Catastrophe risk management: Preparing for potential storms ahead

623 views

Published on

The Economist Intelligence Unit surveyed 225 executives around the world in June 2006 about their attitudes to, and experiences of, building preparations for catastrophe into their risk management processes. The survey was sponsored by ACE, IBM and KPMG. Respondents represent a wide range of industries and regions, with roughly one-third each from Asia and Australasia, North America and Western Europe. Approximately 50% of respondents represent businesses with annual revenue of more than US$500m. All respondents have influence over,or responsibility for, strategic decisions on risk management at their companies. The Economist Intelligence Unit's editorial team conducted the survey and wrote the paper. The findings expressed in this summary do not necessarily reflect the views of the sponsors. Our thanks are due to the survey respondents for their time and insight.

Published in: Business, Economy & Finance
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
623
On SlideShare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
9
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Catastrophe risk management: Preparing for potential storms ahead

  1. 1. Catastrophe risk managementPreparing for potential storms aheadAn Economist Intelligence Unit white papersponsored by ACE, IBM and KPMG
  2. 2. Catastrophe risk management Preparing for potential storms ahead About the survey The Economist Intelligence Unit surveyed 225 executives around the world in June 2006 about their attitudes to, and experiences of, building preparations for catastrophe into their risk management processes. The survey was sponsored by ACE, IBM and KPMG. Respondents represent a wide range of industries and regions, with roughly one-third each from Asia and Australasia, North America and Western Europe. Approximately 50% of respondents represent businesses with annual revenue of more than US$500m. All respondents have influence over, or responsibility for, strategic decisions on risk management at their companies. The Economist Intelligence Unit’s editorial team conducted the survey and wrote the paper. The findings expressed in this summary do not necessarily reflect the views of the sponsors. Our thanks are due to the survey respondents for their time and insight. September 2006 © The Economist Intelligence Unit 2006
  3. 3. Catastrophe risk management Preparing for potential storms ahead Introduction F or most senior executives, there is barely attacks of September 11th 2001, and H5N1, the strain enough time to manage the crises they face on of bird flu that is currently causing concern around the a day-to-day basis, let alone a set of events that world, evolved only in the late 1990s. may never happen. It can be tempting, therefore, The recent foiling of a major plot to cause multiple to consign preparation for catastrophes such as explosions on transatlantic jets demonstrates pandemics, terrorist attacks or seismic activity to that the threat of terrorism remains very much in the bottom of the corporate agenda. But as the our midst. And as the United States enters a new devastating 2005 hurricane season, the continuing hurricane season, which many meteorologists have threat of a global avian influenza (bird flu) pandemic predicted will be as severe as last year’s, the damage and the recent terrorist attacks in Mumbai, London, caused by extreme weather events remains a pressing Madrid and elsewhere have shown, the capacity concern for businesses with operations along the for low-probability, high-impact events to cause eastern and southern coasts of the US. However, in death or injury, disrupt operations and damage terms of economic damage and loss of life, a global reputation is something that cannot be ignored. As bird flu pandemic threatens to dwarf both these a result, preparation for catastrophe is becoming threats. According to Risk Management Solutions, a an increasingly important component of many company that specialises in the development of risk companies’ risk management strategies. models, there is a one-in-five probability of an H5N1 The objectives of this survey and report are to flu pandemic being more severe than the influenza assess levels of preparedness for catastrophe among outbreak of 1918, which is estimated to have killed companies around the world and to find out what between 50 and 100 million people worldwide. executives at these organisations see as the most When asked about how serious they consider a range significant threats they face. We report on the tools of threats to be to their business, respondents to our and techniques that companies are using to manage survey cite power outage as being the most significant, catastrophe risk, the frequency with which they perhaps reflecting what they see as the relatively high update their plans and the level of confidence that probability of such an event occurring. Next on their they possess with regard to specific aspects of their list comes bird flu, which is cited by 43% as being either catastrophe risk management. significant or very significant, and then terrorism, which is seen as a significant or very significant threat New threats on the horizon by 35% of respondents. Perhaps not surprisingly, Companies have always faced threats from given that bird flu has so far had a greater impact in catastrophic events, such as earthquakes, hurricanes Asia than elsewhere, respondents from that region are or major social unrest, but some of the most pressing more likely than those from the US or Europe to see concerns now facing the global business community the threat as significant. Likewise, US respondents are relatively recent phenomena. For example, are more likely than those from other regions to see terrorism, although by no means a new tactic, first extreme weather events as a significant threat, which received significant corporate attention following the reflects concerns about intensifying hurricanes along © The Economist Intelligence Unit 2006
