Business, Interrupted: Post-Pandemic Thinking Like a Risk Manager

Is the key to business continuity success understanding risk and how to manage it across your organization?

That’s what we discussed in an episode of Castellan’s new podcast, Business, Interrupted, with Melanie Lucht, Associate Vice President and Chief Risk Officer at Carnegie Mellon University. Lucht brings unique insight into the congruences between risk management and business continuity to shore up operational resilience, especially related to disaster recovery and response.

At Carnegie Mellon, Lucht got a unique opportunity to lead its new enterprise risk management department with an emphasis on organizational resilience.

In that role, Lucht works with a spectrum of partners and stakeholders, not just to establish and mature continuity and risk management programs, but to come together as a unified team for the organization’s greater good.

The idea behind this core group is simple. By involving cross-functional teams in disaster response and continuity planning, leaders can better anticipate disruptive scenarios, see potential impact, and communicate that information to a broader group to mobilize, coordinate, and communicate for efficient response. That includes executives and other key stakeholders.

The Pandemic Pivot

As this team focuses on preparing for and responding to disruptions, it’s becoming clearer after the past year how much impact the COVID-19 pandemic has had on planning and response, leading to, in some cases, a pivot in program focus.

At the beginning of the coronavirus outbreak, the focus was on communication—communicating as a team and with other stakeholders about preparation for what they anticipated may happen as a result of the pandemic. That started as early as January 2020.

The first priority was raising awareness about what was developing and then, right after, putting the university’s emergency preparedness team on notice.

In just a few weeks, the team shifted to an active response phase, and, at the time, had 150 plans in their environment to take into consideration.

The pandemic pivot provided a unique opportunity for everyone to review plans and ensure that information was accurate, up-to-date, and ready for activation.

From there, they activated their emergency operations center (EOC), which became a hub for critical communication. The core focus being:

1. What are you doing?
2. What do you know?
3. What do you need?

In the early days of the pandemic, the team met twice daily, reviewing those three core questions to ensure everyone was on the same page and had the resources they needed.

Citing how a university in some regards is similar to a small city, Lucht said it was a challenge to deal with COVID response in such unprecedented circumstances.

“And it moved very quickly,” she said.

That included not just students already on campus, but also international students and others planning to return to the university post-winter break.

At times, it felt as if the pandemic situation changed by the hour, supported—thankfully—by a well-established ticketing center within in the EOC to help manage incoming questions and requests for support.

Lessons Learned

Efficient business continuity and disaster response teams are accustomed to planning for events, but must also be adaptable to similar pivots as situations and assumptions change.

The pandemic gave Lucht and her team a few important lessons to draw on.

Recently, the team conducted its after action review and noted how in reality, we’re not truly post-pandemic. It’s an ongoing issue around the globe.

“It was more of an 18-month checkpoint if you will,” Lucht said, pointing out they’re still meeting on a regular basis to manage the pandemic and evaluate its risk-mitigation protocols.

Throughout the process, however, the team has learned a lot about it strengths, as well as opportunities for process improvements and the value of business continuity plans, especially when comparing results from teams that had made business continuity planning a priority, compared to those who hadn’t.

For those who were prepared–even if at the time of creating their plans they couldn’t fully understand exactly how they may later come into play—many responded by saying they were grateful for doing the legwork in advance, which helped decrease some of the stress and anxiety they may have experienced if they had to figure out response on the fly.

But even those who had plans learned they don’t always have the correct assumptions or have everything figured out exactly as they’d come to play out. The result was a better understanding of strategic planning, testing, exercises, and gap identification.

“I think many members of our community have come to appreciate that,” Lucht  said. “They’ve also come to appreciate the value of just risk management in general…”

Positive Response

While there have been a lot of challenges for pandemic response, from a business continuity and disaster response perspective, there have been some positive impacts. For example, across the organization, more team members now understand and appreciate why these teams exist and why they’re important to the organization’s resiliency.

The pandemic provided a unique opportunity for these teams to demonstrate why they do what they do—and why they’re good at it. Ultimately, demonstrating from a risk management perspective that if you do what you do well, and if you’re committed and passionate about it, you earn a seat at the table, especially as it relates to operational resilience and the bigger picture.

While the pandemic continues to have lasting impact on business continuity and disaster response programs around the globe, Lucht sees several important takeaways influencing the future for those areas, as well as risk management.

It’s refreshing to see teams working toward common goals to maximize their potential while seeking out opportunities to evolve programs and plans to the next level. The pandemic has helped break down some apprehension and barrier for doing just that.

And for an educational institution it’s provided new opportunities for team members to learn—including learning from failures, missteps, and missed assumptions.

“And I think just learning from those experiences, and just being able to say—even if you’re tired, even if you’re busy—if you have an opportunity to take it to another level, you absolutely should do that because you have no idea what doors could open for you as a result.”

Would you like to hear more of our conversation with Melanie Lucht about the role of risk management in disaster response? Check out the full podcast episode, “Enterprise Risk Management,” from Castellan or wherever you listen to your favorite podcasts.