In today’s VUCA world, Risk Management has been on the CFO’s radar since the global financial meltdown. Not only are CFOs worried about the economic situation of the world, they have to also deal with compliance of the many regulations that bears down on the illegal transfer of money in a seamless electronic world. More trade agreements in recent times which also spells out more compliance and monitoring, something that the business people tend not to focus too heavily. Country embargoes and natural disasters also spell RISKS to the CFO.

Yes, where the process of Risk Management which used to be the purview of Risk Managers has now given CFOs (especially global CFOs) sleepless nights. The threats of war, unrests and natural disasters are slowly getting more focus than the previous risks of exchange rate fluctuations, general economic risks, country political risks and operational risks.

As CFO, have you looked at your Risk template or software and made modifications to it in recent years? If you have not, that becomes a Risk itself. Without objectively looking at trends of all natural risks surrounding your global operational sites, you as the CFO cannot create plans to mitigate those risks. How do you steer away from a storm if it does not even appear on your radar screen. If you don’t see the risks, there’s a 75% chance that your people at the operational site will not even consider these risks.

Let’s look at some risks which are mostly taken for granted.

Natural Disaster - Earthquakes

For this risk, I see 2 groups, one that have never experienced an earthquake and therefore will deem that an earthquake will never happen; and the one that experiences 20 tremors each year and therefore it becomes ‘business as usual’. The mentality of “we have experienced 20 tremors and only 2 were considered larger than usual, but we survived” is something that I equate to “we have 0.5% more stock losses than average but only these 2 years, the average went up by 1%”. In the earthquake scenario, it is highly likely that the risk is not even recorded somewhere, or if it is, it is brushed off due to lack of clarity. However, for the stock risk, you would probably send a team of auditors  to investigate. But consider the values behind it, the tremors could have happened near one of your major plant which would have resulted in total loss. But this risk is usually in our blind spot.

Globally, the number of tremors and earthquakes have increased by more than 30% in the past decade ending 2012 compared to the previous decade and it is occurring in places which has never had an earthquake before.

Natural Disaster – Floods

Another disaster which is usually downplayed in a Risk exercise is one of flood. Yes, some areas are prone to floods and it is perceived to be an inconvenience for a few weeks and usually there are insurance covers. These are floods following heavy downpours but floods can be due to other reasons and can be of a larger magnitude.

For instance, the tsunami that devastated parts of Japan caused by an earthquake. An impact from a meteorite on the eastern seaboard of the US (or any other country), large enough to cause tsunamis and wash away cities is not only a possibility but a likely event as well. Not only will there be high fatalities, there are also other risks like losing entire IT facilities which are housed in one of the buildings there, similar to the 9/11 incident where a lot of companies lost entire IT teams.

Terrorist Attacks – EMP

Unlike any bomb attacks, where the disaster is limited to the immediate site, an EMP would basically black out the entire city. Communication is stopped immediately. Part of Risk Management is to have a communication tree in place to ensure that risk assessment can be made and communicated to the HQ. How then can this happen when all modes of communication are rendered useless. If this was followed by biological or other means of terrorism, there is no way information will flow.

Part of the Risk Management exercise is to develop a contingency plan as well as a means of communication to the right people in Management in the event an incident occurs. But we usually plan for medium size emergencies, perhaps up to a point short of a sub-national disaster. There are contingency plans drawn up, with relative good emergency call trees set up but what if there is a total breakdown in communication lines? What would be the fall back strategy, how does one call one another or inform the HQ that safety of staff have been verified and that it is either business as usual or business is stopped until further notice (this can be where the safety of an area falls below acceptable levels).

Some of these scenarios are not only possible but are slowly increasing in likelihood:

1. Major earthquake (> 8.0) strikes a cluster of countries that have never experienced an earthquake before
2. National power and communication outage due to a terrorist strike
3. Tsunami hits capital where your office is after an earthquake
4. Global HQ destroyed together with data center

These are the areas that has not evolved much even when the risks associated have long time (at least a decade) evolved to become a real threat to the business and your team. Isn’t it time to consider Risk Management 2.0?