  4. 4. Catastrophe risk management Preparing for potential storms aheadHow significant does your organisation consider the following threats to be to your business?(% of respondents) 1 Very 2 3 4 5 Not Don’t know significant significant Bird flu 16 27 19 13 23 3 Terrorism 12 23 27 19 18 1 Extreme weather events 12 21 23 20 24 1 Seismic activity 6 15 18 23 37 2 Power outage 17 28 26 17 11 1 War/major social unrest 10 16 24 20 28 1Source: Economist Intelligence Unit survey, September 2006the country’s southern and eastern coasts. Which of the following threats has your organisation considered as part of its risk management processes? A fairly high proportion of respondents have (% of respondents)looked at these most significant threats as part of Bird flu 55their risk management processes, with 69% having Terrorism 60considered power outage, 60% terrorism, 55% Extreme weather events 54bird flu and 54% extreme weather events. Levels of Seismic activity 31planning vary considerably from region to region, Power outage 69however, with companies in the US generally showing War/major social unrest 35slightly higher levels of preparedness than those None of the above 7in Asia and significantly higher levels than those in Other 11Europe. For example, 71% of US respondents say that Source: Economist Intelligence Unit survey, September 2006their organisation has considered the threat from In the past three years, has the amount of time andterrorism, compared with 62% of Asian respondents resources devoted to catastrophe risk management in your organisation increased or decreased?and 50% of European respondents. The greater (% of respondents)attention afforded to catastrophe risk management in Increased substantially 23the US is not necessarily based on a higher perception Increased slightly 44of risk—across Asia, Europe and the US, terrorism Stayed the same 29is seen as a significant threat by broadly similar Decreased slightly 1percentages of respondents. Decreased substantially 1 Don’t know 1The gap between awareness Source: Economist Intelligence Unit survey, September 2006and action on catastrophe risk management, with 83% ofGiven the variety of threats they face, it is perhaps companies that have annual revenue in excess ofnot surprising that 67% of the respondents to our US$5bn reporting an increase, compared with 60% ofsurvey say that, over the past three years, they have companies with revenue of less than US$500m.increased the time and resources they devote to Despite this evidence that catastrophe riskcatastrophe risk management. Among respondents management is rising up the corporate agenda,from the US this figure rises to 86%. Large companies there remains a sense among our respondents thatare also more likely to have increased their focus they do not devote as much time to preparing for © The Economist Intelligence Unit 2006
  5. 5. Catastrophe risk management Preparing for potential storms aheadWhich of the following statements best describes your company’s current catastrophe risk management means that they riskposition on catastrophe risk management? losing sight of more immediate concerns—a finding(% of respondents) that suggests that, for these respondents, preparing Preparing for high-impact, low-probability events is seen as important and is something to which we devote significant time and resources 32 for catastrophe is seen as a distraction from “business We see preparation for high-impact, low-probability events as important, as usual” priorities. but we lack time or resources to give it our full attention 50 A possible barrier to the adoption of We do not consider preparation for high-impact, low-probability events comprehensive catastrophe risk management is that as a priority, and devote little or no attention to it 18 it is seen as a sunk cost and as being of no immediateSource: Economist Intelligence Unit survey, September 2006 benefit to the bottom line. But while there may be no immediate bottom-line benefit from adopting potential catastrophes as they should. Fifty percent catastrophe risk management, a high proportion of respondents to our survey say that they see of the respondents to our survey—81%—believe preparation for high-impact, low-probability events that good catastrophe risk management can still be as important, but lack the time or resources to give a strong source of competitive advantage. Jeroen it their full attention. Only 32% say that preparation Meijer, associate director of crisis management at for such events is seen as important and is something Control Risks Group, a risk consultancy, agrees and to which they devote significant time and resources. cites the example of supply chain interdependencies, Among companies with revenue of less than whereby organisations rely on their partners to US$500m, this figure falls to 24%. maintain a consistent and timely flow of goods and The problem for many companies, it seems, is will seek assurances from suppliers that disruptions that they are constantly prevented from addressing will quickly be resolved. “You can therefore create a catastrophe risk management by what they perceive competitive advantage within your supply chain if as more pressing and immediate concerns. Almost your customers know that you are very well prepared one-half of those surveyed agree that a focus on [for catastrophe],” he explains. Please indicate whether you agree