The 2-month lockdown and subsequent measures to open the economy has caused significant damage to the Cypriot and world economy. This damage is going to last for the remainder of 2020 and into 2021. Together with exogenous events and new competitive pressures, it is clear that we have entered a new period of volatility and crisis.
Every company and every entrepreneur, no matter what size, must understand that these tendencies will only intensify, and that crisis management and continual change must become core survival skills. This article explores how to understand risk, how to prepare for it, and the mindset needed to institutionalize it in companies and start-ups.
1. Remembering Crises Past
We tend to have a short-term memory. The latest crisis--the COVID-19 Pandemic--has eclipsed our memory of past events. Yet a quick review of our recent history since 1995 indicates just how volatile the last 25 years have been. I have outlined in yellow the events that have been particularly difficult for Cyprus, where I live.
This list of crises, however, should be sufficient to remind everyone that volatility is global. Everyone is affected.
1995 NATO Bombing Campaign, ex-Yugoslavia; Bosnia-Herzergovina
1997 East Asian Currency Crisis
1998 Russian Ruble Devaluation and Debt Default
1999 NATO Bombing Campaign, Kosovo
1999 Cyprus & Greece Stock Market Crash
2000 International dot.com Crash
2001 9/11 Attacks on New York, Washington DC
US Invasion of Afghanistan
2003 US Invasion of Iraq
2005 Hurricane Katrina floods New Orleans
2006 Israeli Invasion of Lebanon
2008 International Banking & Credit Crisis
2009 Dubai Defaults on Foreign Debt
2010 Greek & European Sovereign Debt Crisis
Deepwater Horizon Oil Spill in the Gulf of Mexico
2011 NATO Bombing Campaign, Libya
Syrian Civil War Begins
Fukushima Earthquake, Tsunami and Nuclear Meltdown
2013 Cyprus Banking Bail-in
2014 Occupation of Crimea; War in Donbass, Ukraine; Embargo on Russia
2015 Syrian Refugee Crisis in Greece, Europe
Capital Controls implemented in Greece
2016 Coup Attempt against Turkish President Recep Erdogan
United Kingdom votes to leave the European Union (Brexit)
2019 Turkish Exploration in Cypriot Territorial Waters
2020 COVID-19 Pandemic
Some of the events on this list may not appear to directly affect Greece or Cyprus. For example, the 2016 coup attempt against President Recep Erdogan was a purely domestic affair. Yet who can say how this traumatic experience has affected President Erdogan’s psychology and decision-making framework?
The same applies to the 2011 NATO intervention in Libya. Apart from UK bombing missions launched from the Akrotiri Airbase by the RAF, one would have expected that Cyprus was not affected by this conflict. This is not so:
-
There is a direct link between the fall of Libya in 2011 to the start of the civil war in Syria in the same year.
-
There is a direct link between the Turkish incursions into Syria and Syrian refugees in Greece and Cyprus.
-
There is a direct link in the current Libyan civil war and Turkey’s presence in Libya, together with Libya’s acceptance of maritime boundaries between Turkey and itself, to the detriment of Greece, Cyprus and international law.
In addition to exogenous threats, we have become inured to new competition emerging from the world wide web as well as from new competitors and substitute products entering the market. By entering the EU, we have gained access to a Single Market of over 500 million Europeans, but we also feel the competitive shock brought about by rival competitors in this market, as well as by those as far away as China.
My point is that crisis management and risk assessment should have become a critical competence for company managers in Cyprus and internationally.
Murphy’s Law states that “Anything that can go wrong will go wrong.”
My own Law is somewhat more absolute: “Everything goes wrong.”
This is not to say one becomes a pessimist and abandons hope. The opposite. One prepares to worse-case scenarios, has a contingency plan for every eventuality, and is prepared for continual risk.
2. Risk Assessment
Risk assessment is the process by which a company or other entity quantifies the types of risks it confronts, the likelihood of their occurring and their likely impact on the company.
Let’s take a look at the exogenous risks affecting Cyprus.
Geopolitical Risk
Turkey: Relations deteriorate leading to limited armed conflict or clashes offshore (see ENI). This would immediately lead to a flight and shipping blockade of Cyprus.
