On 31 December 2019, the World Health Organization (WHO) learned of several cases of severe pneumonia in the Chinese city of Wuhan. This strain of coronavirus has since spread through China and into other countries. WHO later named COVID-19.

The emergence of the coronavirus was exactly the type of fast-emerging risk with uncertain consequences that could have triggered quick actions by governments and organisations. Instead, it was played down or dismissed by many. They adopted a wait and see approach to risk management.

Better-prepared organisations and governments responded positively to news of minimal spread. They rapidly drafted contingencies before the situation deteriorated.

When the first reports of lockdowns came from China, most governments and organisations in the West had weeks to act on this emerging information. But they chose to wait and see. It was their approach to managing their risks. There wasn’t any instant action. No planning was immediately initiated in anticipation of its arrival.

Risk management by-passed

I know, because I have intimate knowledge of one such organisation. No one took notice in that organisation until the coronavirus appeared at its doorstep. Everyone scrambled for action subsequently. Emergency meetings were held to understand the situation. By then, it was already too late.

That organisation did have a risk management framework in place. Every year, it had certified that their risk management framework and processes have been working. That fact was published in their annual report. Risk management was working better on paper than in practice.

The coronavirus was not taken seriously by the senior management of that organisation. Eventually, it was forced to deal with it as an issue, not as an emerging risk!

It was re-active risk management.

From hindsight, this ‘wait and see’ approach to risk management has been proven fatal.

When the world did react seriously to the coronavirus spread, many governments and organisations were already lagging. There were no face mask, sanitisers and personal protective equipment (PPE) for sale in bulk quantities. There was a sudden surge in sales and demand.

In the meantime, healthcare and essential workers were exposed to the coronavirus without PPE.

Economies went into lockdown just to buy time to get these stock in place and to plan for next steps. The economic price paid has been enormous for poor risk management.

Coronavirus is not a “black swan” event

Nassim Taleb coined the term “black swan” to describe an event that is rare, unpredictable. It has an extreme impact.

According to Taleb, coronavirus isn’t one of those black swan events.

He says it’s a white swan because it has been predicted and not rare at all. Take the long list of epidemics that occurred over the last couple of decades — Ebola, SARS, MERS and Zika.

All these should have woken leaders up to the inevitability of this coronavirus crisis. The likelihood of a pandemic occurring is high.

In other words, we were warned.

It is easy to be complacent or dismissive

During the first lockdown, many locations had experienced lower rates of coronavirus infection. The curve had been flattened. Success was on the cards.

Then complacency set in.

Many assumed that the worst had passed. Life would get back to normal again. People dismissed the emergence of the second, third, etc. waves even when there is no vaccine to come for many months.

The first lockdown was supposed to buy time for more preventive and proactive actions to be taken. It was meant to ramp up planning for the inevitable future waves of coronavirus to come.

I was told that some organisations wound back their planned actions after the first wave. When they saw that the coronavirus curve had flattened, there was no longer any urgency to act. Life for some went back to ‘normal’.

Then the second wave came. People were caught off guard. Many then realised the seriousness of the coronavirus.

Many governments and organisations started to take things seriously. By then, it was too late.

Is this how risk management is supposed to be — reactive to circumstances?

Four levels of residual uncertainty

Let us dig deeper.

The level of uncertain is based on the “best available information”. This is one of the principles of effective risk management in ISO 31000:2018 Risk management — Guidelines. Risk management explicitly takes into account any limitations and uncertainties associated with such information and expectations.

The best available information at that time could have helped us identify clear trends or expectations about coronavirus. When the right analysis was performed, many factors that were unknown were known.

The uncertainty that remains after the best possible analysis using the best available information is residual uncertainty. It falls into one of four broad levels as shown below. (McKinsey, 2000)