or disagree with the following statements (% of respondents) Agree Agree Disagree Disagree Don’t strongly slightly slightly strongly know Our insurers will be likely to reduce premiums 12 38 20 17 14 if we demonstrate good catastrophe risk management Good catastrophe risk management can be a 33 48 13 3 3 source of competitive advantage By devoting time and resources to preparing 11 38 33 18 1 for the big one, we risk losing sight of more immediate concerns Preparing for bird flu requires a very different 29 39 16 8 8 set of business continuity capabilities than we have developed for other threats Catastrophe risk management is something 55 34 9 1 1 that requires discussion at board level We regularly test our scenario plans and 17 34 25 19 5 disaster recovery plans Source: Economist Intelligence Unit survey, September 2006 © The Economist Intelligence Unit 2006
  6. 6. Catastrophe risk management Preparing for potential storms ahead Case study: operations. “We had 212 customer systems rebuilding all those systems is a major running from the data centre, and we lost undertaking. We had about 150 people Northgate Information all of them,” explains Chris Stone, chief working constantly in 12-hour shifts over the Solutions executive of the company. next two weeks, rebuilding all the systems “We also had about 450 employees and making sure that we got all the essential The widespread use of outsourcing arrange- who usually worked from that building, customer systems up and running.” ments to cut costs and maximise efficiency although fortunately, because the explosion Customers were kept abreast of has highlighted the need for companies happened very early on a Sunday morning, the situation by individual account to feel confident that their partners have none of them was there at the time.” managers, who in turn were briefed by robust catastrophe risk management plans The company responded quickly, and and communicated with sales directors in place. With many companies contracting within an hour of the explosion had set in and divisional managing directors. “We out business-critical information technol- motion a disaster recovery plan. At 7.30 am worked closely with our customers, trying ogy functions, such as payment processing Mr Stone had his first conference call with to prioritise their needs and make sure that or applications maintenance, to external his executive committee, during which he we didn’t miss a single payroll,” explains Mr providers, the risks to reputation and poten- allocated specific responsibilities for each of Stone. “And in the end, this is something tial for damage to the business should these the different tasks around communication, that we managed to achieve.” services be disrupted by a major incident are planning, and contacting suppliers and Mr Stone believes that if the company considerable. customers. had not had robust business continuity and One information technology (IT) With e-mail taken out by the explosion, crisis management plans in place, it would outsourcing provider that has demonstrated employees were contacted on company not have survived the Buncefield explosion. its ability to respond to catastrophe is mobile phones by a text message, which “If a disaster like that happens and you are Northgate Information Solutions, a UK pointed them to a website that had been set not prepared,” he says, “you are never going company that supplies payroll services to a up to answer essential questions they might to be taken seriously by anyone ever again.” range of public- and private-sector clients. have, such as the location of temporary As it is, the company has since gone from In the early hours of Sunday, December facilities. For many this meant travelling to strength to strength, and in June this year 11th 2005, an explosion at Buncefield oil alternative premises operated by Sungard, announced that, despite the blast, annual depot in the UK caused the largest fire the the company’s disaster recovery provider, pre-tax profits had doubled to £30.6m. “We country had seen since the second world and beginning the arduous job of restoring lost one contract following the explosion war. The blast partly destroyed Northgate’s customer systems. “Having a disaster but, in the following ten weeks, we won 60 headquarters, which was in the nearby recovery contract is just like a building new ones,” explains Mr Stone. “It’s pretty Maylands industrial estate, and devastated block—all it does is tell you that there is a clear that when we talk about commitment the servers on which company data were facility that will be ready for you to build all to customers, it’s something that we really held, causing massive disruption to your systems,” explains Mr Stone. “Actually mean.”The role of insurance shareholders and other investors, which were both cited by 32% of respondents.companies For executives, the pressure from insuranceAside from the business imperative to consider companies means a careful assessment of insurancecatastrophe risk management, respondents to our policies and close co-operation with providers tosurvey also note that they face pressure from a ensure that adequate coverage is in place. In general,number of external stakeholders to put such plans in the respondents to our survey are confident that theirplace. Governments and regulatory bodies are seen insurance policies will provide adequate cover in theas exerting the greatest pressure, cited by 45% of event of a catastrophe, with 63% expressing a high orrespondents, followed by insurance companies, and very high degree of confidence. A smaller proportion— © The Economist Intelligence Unit 2006