Israel: A regional war between Israel and its neighbours or non-state actors
Russia: Further embargos or issues lead to limiting the bilateral business relationship
Likely Impact:
-
Confidence in Cyprus diminishes and then collapses
-
Capital & labour flight
-
Disruption of flights, tourists and financial flows to Cyprus
-
Russian and other companies leave Cyprus
-
In some scenarios: business opportunities
International Regulatory Overshoot
International regulatory requirements continue to increase, making costs of compliance difficult. This is clearly seen today, driven by EU and OECD initiatives.
Likely Impact:
-
Higher compliance costs
-
Confidence in Cyprus diminishes
-
Capital, business & labour flight
US Treasury Operations
Under the guise of AML and anti-terror financing, the US Treasury is placing severe pressure on Russian owners of bank accounts. A significant number have been closed.
Likely Impact:
-
Deposit flight
-
Investor flight
-
Asset base and income of Cypriot banks falls still further
-
Confidence in Cyprus diminishes
International Financial Crash
An emerging debt crisis or a real US-China trade war, and/or a further European debt crisis.
Likely Impact:
-
Lower overall capital and trade flows; synchronized recession
-
Bank failures
-
Corporate bankruptcies
Act of God
A force majeure event such as a pandemic, earthquake, tsunami, major forest fire, or other catastrophe.
Likely Impact:
-
Impact varies depending on scale and location of the event, but the consequences will be signif
-
ant.
Let’s look as well at some key endogenous risks.
Regulatory Error or Capture
The key risk is whether Cypriot regulatory authorities have the resources necessary to implement their mission. For example: are Forex companies properly regulated in Cyprus?
Likely Impact:
-
Further damage to the business reputation of Cyprus
-
Financial damage to investors in specific segments
-
Higher costs of regulation and compliance
National Regulatory Overshoot
Cyprus regulators overstep their bounds. Rather than smart regulation, regulatory authorities rely on high bureaucratic procedures.
Likely Impact:
-
Higher compliance costs
-
Lower regulatory quality.
Revisions to ICP or HNWI Incentives
Further revisions are made to bring Cyprus standards on substance, residency duration, or citizenship grants in line with OECD practice. Cyprus incentives lose their attractiveness compared to other onshore or offshore jurisdictions.
Likely Impact:
-
Labour & Input Price, Quality and Availability
-
Recruiting and retaining the qualified, highly skilled managers and staff needed is becoming more expensive and difficult. All costs are rising.
-
Labour imports or labour offshoring; rising costs for investors.
Lower Banking Effectiveness
High costs of banking for foreign investors; low bank productivity; high bureaucracy and compliance; low capital availability.
Likely Impact:
-
Lower bank lending (negative feedback loop)
-
Investors focus on jurisdictions with a better financial or fintech ecosystems.
Political Fragmentation and Policy Paralysis
The large number of political parties in Parliament prevents decision-making; policy paralysis results
Likely Impact:
-
Poor decisions; delayed decisions
-
Higher corruption and nepotism
-
Greater state control over the economy and society.
3. Paradigm Shift Risks
In addition to the classic exogenous-endogenous risks, I would also like to mention some paradigm shift risks. These are risks that are occurring as a result of changing large-scale economic and social trends. They are happening no matter what: their impact is game-changing. Further information on how we evaluate key trends can be seen in our Corporate Vision.
Economies of Scale, Productivity and Specialisation
Economies of scale are rising continually as industrial specialization takes place. This means that in many sectors, larger-scale competitors (e.g. in Germany or China) are able to produce, ship and distribute to Cyprus more profitably than local companies can compete.
Cypriot manufacturing must specialize and export. But Cyprus has a small domestic market and uncompetitive international transport links. Many Cypriot producers will close or consolidate (depending on the sector).
The Eroding Middle Class
Rising prices are hollowing out the middle class. This results in a larger and more dominant elite that controls resources and eventually political decisions. This also results in an underclass usually bereft of economic opportunities and social mobility.
Domestic consumer spending either must fall, or must be sustained by debt. Political decision-making and governance become distorted.
