Conventional risk management tools are appropriate for managing known or anticipated risks; but threats outside these areas need a different approach. Dr Sandra Bell says that stress testing is one tool that provides the answer, helping identify and correct organizational vulnerabilities in a safe environment.
Introduction
A resilient organization is one that can fulfil its strategic aims, such as economic growth, developing competitive advantage or increasing profits, regardless of any adverse issues it faces either internally or externally. Such an organization is seen to not only survive operational disruption or hostile market environments but succeeds in thriving, despite them.
Conventional risk management tools, such as root cause analysis, SWOT, and probabilistic risk assessment (PRA), can be used to manage known or anticipated risks. But more sophisticated approaches to risk management are needed to cope with the following scenarios: risks that we suspect are more likely to occur than historical observation suggests due to some underlying cause; extreme events that we can imagine but have never actually occurred to our knowledge; or situations where we cannot rule out that the complexity and uncertainty of the environment in which we operate will result in unexpected impacts or conditions.
Stress testing offers a way to identify and correct organizational vulnerabilities in a safe environment rather than learning the hard way through experience, and suffer additional brand damage. Hindsight is always 20:20.
What is a stress test?
The term ‘stress test’ is used to refer to a range of techniques used to assess the vulnerability of an organization to major environmental changes or to exceptional, but plausible, events. The objective is to make risks to the organization more transparent by providing information about the behaviour of the organization under such circumstances.
What the stress test looks like depends on what you are trying to achieve. For example, you can construct a test that investigates a single risk to an organization, such as the credit risk in a financial institution or supply risk in an energy company, or multiple risks such as all events that could disrupt business processes within a manufacturing business.
You can also probe a single risk factor in isolation (a sensitivity test), or a group of risk factors (a scenario analysis). Likewise, if you know the combination of factors that would cause the greatest damage you could deliberately stress this subset of factors and keep all others constant (maximum loss approach). Finally, the test can be based on historical scenarios or hypothetical scenarios, constructed to take account of plausible changes in circumstances that have no historical precedent.
Creating the scenario is the hardest aspect of stress testing, as it requires a significant amount of practical expertise and judgement to ensure the correct risks and factors are identified, together with imagination and creativity to ensure that it is relevant, believable and viable.
Using stress tests to future-proof policy
Resilient organizations are alive to the potential of significant changes in their environment and adjust their policies so that they remain optimized. One way they do this is by using stress tests.
For example, within the energy sector most organizations have carbon dioxide emission reduction policies designed to contribute to international efforts to avoid the most dangerous impacts of climate change. In most cases this involves an increase in the use of renewables such as wind and solar power. However, whilst reducing emissions may avoid the worst case scenario, our climate is still changing and extreme weather events are becoming more severe and frequent impacting the reliability of energy supply from solar and wind that are highly dependent on the weather.
By using stress tests where the scenario reflects the outcome of the proposed policy (e.g. a world where 50 percent of energy comes from renewables), energy organizations such as the UK National Grid and Scottish Power have been able to test themselves against future weather scenarios. This has enabled them to identify that there are realistic future scenarios where energy supply will fail to meet demand and, rather than find out when it happens, implement contingency arrangements, such as sourcing energy from different countries and building resilience into the system to ensure that the lights stay on and the UK stays on track for a low carbon future.
Using stress tests to build relationships
There are three key ingredients to being able to thrive despite market challenges and operational risks. First, businesses need to be adaptive, knowing when to change and optimizing policy and operations according to the outside environment. Leadership is also crucial – with leaders instilling in people the will to succeed during challenging times. The third and final area - one which is frequently neglected by organizations - is their network. Forging and maintaining effective relationships with stakeholders, customers and suppliers is a key component, not simply to being able to maintain successful operations, but also to maintaining a competitive advantage and achieving profit and growth.
Stress tests can also be used probe relationships at a deeper level and identify whether the necessary confidence and mutual trust exists to allow cooperation under stress to take place. If not, concrete measures can be taken to build these vital components of an effective network. For example, even though the energy sector has ensured that it can maintain supply even with a low-carbon policy, balancing supply and demand in extreme weather situations, where supply is threatened and demand simultaneously increases, relies on a joint effort between the energy companies and their customers.
In summary
Organizations need to set long-term policies to achieve long-term aims. However, the world changes fast and it is important to ensure that the ideas and plans that are written into policies and used as a basis for making decisions and guiding actions do not have unintended consequences in the future. As if often stated, no plan survives first contact with the enemy. Professional stress tests can be carried out through external organizations and will help businesses to optimise their risk management and increase their resilience. Resilience must work at all levels– executive, operations, technology – and designing and delivering stress tests is one such way in which resilience can be comprehensively assessed.
The author
Dr Sandra Bell, Head of Resilience Consulting, Sungard Availability Services.