  7. 7. Catastrophe risk management Preparing for potential storms ahead Have any of the following stakeholders exerted pressure 41%—involve insurers in their catastrophe risk on your organisation to improve its catastrophe risk planning, although 50% of all respondents agree that management? (% of respondents) their insurers will be likely to reduce premiums if they Shareholders and other investors 32 can demonstrate good catastrophe risk management. Ratings agencies 17 Given that insurance companies are still reeling Insurance companies 32 from the devastating 2005 hurricane season, there is Customers 28 also real pressure on the industry itself to respond to Suppliers 8 the increased threat from catastrophes. As a result, Employees 23 insurance companies are making greater use of Governments or regulatory bodies 45 innovative financing solutions, such as catastrophe Don’t know 12 bonds, which transfer the risk of a catastrophe to the Source: Economist Intelligence Unit survey, September 2006 investors in the bond. They are also continuing their use of sophisticated risk models, which can be used to What degree of confidence do you have that your company’s insurance policies will provide adequate cover predict losses arising from incidents such as extreme in the event of a major event or catastrophe? weather events, pandemics or terrorist attacks and (% of respondents) thereby guide them in their underwriting and portfolio Very high 11 management decisions. Many of these models Fairly high 52 have been revised since the 2005 hurricane season Fairly low 23 following analysis of how buildings were affected by Very low 8 the storms, says Josh Darr, senior manager of model Don’t know 7 management at Risk Management Solutions, which Source: Economist Intelligence Unit survey, September 2006 provides risk models to the insurance industry. “The In the past three years, which of the following external models being used at the time did not underestimate bodies has your company consulted as part of its the potential strength and intensity of the hurricanes, catastrophe risk planning? (% of respondents) but they did underestimate the volume of losses that Risk consultants 46 would ensue,” he explains. Insurance companies 41 Although models such as those produced by Emergency services 19 Risk Management Solutions are primarily a tool Security consultants 31 for the insurance industry, Mr Darr points out that Lawyers/litigation experts 28 the company also has a consulting arm, which Government agencies 33 uses the models to provide risk assessments and Suppliers 17 impact analyses to corporate clients. “We’re seeing None of the above 18 significant uptake from very large corporations who Don’t know 3 are looking for one-off studies to understand their Other 5 portfolio of risks from a corporate risk management Source: Economist Intelligence Unit survey, September 2006 perspective,” he explains. In the longer term, Mr Darr expects that the regular use of risk models to assess and quantify risks will spread from the insurance industry to the broader corporate arena. © The Economist Intelligence Unit 2006
  8. 8. Catastrophe risk management Preparing for potential storms aheadThe gap between large and How often does your company revise its catastrophe risk plans? (Companies with annual revenue of US$500m orsmall businesses less) (% of respondents)According to our survey, the use of risk consultants for More than once a year 9services such as assessing a company’s loss exposure Once every year 39and conducting impact analyses is something Once every 2-3 years 20that remains predominantly confined to large We see it as a one-off exercise 11corporations. Seventy-one percent of respondents We do not have any catastrophe plans 17from companies with revenue in excess of US$5bn Don’t know 4say that they use risk consultants, compared with Other 1just 28% of those from companies with revenue of Source: Economist Intelligence Unit survey, September 2006US$500m or less. Although the use of external riskconsultants is by no means a benchmark of how of plans to employees, smaller businesses gavesuccessfully companies prepare for catastrophe, this themselves lower ratings than their larger peers indifference in results does point to a broader issue— every category.namely that small and medium-sized companiessimply do not have the time or resources to put inplace thorough catastrophe risk management plans. Scenario planning and In the wake of the London terrorist bombings of simulationsJuly 7th 2005, the president of the London Chamber Although the more sophisticated risk tools may beof Commerce, Michael Cassidy, expressed his concerns out of reach of smaller businesses, there are othersabout “a chronic lack of preparedness” among small that are both inexpensive and effective. For example,and medium-sized companies to address future scenario planning, which was first used by the militarythreats. The findings from our survey also suggest and then commercialised by Royal Dutch/Shell inthat small companies lag considerably behind their the 1970s, has become a widely used way of helpinglarger peers in the adoption of catastrophe risk a range of companies to think through the impact ofmanagement. Seventeen percent of companies with major changes in the business environment, includingrevenue of US$500m or less said that they had no catastrophes. It is used by 57% of the companies incatastrophe plans at all, while a further 11% saw our survey, and by 52% of companies with revenueplanning for catastrophe as a one-off exercise. By under US$500m. “Scenario planning is very scalable,”contrast, only 2% of companies with revenue in excess explains Doug Randall, co-leader of the scenarioof US$5bn said that they had no plans in place. practice at Global Business Network, a consultancy