In his fourth article for Infologue.com, Bill Freear, Managing Director of Pilgrims Group Ltd, asks the question, Is a company barbecue in Basingstoke as risky as one in Baghdad?
Bill continues: “For investors, concentration risk is the risk they take on when they fail to diversify, investing too much in a single sector, country or financial instrument. In business continuity terms, it can mean production and recovery sites sharing a train service, an electricity grid or a flood plain and – significantly for this article on travel risk – it can mean the escalated risk to a company when its key decision makers or those with key skills gather together in an environment that would otherwise present a lower risk.
“Very senior people carry special risks: if two or three are lost at once in an accident or attack, the company could suffer special damage, either through the lack of total corporate firepower that results or perhaps because the CEO and the finance director share structural accountability at the top. In a small company, where three people owned it and there was manageable debt based on, say, personal mortgages, but no succession plan, the result could be the company simply being sold off.
“A way to deal with this is to design a travel risk combination matrix. This is essentially a business continuity issue, the human and family factor notwithstanding, and the risk assessment should be part of the business impact analysis that drives a business continuity plan. Up for consideration are:
Travel threats and vulnerabilities to those threats (probability)
“For example, airline reliability and road conditions in less developed countries (and some developed ones), flying over hostile zones, terrorist threats to hotels and kidnap. And don’t forget that a threat does not have to be something you can drop on your foot; it can include the simple threat of two people being killed in the same low likelihood event, such as a car accident in UK. What you do about it of course, i.e. to what degree do you need to mitigate the resulting risk, has much to do with impact.
Impact
“The risk level and thus the mitigation needed is driven by what would happen if the threat occurred. So, if the accident or kidnap of board members A or B together means the company ceases to exist and that the consequence is financial ruin for 100 people, essential services to other firms stopping and creditors coming after family assets for the next 20 years, then that might drive a decision that lesser impact might not. Combining the probability and the impact should focus that decision.
Outcomes
“So what might the outcomes be? Let us say that if board members A and B were to be lost together, the risk to the company would be higher than if A and C were involved. The conclusion might be that the second travel combination was acceptable, while the first was not. And, if more than five of the ten board members were lost, then the risk might become too high to accept, meaning a maximum of any four travelling together anywhere.
“At levels below VVIP, concentration risk still applies. For example, the loss to the company of people with unique design skills and knowledge or IT experts can be just as damaging. And the loss of 30 out of a team of 40 (and this is an important consideration when travelling or working in places where epidemic is a threat) can bring the department down. To deal with it, again, fall back on the risk based approach. For example, if more than, say, 25 staff are to travel together anywhere or if more than 10 travel together to a high or very high risk country, then the travel department should reschedule or Security should carry out a risk assessment on the journey and propose new mitigation.
“The people with a keen eye for all this are the actuaries, so do talk to your insurance company.
“Of course, reality checks apply. Otherwise no one would work in the same building or have a family barbeque. Even where the impact is at its highest, sometimes one does not have to spell out that a company barbeque in Baghdad is more of a problem that one in Basingstoke. The way to deal with this is risk management by formal exception in Baghdad and risk management by common sense in Basingstoke.”
Opinions expressed by contributors and commentators do not necessarily reflect the views of Infologue.com or Interconnective Limited.