COVID-19 Risks: insights into a changed risk landscape

COVID-19 requires us to oversee, anticipate, and manage many risks and opportunities. Critical decisions need to be taken but limited time is available. You want to make sure you don’t oversee anything of importance and avoid blind spots.

These 19 COVID-19 risks can be used as a checklist by board and audit committee members, managers as well as risk and internal audit professionals, to help you assess the current risk landscape.

COVID-19 risks & measures to consider

1. Fraud

What is the risk?

When virtual and remote working becomes the new standard, the fraud risk changes. New fraud scenario’s appear and existing controls might not be relevant or operating anymore. Remote working creates opportunities for phishing and CEO fraud.

Measures to consider?

Update the fraud risk landscape and reassess the existing controls in place.
Adjust controls where needed to the new reality.
Exploit the potential of Artificial Intelligence for automation of controls.
Stress the importance of compliance and improve fraud risk awareness.

2. Cyber

What is the risk?

Cybercrime increases and cybersecurity becomes more important when virtual and remote working become the new standard. Furthermore, the rise of online activity can result in an increased risk of data leaks.

Increased number of users utilizing BYOD could increase your information security vulnerabilities.

Measures to consider?

Improve cybersecurity and cyber resilience.
Review risk management and security programs.
Make sure your network architecture includes safe alternatives for remote working.
Educate employees on the risks of remote working and how to stay compliant.
Make sure your cybersecurity framework is adapted.

3. Risk & compliance culture

What is the risk?

Due to the changing work environment, it becomes more difficult to control compliant behavior. Soft controls have become more important than ever before.

Measures to consider?

Ensure that risk and compliance measures adjust to the new way of working.
Make sure that it is clear for people what is expected from them and that they can reach out and discuss in case of uncertainty.
Measure the risk culture, confront it and act upon it when needed.

4. New regulatory requirements & opportunities

What is the risk?

COVID-19 brings various regulatory changes impacting many industries resulting in trade restrictions, operational interruptions, economical compensation, data privacy issues, corporate disclosures and prosecutions.

Measures to consider?

Continuously monitor the changing regulations in the countries you are active in (regulatory watch).
Perform impact assessments and install the required preventive and detective compliance measures.

5. Physical & mental health & safety

What is the risk?

Besides managing the obvious risk of infection, the current crisis also has an effect on the mental wellbeing of employees.

Measures to consider?

Update health and safety protocols and code of conduct. Including: safe work practices, personal protective equipment, procedures to follow in case of suspected infections, mental wellbeing programs, training and awareness.

6. Contractual obligations

What is the risk?

It can be hard to fulfil some contractual commitments in times of crisis. A key question to ask is to what extent this exposes your company to risk.

Measures to consider?

Have the legal department perform a detailed analysis of the existing contract risks and adapt the clauses for new contracts.
Properly document the situation and measures taken.

7. Virtual workplace

What is the risk?

Organizations are not given a lot of time to adapt to the digital workplace. Besides the technological aspect of working remotely it also brings challenges for people management, supervision of work and coaching of employees.

Measures to consider?

Support your employees with the change to a new way of working.
Clear communication from top management about the company’s expectations from their employees.
Explore new and more efficient ways of working e.g. online collaboration tools.

8. Reputation

What is the risk?

Due to cancelled contracts, cancelled projects, bad communication and other effects of the crisis, there can be a loss of confidence. It is important to have an adapted strategy and a clear plan to protect brand integrity.

Measures to consider?

Focus on confidence building through every channel by showcasing excellence in crisis management
Clear communication.
Comply with new regulations.
Focus on the wellbeing and health of your employees.

9. Business continuity, crisis management & emergency plans

What is the risk?

Black swan events like COVID-19 will become more important during risk assessments, since previously unlikely high impact events will become likely. The demand for experienced and qualified emergency response staff will increase drastically.

Measures to consider?