This disparity can in part be attributed to that specialises in helping organisations to preparethe greater regulatory burden placed on larger for possible futures. “For a small business, you canbusinesses, which often requires them to adopt spend a day with a team looking at a few differentbusiness continuity plans, but it nevertheless reflects scenarios imagining what you would do, whereas inthe large gap in preparedness between large and a large business, you could spend six months doing asmall businesses. When our survey respondents were series of major studies.”asked how successfully their organisation conducted Mr Randall attributes the growing interest in toolsaspects of catastrophe risk management, such as such as scenario planning to the recognition amongrisk assessment, impact analysis and communication companies that they are no longer necessarily in © The Economist Intelligence Unit 2006
  9. 9. Catastrophe risk management Preparing for potential storms ahead Which of the following tools does your organisation have considered. Second, it helps prepare your currently use to manage catastrophe risk? organisation and make it more resilient for dealing (% of respondents) with threats.” Catastrophe modelling 11 By taking executives out of their comfort zone Scenario planning 57 and forcing them to challenge the assumptions they Specialist training of employees (e.g. crisis management) 47 hold about the business, scenario planning can be Simulations 31 a valuable educational tool. But more importantly, Active testing of disaster recovery plans 46 it encourages them to test the resilience of their None of the above 16 strategies against different potential scenarios. “You Don’t know 2 can start to look at how certain strategies only make Source: Economist Intelligence Unit survey, September 2006 sense in certain scenarios,” explains Mr Randall. “If that’s the case, you want to know, because you are control of their own destinies. “Faced with a whole effectively making a bet with that strategy that a host of extreme weather events, geopolitical changes certain scenario will come true.” and technology innovations, companies started to say Real-life simulations of specific catastrophes can ‘We don’t understand the world around us and we’d also be a valuable tool to help companies test their better be prepared for different futures,’” he explains. preparedness and provide individual executives The objective of scenario planning is not to with the skills they would need to face the media, predict the future but to describe a range of possible investors and relatives of employees in the wake of a scenarios and consider their impact on the business, catastrophe. Simulations are less widely used among its operations and strategy. A scenario planning the respondents to our survey than scenario planning, exercise will typically require executives to spend time however, with 31% of the overall sample and only “brainstorming” potential events that could strike the 17% of companies with revenue of US$500m or under business, and to think through how these would affect indicating that they currently use them. their strategy and operations. “Scenario planning is a platform for thinking about the challenges an Leadership and communication organisation faces,” explains Mr Randall. “It serves As with many aspects of risk management, the two main functions: first, it helps to identify emerging leadership of the company plays a vital role in issues or threats that your organisation may not ensuring that effective plans are in place and that roles and responsibilities are understood by everyone Which of the following tools does your organisation in the organisation. Mr Meijer of Control Risks currently use to manage catastrophe risk? (Companies with annual revenue of $500m or less) Group stresses that catastrophe risk management (% of respondents) is something that must be initiated and supported Catastrophe modelling 9 from the very top of the organisation. “Very well- Scenario planning 52 communicated board commitment is crucial for Specialist training of employees (e.g. crisis management) 29 a successful process,” he explains. “If there is no Simulations 17 board sponsorship for these issues, people are not Active testing of disaster recovery plans 36 stimulated to address them.” This is a statement that None of the above 25 finds strong support among our survey respondents, Don’t know 1 89% of whom agree that catastrophe risk management Source: Economist Intelligence Unit survey, September 2006 is something that requires discussion at board level. © The Economist Intelligence Unit 2006
  10. 10. Catastrophe risk management Preparing for potential storms ahead Case study: simulated a series of terrorist incidents a realistic fashion the durability of the sector in London and other cities that affected as a whole.” The market-wide exercise people, buildings and infrastructure. In 2006, the market-wide exercise Information was relayed as realistically will focus on the threat from a pandemic as possible using news broadcasts and outbreak for the first time. “It’s a threat that websites and participants were encouraged hasn’t been thought about so much over In the UK, the Tripartite Authorities, which to contact the civil contingencies agencies the years, so we’re particularly interested in consists of the Financial Services Authority, and authorities that were also taking part in what the cumulative effect is on the sector the Bank of England and HM Treasury, have the exercise. Coming just a few months after and how we as regulators need to deal with instituted an annual simulation, called the the July 7 bombings in London, the market- that,” says Mr Maddison. market-wide