Climate Change
We have entered the Anthropocene era: a time when human activity affects the Earth.
Weather conditions become more extreme; large scale risks like ocean acidification and fisheries extinction will fundamentally change the environment.
Technological Change
The scope of technological change, as expressed through digital transformation and associated paradigm shifts, is overwhelming. The rise of artificial intelligence, automation and big data means that many professions will be eliminated or radically transformed, with much lower employment. The eventual addition of genetic therapies and technical implants in humans will change the very definition of humanity.
Lower employment needs in basic, unskilled professions as robots and software replace humans.
Increasing inequality and disenfranchised “digital helots”. The rise of an underclass equal to at least 50% of most populations.
The digital world becomes more attractive and convenient than the physical world.
Hacking attacks, identity theft, IP theft, denial-of-service attacks and other technological threats multiply.
Overpopulation and Migration
The Earth’s population has reached 7.78 billion people and continues to rise. This creates incredible environmental stress while intensifying migration flows.
Environmental stress includes human-driven desertification, overfishing and overgrazing as well as pandemic releases (e.g. Ebola).
Migration flows from poor countries to rich ones is creating fundamental pressures on both source and destination countries.
4. Chance of Occurring
A normal risk analysis framework would outline the chance of occurring for each risk. Yet as per Murphy’s Law (or Ammerman’s Law), or as per the historical analysis in Section I, it is clear that risks in our part of the world have been occurring almost inevitably.
Moreover, the Paradigm Shift risks are exactly that: they are risks that will affect all of us. Indeed, we see these as inevitable developments that can already be clearly observed in our operating environment.
Rather than providing a chance for each risk, we suggest taking an alternative approach:
Every 3-5 years, a significant exogenous or endogenous risk will occur, fundamentally changing our business conditions and environment to a critical effect.
5. Corporate-Level Impact
The likely corporate-level impact of such a risk event includes:
-
An existential disruption to normal business operations. This means that for a minimum period of 2 weeks to possibly several months, normal business operations, defined as value-gaining services or products provided in a specific place to specific customers, are disrupted.
-
A significant loss of income, starting from a minimum of 20% of annual revenue. This loss of revenue is due to the business disruption outlined above, but also due to equivalent disruptions felt across the customer and consumer ecosystems the company serves.
-
A significant loss of profitability. This can be measured in terms of negative profitability and negative cash flow for an extended period, usually at least 4 months. On the one hand, this is due to extra spending needed to maintain basic business operations. On the other, it is due to the need to discount and provide additional value in order to make sales.
-
A significant loss or morale, productivity and work hours by the company’s workforce. On the one hand, this may be a direct impact of the crisis itself (e.g. an air bombing campaign; pandemic lockdown). On the other hand, this may reflect very real psychological difficulties of the workforce to adapt to the new business environment at the heart of the crisis.
-
A whiplash effect on general consumer spending and consumer confidence. This leads to behaviors such as cutting expenditure or stockpiling basic necessities, and in turns leads to an overall decline of consumer spending (except in certain categories).
There are also some ecosystem-wide impacts or trends that are usually observable:
-
Government response shows itself to be inadequate, delayed or insufficient. Despite spending billions on civil protection, public sector ability to manage even simple crises appear to be an empty box on an organizational chart. This further betrays public trust and intensifies the damage already wrought by the crisis.
-
This inept government response tends to create a class of insiders and outsiders. The insiders are the ones who use political lobbying and connections to get their share of disaster relief and profit from the crisis. The outsiders are those who cannot navigate the complexity and lose out. This only increases the sense of alienation and distrust between government and citizens, and between rival companies.
-
The tail-end of the crisis impacts tend to accelerate, or at least continue, long after the direct crisis ends. For example, the COVID-19 Pandemic lockdowns have lasted, on average, about 2 months. The wave of bankruptcies of companies driven out of business by the lockdown (not the virus) is only just beginning.
6. Risk Mitigation
Back in 1997, my company faced a dramatic loss of income brought about by the public sector cancellation of a series of projects we were working on. This was no fault of our own: it was a policy decision made by the European Commission on a broader scale. We were confronted by an immediate loss of 75% of our income.