Integrate BCM and risk management into the company's strategy plan.
Hire qualified key personnel or train current employees.
Keep in mind the lessons learned from COVID-19 while reviewing BCM and emergency plans.

10. Disruption and innovation

What is the risk?

When businesses are disrupted, other business models are created. Many organizations have now enforced their online activity, others have added services such as home delivery, or investigated alternative markets. Innovation is key.

Measures to consider?

Boost or set-up your innovation process.
Create or build an agile business culture to act on change and disruption.
Evaluate new processes and work on continuous improvement to make sure these processes are sustainable for the future.

11. Economic downturn

What is the risk?

The COVID-19 outbreak has had a strong negative effect on stock markets around the world. The many cancelled contracts and projects will have a financial impact for a lot of companies and industries with possible layoffs as a consequence. Update financial forecasts and expectations.

Measures to consider?

Define mid and long term solutions. Consider creating a crisis budget.
Find cost reducing measures in line with the company’s strategy and goals.

12. Working capital, cash management (incl. credit risk) & insurance

What is the risk?

The loss of revenue due to cancelled contracts and projects, as well as solvency issues on the client side can lead to liquidity problems. It is important to keep the core business going to keep cash coming in, but also to keep cash going out to your suppliers and other stakeholders.

Measures to consider?

Cash flow forecasting and monitoring
Prepare and execute cash flow optimization measures (receivables, inventory and payables).

13. Social & political instability

What is the risk?

COVID-19 impacted the political environment of many countries. There is possibly a new sense of authority where the government and regulatory bodies are playing a central role.

Measures to consider?

Create a trusted line of communication with the government and regulatory bodies.
Encourage open communication between employees and management.
Give direct and clear top-down communication about changing rules and guidelines.

14. Transport, logistics & travel

What is the risk?

Every country or region has his own set of rules and regulations on travel and transportation, resulting in supply chain and business interruptions.

Measures to consider?

Closely monitor the changing local regulations.
Monitor closely and anticipate on the impact of these restrictions on the sourcing of your companies’ critical services and goods.
Update travel security programs. Use technology to replace travels as much as possible.
Keep close contact with suppliers and customers.

15. Strategy & financial plan

What is the risk?

The way we interact with our customers and employees has changed during the current COVID-19 situation, but this can very well be a permanent change. If the way we think and behave has changed, this could also have an impact on our strategic plans and financial forecasts.

Measures to consider?

Do not focus on short term solutions alone. Update or create protocols by focusing on mid and long term objectives.
Consider cost reduction and recovery initiatives. Integrate BCM and risk management into the company's strategy and financial plan.
Use current disruptive momentum to accelerate planned changes.

16. Steering information & data

What is the risk?

These days it is essential to rely on qualitative and readily-available steering information. The crisis has changed the way we work and thereby the way we build and design our business processes.

Measures to consider?

Define the required reports and insights and assign a task force to build it.
Focus on data management.

17. Stakeholder management & communication

What is the risk?

No clear communication or communicating inaccurate information to your stakeholders can lead to a loss of trust and a loss of confidence. Do not only think short term, but also think about the period after COVID-19.

Measures to consider?

Communicate clear and genuine with all stakeholders to manage expectations.
Prepare a stakeholder map and strategy.
Make sure responsibilities are clear related to the communication to stakeholders.
Focus on confidence building through every channel by showcasing excellence in crisis management.

18. Tax & Trade

What is the risk?

Travel and business operations are impacted heavily due to the many new and changing local and global regulations. It is crucial to keep up-to-date with the changing tax regimes and government support programs that impact you.

Measures to consider?

Keep close contact with regulatory bodies.
Perform a tax impact assessment.

19. Third party management & supply chain

What is the risk?

Border closures, travel bans and other consequences from the continuously changing COVID-19 measures have a big impact on our supply chain. A loss of availability to critical goods and resources can lead to major losses.

Measures to consider?