exercise, to test responses to wide exercise was also an opportunity for With a pandemic outbreak likely to sector-wide disruption of the financial serv- participants to test the new measures they spread in waves over a period of months, ices industry and highlight issues of interde- had put in place in response to the attacks. the use of real-time, realistic simulations pendency that could not be examined using “The underlying purpose of the market- played out over a short timeframe, which stand-alone simulations. In the past few wide exercise is to make the financial sector has been the model used in the past, is less years, the market-wide exercise has grown as resilient as possible against any kind appropriate. “Because of the nature of the from a round-table discussion involving of operational disruption and to promote threat, and because we want to get as much approximately 130 people in 2003, to a full- good practice,” explains Richard Maddison, out of the exercise as possible, we’re going scale, realistic simulation in 2005, which deputy head of the business continuity to run it over a six-week period,” explains brought together 7,000 participants from 70 management team at the Financial Mr Maddison. “We want people to go away organisations, including the major banks, Services Authority. “It is an opportunity and research properly what the answers the City of London Police, the Corporation of for participants to test their own plans, but might be and then come back to give it their London and seven overseas regulators. because we can get all these people together considered opinion. It’s a rolling series of The November 2005 market-wide exercise at the same time, it is also a way of testing in discussions against a scenario.” “How successfully do you feel your organisation conducts the following aspects of catastrophe risk management?(% of respondents) 1 Very 2 3 4 5 Not Don’t successfully successfully know Assessment of threats 13 48 26 6 5 3 Impact analysis 10 37 31 13 5 3 Determining roles accountability 14 32 30 14 7 3 Setting of clear objectives priorities 14 32 32 14 6 3 Collaboration between departments 5 30 36 18 8 4 Communication of plans to employees 7 26 35 19 9 4 Communication of plans to customers 3 17 27 32 14 8 Engagement with external agencies 7 23 31 17 14 8 (such as emergency services) Collaboration with suppliers/value chain 4 19 30 23 11 13 Maintaining updating plans 9 24 36 14 12 5 Actively testing plans scenarios 10 22 28 18 17 5Source: Economist Intelligence Unit survey, September 2006 © The Economist Intelligence Unit 2006
  11. 11. Catastrophe risk management Preparing for potential storms ahead The communication of plans to employees, plans to their employees successfully, and just 20% customers and suppliers should also be seen as a believe that they communicate plans successfully to priority, as it is only by constant, effective dialogue customers. that a company facing a crisis can emerge intact. Respondents also do not consider themselves Mr Stone of Northgate Information Solutions cites particularly adept at ensuring that catastrophe risk communication as being the most essential element management plans are tested and kept up to date. of any crisis management situation. “Everyone needs Just 33% say that maintaining and updating plans to be given as much information as possible, because is something their company does successfully, and, lack of information leads to all sorts of panic and although 51% say that they regularly test their doubt,” he explains. scenario and disaster recovery plans, only 32% Despite the importance of communication as a tool consider their companies to be successful at doing so. to help an organisation steer its way through a crisis, These findings suggest that companies are most likely the respondents to our survey do not rate themselves to fall down on the administrative side of catastrophe highly in this area. Only 33% of companies believe risk management by failing to renew plans or update that they communicate catastrophe risk management them to reflect personnel or organisational changes.10 © The Economist Intelligence Unit 2006
  12. 12. Catastrophe risk management Preparing for potential storms aheadConclusionI t is impossible for companies to consider every services, or those that operate in regions of high eventuality that they could face in the future, and seismic activity or terrorist threat, will undoubtedly many of the incidents for which they do prepare need to put in place more sophisticated plans. Butmay never happen. But despite this, companies would even very small businesses, which may not considerbe foolish to ignore catastrophe risk management themselves to face significant risks, should giveon the grounds that such incidents are either some consideration to catastrophe risk management.unforeseeable or too remote. Many of the precautions Such preparations need not be expensive or time-that companies need to put in place to deal with consuming—even straightforward precautions, suchcatastrophe are generic and would apply in the case as backing up all data to a remote site on a daily basisof any major incident. For example, employees and and putting in place policies for employees in theassets must be protected, IT infrastructure and other event of a catastrophe, could make the differenceoperations must be restored, and reputation must between survival and extinction.be maintained using open, constant communication As the level and variety of threats that companieswith customers, investors and the media. As such, face increases, they are likely to face greater pressurecompanies should not necessarily focus on specific from external sources, such as regulators, customersthreats but rather on the general decision-making and shareholders, to put in place good catastrophe riskstructures, roles and responsibilities, and priorities management. Executives who have ensured that theirthat they would need to set for any major incident. company has robust plans in place will not only be The extent to which companies need to prepare well prepared for a range of eventualities, but will alsoeffectively for catastrophe will depend on their demonstrate to the broader stakeholder communityresources, size, industry and the level of risk that they that they take seriously their responsibility forface. Heavily regulated industries, such as financial protecting the organisation over the long term. © The Economist Intelligence Unit 200611
