The COVID-19 pandemic showed many organizations that they are insufficiently prepared for crises that could undermine their existence. McKinsey spoke with Celia Huber, a senior partner who leads the firm’s North American Board Services practice area, about the role boards can play in ensuring readiness for such crises.
McKinsey: Why is existential riskrising on the board agenda, and why is it important for insurance carriers?
Celia Huber: In our annual survey of approximately 1,500 corporate directors, we found that boards are not pleased with their performance on risk management. Very few report excellent risk management over the past year, and only 40 percent say their organizations are prepared for the next large crisis.
Traditional thinking is to estimate the value at risk times the probability of the event, but existential risks like oil spills that could derail the entire business need to be treated as if they could happen without adjusting for their probability.
The pandemic was an example of an extraordinary crisis, which we define as a high-consequence, low-likelihood event that can cause long-term economic impact, significant reputational damage, and leadership changes. This is not about looking for “black swans” but about identifying events that would have significant ramifications for the core of your organization. If you provide cybersecurity, for example, a cyberattack will be core to your value proposition. We are now seeing major issues around supply chains, and the inability to obtain inputs core to your products or services could pose potentially existential risks.
Corporate boards need to also consider scenarios in which multiple crises hit at the same time—that’s what COVID-19 represented. We had a health crisis, a financial crisis, and a social crisis. The risk of multiple crises is apparent in the public sector as well. I live in California, where the combination of the pandemic and our wildfire season led to a lack of personnel to deploy for things like vaccination clinics.
Insurance carriers play a unique role in society in ensuring financial stability and risk pooling across property, health, and mortality risks. Customers depend on insurers’ reliability to fulfill that promise and, secondarily, to safeguard their information. Existential risks affect insurance carriers in two ways. First, the underlying risk they insure can change and affect their ability to pay, such as when there’s a significant, society-wide increase in disability or mortality or rising wildfire risk. Second, within their own operations, insurers need to be mindful of risks such as cybersecurity threats to their customer data or their ability to pay claims.
McKinsey: How should boards approach assessing risks and their magnitude?
Celia Huber: While management is thinking about the higher-likelihood, lower-consequence risks, boards should sift through those low-likelihood “predictable surprises” and identify a handful of high-consequence ones to pressure-test against the operating model and core values. One effective approach is what we call a premortem, playing out how the organization would be affected by risks that the World Economic Forum and other groups of experts have identified. And it’s important to think about the first order of consequences, the second, and the third.
I worked with one insurance carrier’s board that started by identifying 25 trends that generated risk for the organization, such as labor shortages, inflation, recession, and government regulation. We tried to make these trends granular so we could play out the compounding of risk, and from those 25, we identified a subset that we felt were existential—they would change the future of the business.
McKinsey: How should the board approach mitigation of those extreme risks?
Celia Huber: You need to make sure that management is investing in resilience holistically—implementing measures to protect the organization during an incident and to preserve its ability to invest coming out of the crisis. For example, I work with life insurers and retirement product providers for whom the pervasive low interest rate environment is a threat to their business model. A resilience mindset for them means asking: How long can we weather the storm, and do we think interest rates will ever change? One company drew a line in the sand: “We will stay in this business until this point. Past that point, we will change the products we offer because we can no longer manage the risk.” Risk appetite, both financial and operational, is very important to define. Boards that do this well not only force themselves to think about what could happen, should happen, and is likely to happen, but they purposely pick one of the outlier scenarios and go deep on it so that they can push their thinking.
In terms of mitigation, I’d be remiss not to mention the obvious lever of insurance. It may be costly, but better to have coverage than to cover losses fully from your own equity capital. Another element involves operating risk. What is the cost of a chemical spill that forces you to shut down your plant and pollutes the surrounding communities? There is insurance to mitigate that, but you can also make safety or equipment changes and process improvements. If you think about earthquake risk and mitigation, insurance may be too expensive, so companies need to consider operational changes that enable them to withstand, say, a 5 magnitude earthquake but maybe not go so far as to prepare for an 8 magnitude one.
***
Celia Huber is a senior partner in McKinsey’s Bay Area office.
For more on corporate governance and board effectiveness, see:
- Ron O’Hanley of State Street on corporate resilience and ESG
- The postpandemic board agenda: Redefining corporate resilience
- How to accelerate gender diversity on boards
- How boards can help digital transformations
- Inside the Strategy Room podcast: The role of the board in preparing for extraordinary risk