Context
It’s all very well identifying a risk, but do you really know what would happen if it occurred?
What usually happens in risk planning is, a risk is identified, then there is a brief discussion about the likelihood of occurring and probable impact. Both are given a High, Medium, or Low rating, and then the conversation moves on to the next risk. Good organizations will add a third dimension, detect-ability. Again, this will be rated, and the conversation will move on.
When it comes to risk management, only the very best organizations run scenario testing.
Scenario testing objective
Scenario testing is designed to scrutinize issues around policy, decision making, communications, information sharing, technology, and resource deployment.
A great example is COVID-19. Prior to the pandemic lots of organizations may have had something like “Global flu outbreak” on their risk registers. Most likely it would have been rated as low for probability, and high for impact and detect-ability. But very few organizations (if any?) asked the “so what?” question.
So, what would we do if that risk does occur? How might it pan out? Is there only one scenario or are there many? For each, who would need to do what by when and how?
Even a cursory exploration of pandemic related risks would have come up with two key scenarios that would need to be addressed: employees having to work from home; and patients not being able to go to sites. But how many organizations had plans ready to go for those two scenarios?
Setting up the exercise for success
Scenario testing is a ‘tabletop exercise’ so doesn’t require a big commitment of resources, but it does require that all the groups in an organization are represented. Ideally you need representatives with a good working knowledge of processes, data, and available resources so they can make realistic and sensible contribution to the “What would we do if…?” discussions.
For high priority risks that could impact the viability of the business, then executive leadership should be invited to take part. Their participation (or otherwise) sends a very big signal to the organization on how seriously leadership take risk management.
Ahead of the exercise the facilitator should prepare different scenario questions for the risks to be explored. If we take the COVID example, different scenarios could have included:
What would we do if there are regional outbreaks? What would the implications be in each region?
What would we do if it lasts 6 months, a year, or two years? What are the implications for our business? What would we need to do to adapt?
How will it impact different parts of our business (Operations, IT, Finance, HR, etc.)?
What are the key decisions that would need to be made? Who would make them? What information would they need? How would they make them? How would the decisions be communicated? Are there any second or third order consequences that we need to consider?
Good questions are ones that can be built on, ratcheting up the pressure to test how an organization might respond. A simple example would be:
What would we do if there was an outbreak in South America?
What would we do if it then spread to North America? What would we need to do before it does?
What would we do if it then goes global? What would we need to do before it does?
Running the exercise
As with other risk exercises, this one is best run by a knowledgeable but unbiased facilitator to mediate between groups.
Think about how much time might be needed for each risk, based on the scenario questions you want to ask. Some scenarios will obviously need more time than others. You may need to run multiple sessions.
At the start of the meeting, get each participant to introduce themselves and their responsibilities. This needs to be quick and punchy, don’t let people waffle on.
The facilitator describes the process. It’s important to state up-front that this is a “no-fault, no-blame” exercise. It’s intended to flush out problems. Identifying problems can make some people feel vulnerable, but the point is to identify issues ahead of time so mitigations can be put in place to avoid problems becoming crises.
The facilitator then starts with the first risk. They pose just the first question and ask one person to start with a response. Don’t ask more than one question at a time otherwise people will get confused.
Even worse, some people may try and answer different questions. That’s because some people will want to put out answers that make them look good or deflect from deficiencies in their area. Don’t allow any one person or group to dominate. It’s important to get input from all groups, otherwise gaps will be missed.
During the meeting the facilitator needs to document identified issues, decisions taken, and other relevant information. At the end of the meeting these need to be summarized and actions assigned to owners. The most common actions will be to “Develop a plan to fix this…” That’s fine because it’s a flushing exercise, not a planning exercise.
Conclusion
Scenario testing allows you to take a hard look at your processes, decision making, and communications in a safe environment and without committing resources. The big benefit is that it makes executives and managers to think about how their organization would cope in a crisis, enabling them to make the necessary adjustments in good time.