Up in smoke

Everywhere, after 11 September, the same impossible question: whatnow? To answer it, we need to know what is temporary – caused by theeconomic downturn that began before the attacks but which will eventuallyreverse – and what is permanent. Sometimes the difference isn’t clear. Forexample, does the collapse in business among flag-carrier airlines, butthe comparative buoyancy of the budget fliers, represent a paradigm shiftin the market?

This confusion is likely to place a double strain on FDs. Most will beunder intense cost pressure as the downturn bites, markets shrink andcompetition gets tougher. But they will also need to play a more proactiverole in the risk management of their organisations.

In this sense, risk is defined in its broadest sense. Remember that theTurnbull Committee Guidance for Directors on Internal Controls placedresponsibility for risk management firmly in the FD’s domain – so thiscould be a good time to revisit Nigel Turnbull’s report which set out abest practice framework for business risk management based on assessingand controlling significant risks.

What does seem important is that, in future, business will operate in aworld in which threats will appear from unexpected areas. Notsurprisingly, security is the first issue boards have addressed. IanJohnson, a leading security consultant, saw enquiries double overnightafter the World Trade Center attack.

“The big one was control of access to buildings – x-raying baggage andbody searching,” says Johnson. “We’ve also been asked about mail screeningand bomb blast protection.” The events in New York have also madecompanies aware of risks inherent in their location. “If you’re close to asignificant building it could increase your risk,” he says.

Richard Pursey, managing director of Global Continuity, a leading UKplayer in business continuity, agrees that location will become morecontentious. Within hours of the attacks, six City companies had calledhis firm wanting to move some staff out of London. “Because of the scaleof the disaster, they didn’t want all their eggs in one basket,” hesays.

Two points arise. First, locating all staff in one prestige office blockmay not seem as wise as it did. That’s especially the case if the buildingalso includes staff from what you regard as a higher risk company.Secondly, as Pursey points out: “Companies are revisiting why they areeven based in these areas anyway. I have spoken to two finance houses -one in Brussels, one in London – which are questioning whether they shouldeven be in these city centres any more. In some ways they don’t need to be- everything is electronic.”

Whether firms move or not, 11 September means they need to pay much moreattention both to staff safety and business continuity. That is an issuewhich FDs may have wanted to look into even without an increased terroristthreat. As the Centre for Corporate Accountability points out, 3,759people have been killed and 205,000 seriously injured at their place ofwork in the past 10 years. And the public is becoming restless about theseeming failure of directors to accept responsibility for tragedies wherethere is apparent negligence.

The problem is that many companies are in a panic about something thatwill never happen to them – a terrorist attack – when there are a host ofseemingly minor matters, such as office or factory fires, which are morelikely to do damage. Ian Waldram, immediate past president of theInstitution of Occupational Safety and Health, says that any company whichhasn’t carried out a safety survey of its premises should do soimmediately.

Even if all staff safety issues are covered, there is still a danger thata company could cease to function after a major incident – whetheraccident or attack. Mercifully, the UK has known nothing on the scale ofthe World Trade Centre, but the IRA bomb which devastated the centre ofManchester in 1996 seriously disrupted 452 companies. Within six months,250 were out of business for good.

In the past few years, many companies – especially in financial services -have put business continuity plans in place. The question FDs must nowaddress is whether those plans are robust enough to cope with the scale ofany emergency which might occur. Soon after 11 September, Guardian iT, adisaster recovery services specialist, was showing journalists over itsemergency high-tech relocation centre in East India Dock. But if an attackcan disrupt an area the size of south Manhattan, should disaster recoverysites be situated in such a high-risk commercial district?

John Sharp, chief executive of the Business Continuity Institute, sayscompanies should take a fresh look at risks. “You should look at all theprocesses you go through in order to deliver a product or service,” hesays. “IBM has a concept of going from quote to cash – you need tominimise the risks at each step.”

Sharp points out that insurance by itself is an inadequate response torisk management. “You may be able to insure against your factory burningdown, but insurance doesn’t keep your customers happy and supplied withproducts,” he says. Indeed, research by IDC suggests insurance only coversbetween 30% and 60% of the costs of a disaster. Exclusions and excessesmay reduce even that figure.

Most businesses will be facing hefty premium rises across their businessinsurance portfolios during the coming year. Premiums were already set torise to help insurers recover losses from last year’s floods and otherdisasters. Industry insiders suggest 11 September could add another 20% toan average company’s premiums; analysts say the cost to insurers couldwell top £10bn. But all these figures are estimates until complex andprotracted legal action over some liabilities has run its course.

What will make life more difficult is that many listed companies are onlyprepared to insure with firms which have balance sheets at least as strongas their own. But, as David Gamble, executive director of the Associationof Insurance and Risk Managers in Industry and Commerce, points out, thenumber of insurers with AAA and AA ratings is falling. So there won’t beso much choice in the insurance market for those FDs who regard thebalance sheet test as critical. “The scarcity means that the insuringcompanies can put their rates up across the board,” says Gamble.

The one bright spot for UK business is that insurance for terrorist actswill still be available through the Pool Re scheme at affordable rates.The scheme was set up with government encouragement in the early ninetieswhen commercial insurers refused to provide cover in the wake of a stringof IRA attacks. Few other countries have a similar approach.

Another financial issue which may now figure higher on the FD’s agenda ismoney laundering. This will certainly be tougher for banks and others infinancial services to deal with. But the Financial Action Task Force, theOECD body which coordinates the fight against money laundering, isdetermined to crack down harder on terrorist financing.

The FATF held a special plenary session in Washington at the end ofOctober. It agreed a raft of measures which will make it difficult for anygovernment to stand aside from money laundering controls in the future.The UK government has been doing its bit and is egged on by the knowledgethat catching dirty money aids the public finances. It is likely toimplement new measures enthusiastically.

FDs who blithely assume their firms are immune from this kind ofunpleasantness could be in for a shock. Nigel Morris-Cotterill, who runsSilkscreen Consulting, a specialist operation which advises on moneylaundering, says: “It is very common for criminals to use some of themoney which they have laundered to invest in a legitimate business.” Firmsharbouring such investments could be guilty even if they fail to reportsuspicions that the money was introduced for laundering purposes.

With the international situation continuing to develop, there are likelyto be further unpredictable consequences. For example, a report from ITservices company Keane predicts a downturn in outsourcing becausecontractors will not want to take on staff. But the ManagementConsultancies Association figures for the first three-quarters of 2001 sawIT outsourcing growing at a very healthy 25.4%.

What most FDs can be fairly sure about is that issues such as risk,security and good governance will be right at the heart of their concernsfor the next few months, and probably years. The defiant message fromworld leaders after 11 September was “business as usual”. That businesswill continue is a certainty – but it is never going to be “as usual”again.