazardous – there is no way of comprehending their arrival or their potential impact.

Claiming over 20,000 lives and injuring many others, and with catastrophic property losses and major impacts on global supply chains, the Japanese disaster highlighted a further characteristic of black swans: that their impacts often go far beyond the immediate vicinity of the event, often with global, systemic ramifications.

Preparation and planning

Given that events on the magnitude of those seen in Japan are almost impossible to conceive, is it possible for organisations to effectively plan and prepare? Companies can put in place contingencies to deal with most potentially damaging eventualities, but are traditional risk management strategies sufficient to safeguard against black swan events?

When planning for the unexpected, there is clearly a line to be drawn. Some possibilities are just too remote to justify the expense in time, money and human resources, and at some point boards must assess the cost benefits of attempting to predict the unpredictable. Sensible boards, for instance, won’t spend too much time planning for the eventuality of asteroids hitting the earth. Risk management teams, therefore, would be much more prudent to examine the more well-known avoidable and preventable risks to their business, such as compliance failures or operational health and safety risks. “These are risks that the organisation can and should do something about and their mitigation is a basic responsibility of management,” says Ms Williams. “When it comes to the black swan type of risk you can’t predict exactly what these might be, but instead organisations need to focus on the resilience of their key systems and processes to major shocks, whatever their cause. Techniques such as scenario planning, stress testing and supply chain analysis can be helpful here, together with a detailed understanding of the interconnected nature of the organisation and its ‘extended family’ of suppliers, partners and customers.”

While essential in steering organisations from harm’s way, traditional strategies are by no means foolproof, and risks should not be viewed in isolation. In order to effectively protect against major events, risk management must become part of the fabric of the company. “Just as a doctor may miss an important medical diagnosis based solely on reading a patient’s heart rate and blood pressure, traditional risk management can raise important issues, but entirely miss other areas that present equal or more serious consequences,” says Ms Fox. “Leading organisations are utilising enterprise risk management as a strategic business discipline tied closely to their objectives, not just a process or an annual assessment. The difference is in managing the combined impact of those risks as an interrelated risk portfolio rather than treating risks in isolation.”

Responding to disaster

The nature of black swan events means that, despite even the very best foresight and planning, they can rise to blindside a firm with little or no warning. Given their potentially catastrophic nature, a set of flexible and robust procedures is required to minimise their impact and provide aid in the aftermath. While organisations can never be completely prepared for a black swan event, they can attempt to minimise the operational and financial damage when they occur, and protect their reputations.

To keep the firm afloat while it fights fires across a broad front, businesses must prioritise and ring-fence essential services to continue throughout the crisis. Such decisions must be made well in advance, Ms Fox asserts. “From an operational and financial perspective, pre-planning needs to consider what absolutely must continue if operations are disrupted – what delays cannot be tolerated – so that arrangements can be made in advance of the need to be triggered at the time of crisis. These arrangements may include using alternate locations, suppliers or distribution channels, pre-funding arrangements, and notifying insurers. Likewise, advance arrangements need to be made to deal with the crisis aftermath, whether that is employee counselling, restoration vendors or media relationships, to name just a few.” While most organisations will have a crisis management plan in place as part of their business continuity management, such plans must be properly and regularly tested.

Key considerations should include the failure of communications which may disrupt the decision making process. To protect against this eventuality, organisations are advised to decentralise any response program, affording local responders the power and responsibility to tackle crises within their influence. Such regional responders must, however, be encouraged to act within a manner consistent with the organisation’s goals and values, and in accordance with established emergency response procedures. For the response team to be effective, it must also receive sufficient logistical support, which should include primary and backup communications equipment to allow interaction between stakeholders and responders as well as real-time incident updates. Failures in communication and coordination between federal, state and local governmental bodies have been blamed for the poor response in the wake of Hurricane Katrina and subsequent flooding of New Orleans.

Organisations are also well advised to employ a multiple-response approach. Catastrophic events are all too often fought with a linear single-solution response, where only after one tactic is shown to fail, is another employed. Such strategies can act to extend the impact of the incident in both scale and scope. Responders should therefore attempt to identify a broad base of actions, prioritising them for implementation by their expected outcome. While developing and executing such a multiple-response strategy can prove costly, it can be financially beneficial compared to the recovery costs of an accident that has been allowed to expand beyond all necessary parameters. In this respect, the decision taken at Fukushima Daiichi to use temporary transmission lines as a sole source of power, rather than also implementing temporary diesel, has been blamed for the failure to restore emergency power within an adequate timeframe.