  13. 13. AppendixCatastrophe risk managementPreparing for potential storms ahead Appendix In June 2006, the Economist Intelligence Unit conducted a survey of 225 executives from across Europe, Asia-Pacific and the Americas. Please note that not all answers add up to 100%, because of rounding or because respondents were able to provide multiple answers to some questions. In which region are you personally located? What is your primary industry? (% respondents) (% respondents) Financial sevices 33 Asia-Pacific 30 Professional services Latin America 1 17 Energy and natural resources North America 31 8 Eastern Europe 2 IT and technology 7 Western Europe 30 Government/Public sector 6 Middle East Africa 5 Education 4 Entertainment, media and publishing 3 What are your main functional roles? Healthcare, pharmaceuticals and biotechnology (% respondents) 3 Construction and real estate Risk 3 57 Consumer goods Strategy and business development 3 41 Logistics and distribution Finance 3 38 Manufacturing General management 2 36 Retailing IT 2 10 Telecoms Information and research 2 8 Agriculture and agribusiness Customer service 1 7 Transportation, travel and tourism Operations and production 1 7 Automotive Marketing and sales 1 6 Legal 5 RD 4 Human resources 3 Supply-chain management 2 Procurement 1 Other 512 © The Economist Intelligence Unit 2006
  14. 14. Appendix Catastrophe risk management Preparing for potential storms aheadWhat is your title? What are your company’s global annual revenues in(% respondents) US dollars? (% respondents)CEO/President/Managing director 25CFO/Treasurer/Comptroller $500m or less 49 17 $500m to $1bn 14Risk manager 17 $1bn to $5bn 16Other C-level executive 9 $5bn to $10bn 5CRO $10bn or more 17 6Other manager 5SVP/VP/Director 5Head of Department 5Board member 4Head of Business Unit 3CIO/Technology director 2Other 2How significant a threat do the following risks pose to your company’s global business operation today?Rate on a scale of 1 to 5, where 1=very high risk and 5=very low risk.(% of respondents) 1 2 3 4 5 Not applicableFinancing risk (difficulty raising finance)6 15 26 27 24 2Credit risk (risk of bad debt)5 20 29 33 11 1Market risk (risk that the market value of assets will fall)10 26 32 23 8 2Foreign exchange risk (risk that exchange rates may worsen)4 26 34 19 15 2Country risk (problems of operating in a particular location)8 25 27 20 16 4Regulatory risk (problems caused by new or existing regulations)13 32 32 16 6IT risk (e.g. loss of data, outage of data centre)11 27 33 21 7Political risk (danger of a change of government)7 20 28 30 16Crime and physical security5 21 34 27 13Terrorism8 17 28 29 17Reputational risk (e.g. events that undermine public trust in your products or brand)16 30 26 20 6 1Natural hazard risk (e.g. hurricanes, earthquakes)5 21 24 31 18 2Human capital risks (e.g. skills shortages, succession issues, loss of key personnel)15 37 28 16 4 © The Economist Intelligence Unit 200613
  15. 15. AppendixCatastrophe risk managementPreparing for potential storms ahead How has your organisation’s assessment of risk in each of the following countries and regions changed over the past three months? (% of respondents) Significant increase in risk Slight increase in risk No change Slight decrease in risk Significant decrease in risk Don’t know Canada 7 55 5 2 30 US 8 31 40 7 1 13 France 4 20 39 6 31 Germany 1 10 46 11 1 30 UK 3 21 47 6 1 22 Other Western Europe 14 54 7 1 23 Russia 7 29 22 10 1 31 Other Eastern Europe 1 22 35 10 1 30 China 2 28 30 13 4 24 India 2 23 33 14 2 27 Japan 10 50 10 2 27 Rest of Asia-Pacific 2 20 47 5 1 25 Middle East 17 28 19 7 1 28 Latin America 7 25 32 7 29 Overall global risk 2 49 32 6 1 10 In each of the following regions, are the majority of risks to your business considered to be general (eg, likely to affect many other companies operating in the same location or industry) or specific (eg, relating to your company’s internal systems, processes or people)? (% of respondents) General Specific Not applicable/Don’t know Africa/Middle East 49 15 37 Asia-Pacific 56 19 26 Eastern Europe 54 11 35 Western Europe 60 17 23 North America 58 20 22 Latin America 48 11 4114 © The Economist Intelligence Unit 2006