At that point, we defined a risk mitigation framework as follows:
-
Always have a minimum cash reserve of 3 months operations;
-
Never let any single client account for more of 20% of turnover;
-
Never let any single business practice or geography account for more than 25% of turnover;
-
Carefully monitor star clients and star consultants for their durability and loyalty.
Fast forward to the COVID-19 Pandemic and we see that while points 2-4 of the framework were adequate, point 1 was not. In fact, in the present crisis, we see that not only 90% of turnover has evaporated, but that given the lasting effects of this crisis, we don’t expect to regain all of it this year. So rather than 3 months operational reserve, we need closer to 8 months.
Each company must define its own risk mitigation framework. What I will present here is a guideline on some key aspects of developing a risk assessment and risk mitigation framework.
Cash Reserves
No matter what, you need access to cash reserves in a crisis. This can either be your own cash, or an emergency credit line. This should typically be sufficient for 3 months operations, but as COVID-19 shows, 8-12 months may be more appropriate.
Cash Access
The capital controls in Greece and Cyprus taught us that having cash in the bank is no guarantee of having cash in the hand. It is imperative to have a range of back-up banks and financial instruments available so that you can access cash if needed.
Since the 2013 and 2015 events in Cyprus and Greece, my company has opened foreign bank accounts in multiple countries and have also gained access to Revolut and other payment systems that should enable the free(r) movement of and access to cash in the case of further capital controls. Everyone should do the same. You cannot rely on a single bank in a single country: multiple examples have taught us this lesson.
Buffer Stocks / Emergency Reserves / Supply Chain
We currently depend on a global supply chain for all forms of critical and discretionary goods and services. This supply chain is fragile, and in an island like Cyprus is even more susceptible to disruption. The run on toilet paper in the UK and other countries during the COVID-19 crisis is an amusing case in point.
Management theory teaches us that reducing inventories in a benefit. But it’s a critical risk to business operations if the supply chain is disrupted. What are your minimum buffer stocks needed in cash of a supply chain disruption? What emergency reserves do you need? Those reserves will not only sustain you in a crisis, but can become an important source of barter or income.
Customer & Market Dependence
A crisis may impact your customers or a key market first. The crisis risk on your company is initially indirect, but will manifest itself when a customer defaults on payments, cancels orders or requests discounts or greater credit terms.
In general, ensure that your dependence on any single customer and segment or geography is limited. Diversify internationally and/or online as far as possible while retaining a strong local market presence. (This advice is heavily segment-dependent, but the diversification strategy should be clear).
Executive Performance and Dependence
Just as you may depend on a few key clients or suppliers, so may you depend on a few star employees or managers. What happens if their performance is disrupted (e.g. from a family situation or divorce) or by a competitor (and they leave the company?).
Have you taken steps to retain key staff? Are you supporting key staff in difficult personal times? Do you have adequate non-compete safeguards in place? Do you have a rotation and staff reserve system in place?
Key Vendor, Supplier and Subcontractor Reliance
In many cases, we build up excessive reliance on a dependable vendor, supplier or subcontractor. A crisis is often unleashed by an unforeseen event happening to that actor: a bankruptcy, take-over, generational change, or physical disaster like a fire, flood or other event.
How reliant are you on key vendors, suppliers or subcontractors? Under what scenarios could this reliance become a problem for you? What are the alternatives?
Physical Safety
In the corporate world, we tend to take physical safety for granted. But in a crisis, this is often the first assumption to fall. When the Greek financial crisis started in 2010, the rate of burglaries and home invasions in Athens and other cities skyrocketed. At the same time, police patrols were nowhere to be seen, and calling the rapid response number was a joke.
What measures do you need to take to ensure physical safety of your staff, facilities and other key assets? What measures need to be extended to their families and other stakeholders?
Mobility
One of the first key services to go in a crisis is mobility. This is either due to a disaster, e.g. an earthquake or flood that disrupt transport lines, or due to government decision, such as the COVID-19 lockdowns.
In 2014, we had a client in Lugansk, Ukraine, that could no longer ship products because transport firms refused to enter a war zone. In the 2020 COVID-19 Pandemic, every single tourism client is affected by the flight shutdown.