Needless to say, the manner in which an organisation deals with a crisis will have an impact on the reputational damage it suffers as a result. While the firm may not be able to foretell catastrophic incidents, it is capable of putting in place certain provisions for the eventuality. Firms that respond rapidly, effectively and in a transparent fashion can come out of black swan events with their reputation intact, if not improved. Pre-planning and training are two critical components in this respect. Crises require collaboration and communication – before, during and after the catastrophic event. Crisis command structures, with defined roles and responsibilities, should be evident so that everyone understands what is expected from whom. Top executives should be seen as a visible source of information and support. Firms that fail to appreciate the scale of the problem, or that withhold information, cannot expect to come out of the situation in a positive light. BP’s response to the Deepwater Horizon incident and TEPCO’s handling of the Fukushima incident are testament to this fact.

Insurance is the sensible fall-back in the event of most unforeseen calamities, softening the immediate need for funds in covering damages, restoring assets and taking additional actions. By their very nature, however, true black swan events can be difficult to insure against, though this is not to say that insurance is not an option. “There is insufficient information to underwrite the risk in the usual way and coverage would need to be extremely broad,” explains Ms Williams. “Payment would need to be made immediately as liquidity is often an issue in the aftermath of a major shock. There is little around at the moment, although there are some indications that the London market is looking at developments. Organisations should of course ensure that their basic insurance coverages are properly in place and, most importantly, should look critically at the capital and other financial instruments they have available to see them through bad times.” In addition to typical hazard, health and liability insurance that protects property and responds to injuries, organisations can buy ‘crisis management’ insurance as part of other programs or as standalone insurance products. Certain insurers are now also offering ‘reputation’ policies, providing coverage for damage to the company brand.

Changing attitudes

While we may think of black swans as rare events, looking back over decades we can see they occur with some frequency. In the first years of the twenty-first century, for instance, black swan events have reared their heads on a frighteningly regular basis. The 2001 terror attacks in the US, the 2004 South-East Asian earthquake, the financial meltdown of 2008 and, most recently, the 2011 Japan Tsunami, are just a few of the disasters that have appeared from nowhere to wreak catastrophic havoc. While it may seem that such events are occurring more frequently, rapid globalisation and advances in communications mean that events in far flung regions of the world now have much wider impacts. In an age where reputation is one of a company’s most important assets, overlooking the issue is not an option. “Reputational risk is ranked as a priority on board and senior executive lists,” says Ms Fox. “While they may not want to spend a lot of resources on preparing for perceived once-in-a-lifetime black swan events, organisations are aware of the need to prepare for dynamic and emerging risks that could impact their strategic objectives in a catastrophic way. Those random, seemingly unpredictable, and unconnected issues, trends and signals are being more formally integrated into a strategic risk management approach.”

Despite the severity of the issue, however, some organisations still fail to pay adequate attention to the risks. An awareness of the hazard of black swans does not necessarily result in action, according to Ms Williams. “A survey last year by the global insurance broker Willis found that only 5 percent of respondents felt that their boards pay significant attention to black swan risks. Yet at the same time over 30 percent thought that their company was vulnerable to severe impact from black swan events. Economic difficulties also make it difficult for organisations, and governments, to contemplate investing in the changes required to increase resilience, which may require re-examination of their business model.”

Perhaps a major factor in the refusal of boards to face such risks lies in a sense of helplessness in the face of uncertainty. Indeed, the prospect of contending with perils on the scale of a black swan event can easily lead to frightened paralysis. Tackling the issue as a monolithic menace is, perhaps, the error of such organisations. Bolstering existing risk mitigation techniques and weaving risk management strategies into the cultural fabric of the firm can help scale down their perceived magnitude, while established continuity plans and preparations for communications failures will show their worth in the case of the worst possible scenario. Black swan events, though rare, are inevitable, and wherever an organisation is located, in an integrated global community almost everybody feels some impact when they strike. They are dangerous and unpredictable, but black swans can, and must, be tamed.

Matt Atkins