  16. 16. Appendix Catastrophe risk management Preparing for potential storms aheadHow significant does your organisation consider the following threats to be to your business?(% of respondents) 1 2 3 4 5 Dont Very Not know significant significantAvian flu16 27 19 13 23 3Terrorism12 23 27 19 18 1Extreme weather event12 21 23 20 24 1Seismic activity6 15 18 23 37 2Power outage17 28 26 17 11 1War/major social unrest10 16 24 20 28 1In the past three years, has the amount of time and resources Which of the following threats has your organisationdevoted to catastrophe risk management in your organisation considered as part of its risk management processes?increased or decreased? (% of respondents)(% of respondents) Power outage 69Increased substantially 23 Terrorism 60Increased slightly 44 Avian fluStayed the same 29 55 Extreme weather eventDecreased slightly 1 54Decreased substantially 1 War/major social unrest 35Don’t know 1 Seismic activity 31 None of the above 7 Other 11Have any of the following stakeholders exerted pressure onyour organisation to improve its catastrophe risk management?(% of respondents) Which of the following statements best describes yourGovernments or regulatory bodies company’s current position on catastrophe risk management? 45 (% of respondents)Shareholders and other investors Preparing for high-impact/low 32 probability events is seen asInsurance companies important and is something to 32 which we devote significant time and resources 32Customers 28 We see preparation for high-Employees impact/low probability events 23 as important, but we lack time or resources to give it our fullRatings agencies attention 50 17Don’t know We do not consider preparation 12 for highimpact/low probability events as a priority, and devoteSuppliers little or no attention to it 18 8 © The Economist Intelligence Unit 200615
  17. 17. AppendixCatastrophe risk managementPreparing for potential storms ahead In the past three years, which of the following external What degree of confidence do you have that your company’s bodies has your company consulted as part of its catastrophe insurance policies will provide adequate cover in the event of a risk planning? major event or catastrophe? (% of respondents) (% of respondents) Risk consultants 46 Very high 11 Insurance companies 41 Fairly high 52 Government agencies Fairly low 23 33 Security consultants Very low 8 31 Don’t know 7 Lawyers/litigation experts 28 Emergency services 19 None of the above 18 Suppliers 17 Don’t know Which of the following tools does your organisation 3 currently use to manage catastrophe risk? Other (% of respondents) 5 Scenario planning 57 Specialist training of employees (e.g. crisis management) What do you see as being the most important priorities in 47 the event of a catastrophe? Active testing of disaster recovery plans (% of respondents) 46 Simulations Safety of employees 31 91 None of the above Continuity of IT systems 16 50 Catastrophe modelling Reputation of company 11 42 Don’t know Maintaining contractual obligations 2 29 Security of premises 22 Impact on bottom line How often does your company revise its catastrophe risk plans? 20 (% of respondents) Local communities More than once a year 13 13 Resilience of supply chain Once every year 36 12 Other Once every 2-3 years 21 2 We see it as a one-off exercise 8 We do not have any catastrophe plans 13 Don’t know 5 Other 316 © The Economist Intelligence Unit 2006
  18. 18. Appendix Catastrophe risk management Preparing for potential storms aheadHow would you rate your organisation’s level of preparedness for catastrophe in the following departments?(% of respondents) 1 2 3 4 5 6 Very Very Dont high low knowManagement team16 40 27 8 7 1IT26 38 22 8 5 1Human resources6 25 37 18 9 4Operations (including distribution and supply chain)9 31 36 13 6 4Customer service8 26 33 18 7 7Sales and marketing4 16 34 28 9 9Finance8 32 31 16 8 4Corporate communications/PR13 29 29 13 9 6How successfully do you feel your organisation conducts the following aspects of catastrophe risk management?(% of respondents) 1 2 3 4 5 Don’t Very Not know successfully successfullyAssessment of threats13 48 26 6 5 3Impact analysis10 37 31 13 5 3Determining roles and accountability14 32 30 14 7 3Setting of clear objectives and priorities14 32 32 14 6 3Collaboration between departments5 30 36 18 8 4Communication of plans to employees7 26 35 19 9 4Communication of plans to customers3 17 27 32 14 8Engagement with external agencies (e.g. emergency services)7 23 31 17 14 8Collaboration with suppliers/value chain4 19 30 23 11 13Maintaining and updating plans9 24 36 14 12 5Actively testing plans and scenarios10 22 28 18 17 5 © The Economist Intelligence Unit 200617
  19. 19. AppendixCatastrophe risk managementPreparing for potential storms ahead Please indicate whether you agree or disagree with the following statements. (% of respondents) Agree strongly Agree slightly Disagree slightly Disagree strongly Don’t know Our insurers would be likely to reduce premiums if we demonstrate good catastrophe risk management 12 38 20 17 14 Good catastrophe risk management can be a source of competitive advantage 33 48 13 3 3 By devoting time and resources to preparing for the big one, we risk losing sight of more immediate concerns 11 38 33 18 1 Preparing for avian flu requires a very different set of business continuity capabilities than we have developed for other threats 29 39 16 8 8 Catastrophe risk management is something that requires discussion at board level 55 34 9 11 We regularly test our scenario plans and disaster recovery plans 17 34 25 19 5 Corporate governance Communications Reaching milestones Information technology security Intellectual property protection Regulatory compliance18 © The Economist Intelligence Unit 2006
  20. 20. Whilst every effort has been taken to verify theaccuracy of this information, neither The EconomistIntelligence Unit Ltd. nor the sponsor of this reportcan accept any responsibility or liability for relianceby any person on this white paper or any of theinformation, opinions or conclusions set out in thewhite paper.
  21. 21. LONDON NEW YORK HONG KONG26 Red Lion Square 111 West 57th Street 60/F, Central PlazaLondon New York 18 Harbour RoadWC1R 4HQ NY 10019 WanchaiUnited Kingdom United States Hong KongTel: (44.20) 7576 8000 Tel: (1.212) 554 0600 Tel: (852) 2585 3888Fax: (44.20) 7576 8476 Fax: (1.212) 586 1181/2 Fax: (852) 2802 7638E-mail: london@eiu.com E-mail: newyork@eiu.com E-mail: hongkong@eiu.com

×