Too many risk managers focus only on ‘what their boss is concerned about’

Do companies in Asia have tested and robust plans to manage the risks that challenge the region? And are risk managers buying the right insurance products to manage their exposure to threats such as cyber risk, supply chain disruption, reputational risk and natural disasters?

The Malaysian Association of Risk and Insurance Management (MARIM) conference, Securing the Future through Risk and Resilience Management, kicked off this morning with these questions, posed by MARIM chairman Mohamad Bin Mohd Zain.

Mohd Zain, who is also vice-president of group business assurance at Telekom Malaysia Berhad, told delegates – including representatives from StrategicRISK – that businesses had to focus their resources on delivering resilience and protecting reputation.

Facing new risks

One of the conference’s first plenary papers duly examined these issues. In Risky Business: Risks and challenges faced by Asian business today, regional director of the Business Continuity Institute and managing director of Business Continuity Planning Asia Henry Ee said that major technological, political and population changes had introduced new risks to business.

Ee, who was part of the technical committee for Singapore Standard SS 540:2008 and the British Standard BS 25999, also examined the business continuity management (BCM) implications of ISO 22301, a management systems standard for BCM introduced in 2012.

He said that BCM involved developing a framework, employing recognised and effective methodology, recognising industry guidelines and complying with any relevant regulations.

“More and more organisations are seeing the importance of better business continuity in the supply chain, especially key dependencies,” he said.

Climate stress

Ee went on to look at how climate-related issues were causing real economic stress, citing the haze in south-east Asia and flagging the issue of food security in an environmental context.

Contingency planning was vital for dealing effectively with everything from typhoons to IT crises, he said.

Human safety must be considered first. Without the people, there’s no business’

Of even greater importance was an organisation’s staff. “The most important thing is the people plan,” he said. “Human safety must be considered first. Without the people, there’s no business.

Ee said a risk manager should examine how their firm’s people are likely to behave in a crisis. “How are your people going to react?” he said. “And look at your dependencies – how other companies’ people are going react to a crisis is of equal importance to how you will react.”

Management support

He finished by saying that the support of management was essential to assure the effectiveness of a BCM plan.

“Without it, it’s very difficult to move ahead,” he said. “A lot of the managers are only concerned with what their boss is concerned about. If top management is supportive, you have a better chance than the guy starting at ground zero.”

For the full conference program and a list of speakers, go to www.marim.org