Building Resilience Through Risk Management: Three Questions for CEOs

The spectacular event of February 24, 2022–the unprovoked, brutal, and barbaric invasion of Ukraine by Russians–was a stark reminder to boards, CEOs, and business leaders of the value of building resilience. In this geopolitical crisis, disruptive risk management becomes salient for thriving rather than surviving in this age of the Ukrainian crisis and beyond.

Indeed, in one of our most popular articles, Organizational Resilience, we argue that resilience is the new competitive advantage, given that disruptions—market-based, nonmarket, or Black Swan—are the new realities of today’s business environment. Thus, the winners will be the companies that boost their strategic resilience capabilities.

As Russia began its assaults on Ukraine, the global condemnation and public outcry grew louder while the business environment deteriorated rapidly. Russia underestimated the will and unity of NATO European allies, given that Russia is the EU’s third-largest trading partner and the major energy source for many European Union countries, such as Germany and Italy. However, the EU is Russia’s biggest trading partner, accounting for over 37% of its global trade. Similarly, Europe accounts for more than 36% of Russia’s imports, and nearly 38% of its exports went to the European Union in 2020.

However, with over 69% of Russian foreign direct investment (FDI) originating from the European Union, the economies increasingly depend on each other. In addition to EU-originated FDI, European countries exported massive industrial goods to Russia, over €310 billion in 2020in machinery and transport equipment, which are crucial for development and Russia’s economic growth.

Understanding Ukraine’s economic relationship with the rest of the world is imperative to building resilient organizations. CEOs and business leaders can ascertain their vulnerabilities by having these granular details. Countries and businesses can assess their vulnerabilities to the Ukrainian and Russian economies by understanding the exposure and resilience of those trading with Ukraine and Russia.

Indeed, the belief that the end of the Cold War was the beginning of a stable and rule-based world order was a dangerous fantasy. Given that Putin demonstrated through his pre-planned and unjustified attacks on the democratically elected government of Ukraine, he is living on a different planet, with a mindset that will have dangerous implications for businesses operating in the region and around the world. That’s why this week, the IMF warned that the ongoing war in Ukraine would devastate the global economy.

Consistent with IMF’s view, in early March 2022, Russia’s central bank governor, Elvira Nabiullina, appeared at a recent news conference clad in all black, heralding severe trouble for the Russian economy by announcing the rapid deterioration of the Russian economy, given the barrage of Western sanctions hitting the Russian economy. That’s why, given the reputational risk of doing business in Russia, many Western organizations from many industries – such as McDonald’s, Visa, H&M, and Apple pulled the plug while condemning the immoral Russian aggressions and the ensuing humanitarian crisis at the Ukrainian borders.

In times of crisis, high pressure, and unexpected disruptions, our experience suggests CEOs and business leaders can make missteps through rosy assumptions—by being repeatedly and spectacularly wrong. This situation can be problematic for stakeholders, including employees and other business partners, who rely on business leaders for guidance. Thus, in this high-stake and deteriorating business environment, sound strategic decisions grounded in good judgment are crucial for an organization’s short- and long-term viability.

In other words, sound risk management in times of crisis is the difference between resilient organizations and those praying for survival. In addition to the Russian invasion of Ukraine, inflation has been rising worldwide since last year, which requires another strategic calculus from sourcing to the end consumers regarding pricing and deploying the proper accounting practice during times of inflation.

Specific Mitigation Strategy Needed For Each Risk Profile

Simply put, risks threatening organizations can be categorized in varied forms depending on the size, industry, and global presence, as well as the interconnectedness of the challenges. Broadly speaking, we have financial and economic risks, operational risks, reputational risks, climate change risks, natural disaster risks, cybersecurity risks, and compliance risks, which organizations worldwide deploy to play by the rules of their industry. For example, recently, cyberattacks brought a German wind turbine operator—Tobi Windenergie Verwaltungs GmbH—to a grinding halt by crippling its satellite while disrupting over 10 GW of German wind turbines. Similarly, the leading Japanese carmaker—Toyota—was forced to shut down its production on March 1, 2022, due to ransomware cyberattacks on one of its suppliers.

Furthermore, with over 1.6 million cars sold in Russia in 2021, the supply chain of many carmakers has been seriously disrupted, including Volkswagen, BMW, and Renault, which heavily relies on Russia as its growth engine. Thus, CEOs and business leaders must understand the inner workings of that thing —disruption in the 21st century. Therefore, the first order of business in building organizational resilience in this age of Russian invasion is crucial for risk management.

Resilience During a Crisis: Three Questions for CEOs

The Cardinal Rules of risk management in times of volatility, uncertainty, complexity, and ambiguity (VUCA) call for scrutinizing assumptions regarding risks and their implications for a company, including most—if not all—stakeholders of the firm’s ecosystem. The granular the exercise, the better the hidden exposure can be uncovered before it’s too late.

The first question is: Given what we know about the evolving Russian aggression in Ukraine, what is the probability that a disruptive event will occur? In classic Bayesian analysis, this stage can be called a prior probability, such as 10% or 29%.

Second question: What does your company risk losing if you make the wrong assumption? In other words, how vast and disruptive will the losses be given assumptions errors?
Third question: how do ongoing factual observations improve your understanding of your organization’s risks? Before the Ukrainian crisis, in the first question, you knew (or know) that a particular risk event was 10% or 29%. Given further data and observations, have the risks increased or decreased? By how much from the prior 10% or 29%?

Strategic response: For CEOs and other executives we discussed, the probability of a worse event occurring has dramatically increased; as such, sound strategic calculus called for mitigation strategies. They include insurance, de-risking the firm’s bet through hedging, deleveraging the balance sheet, doubling down on cybersecurity, supply chain visibility, and developing a new digital strategic vision, among others. The key is avoiding risks you cannot afford, given their disruptive implications on your organization’s short- and long-term strategy and purpose. Indeed, our experience in helping companies build resilience in this age of COVID-19 suggests that only 20% of companies in crisis (facing disrupting issues) fully recover, 33% of firms disrupted are beyond recovery, and 49% of disrupted organizations (in crisis mode) thought to by the management and observers as recoverable, genuinely recovered from the crisis.

Building a Risk and Crisis Management Team

Given the evolving nature of the Ukrainian crisis and its implications for commodity prices, supply chain disruption, default risk, and cybersecurity, many companies will need a dedicated team that monitors the crisis—ideally nonstop for 24 hours. The cross-functional team will require expertise in finance and insurance, supply chain, health and safety, deep legal knowledge, strategic risk management, and cybersecurity.

Some critical focus areas will include damage and reinstalling control of the situation, resource allocation (even humanitarian assistance), assets protection, and ongoing communication with other business units, partners, and key accounts worldwide. Moreover, liaison with relevant regulators whenever needed and necessary. Furthermore, scenario planning will be imperative for ascertaining required cash flow and inventory management contingencies, considering the impact of banking and SWIFT sanctions on the Russian economy.

In short, the world’s economy and business environment in 2022 may be a watershed moment for many CEOs and business leaders running some of the largest yet most complex companies. If the Russian invasion of Ukraine confirms anything, corporate performance, and executives’ success will depend mainly on the degree to which they build organizational resilience, the ultimate competitive advantage in this new age of disruption.