How dependent are you on mobility? What will you do if your normal transport networks are shut down? Do your contracts reflect a force majeure clause in case of transport interruption? Do you have a backup plan?
Secondary Facility / Remote Working Networks
A crisis will typically have a major effect on primary facilities such as factories or office buildings. The 9/11 attacks in New York City, for example, placed much of the financial district off limits, and spurred a need for disaster recovery facilities in New Jersey.
What steps have you take to have a secondary facility? Is your data backed up securely? Can you organize remote work or work-from-home arrangements for your staff?
Data & Record Security & Liability
Many companies still rely on single-site data storage, and paper data storage. In a crisis, this data may be destroyed or rendered inaccessible, stopping operations. Data storage without adequate physical and cybersecurity safeguards will also place your company at risk of a heavy fine under the EU General Data Protection Regulation.
What steps have you taken to protect critical data and records? Do you have back-up storage sites and cloud or digital storage? How are these protected?
Technology Evolution and Digital Transformation
Today, no matter what your current condition, you need a strategy to engage with customers and move your company online. This may be transformational in scope or simply transactional, but it needs to be done. Technology is fundamentally changing every aspect of human social and economic interaction. Smaller and more isolated societies like Cyprus have avoided this to a large extent. Other countries like Estonia have been first movers and innovators in it. The gulf between the two is incredible.
7. First Conclusion: The Crisis is Permanent
To conclude, I’d like to return to the list of crises suffered in Cyprus and the region that was listed at the beginning of this article.
2013 Cyprus Banking Bail-in
2014 Occupation of Crimea; War in Donbass, Ukraine; Embargo on Russia
2015 Syrian Refugee Crisis in Greece, Europe
Capital Controls implemented in Greece
2016 Coup Attempt against Turkish President Recep Erdogan
United Kingdom votes to leave the European Union (Brexit)
2019 Turkish Exploration in Cypriot Territorial Waters
2020 COVID-19 Pandemic
In Cyprus, most of us had the feeling that the economy was recovering after the 2013 bail-in. Revenue was pouring in due to the Cyprus Citizenship by Investment Programme. Tourist arrivals reached nearly a record of nearly 4 million in 2019. New skyscrapers litter the Limassol and Nicosia landscapes. High end restaurants like Matsuhisa opened and prospered, and getting a reservation in even average restaurants could be a challenge on weekends.
But look at what the record shows.
Since 2013, nearly every year, there has been a significant exogenous event which has either drastically affected Cyprus, or will in the near future.
In the meantime, even without these, the Paradigm Shift risks are gaining traction and velocity. Technological change is moving faster and faster. Inequality is growing. The threats from migration are growing.
This means that whatever progress we have made since 2013 has been made in spite of adverse conditions and risks, not because of stability.
This also means you should remember Ammerman’s Law: Everything goes Wrong. Be prepared for a crisis every year.
8. Second Conclusion: Agility is Key
The second conclusion is that your ability to survive and prosper in an age of continual crises is to be agile. You need to not only be ready to change, but to embody change as a core competence in your management team and your organization.
Lean management has defined Kaizen as a process of continual improvement and change. This should be accompanied by a process of continual risk assessment and disruptive innovation. Companies must continually adapt and change to survive. This must occur faster than ever, and more surely than ever.
Today, we need to be constantly aware of the risk framework under which we operate. To not implement a risk assessment and mitigation strategy is simple blindness. It means we ignore the historical record of adverse events over the past 25 years (or even going back to 1974) and press ahead regardless.
Today, everything is changing, and almost nothing can be taken for granted. Incorporating this mindset into your management team and company is critical for success.
The sooner you begin, the better.
“The only constant in life is change”
--Heraclitus
Limassol, Cyprus
29 May 2020
Related Content
Risk Analysis & Mitigation Services
The Cyprus Investment Strategy: Competing in the New World
This article is dedicated to our clients in Cyprus, Greece, Ukraine, Russia and other high risk countries who have managed to survive and excel despite operating in one of the most adverse business environments in the world.