Risk management, planning, and audit are at the centre of the sector’s Covid-19 response

A black swan is defined, in Nicholas Taleb’s popular book, as follows:

First, it is an outlier, as it lies outside the realm of regular expectations, because nothing in the past can convincingly point to its possibility. Second, it carries an extreme ‘impact’. Third, in spite of its outlier status, human nature makes us concoct explanations for its occurrence after the fact, making it explainable and predictable.”

Covid-19 has had, and will continue to have, an extreme impact on just about every area of life. But it is emphatically not a “black swan” – it was always predictable. Everyone knew we have a small but specific chance of a respiratory pandemic any given winter. The trouble was, it was seen as vanishingly unlikely.

In a similar way, every newspaper (and even Wonkhe) has a “London Bridge” plan and accompanying documentation. This covers what would be published in the event of the death of the Queen – and details the effect of the formalities of the death of the monarch and coronation of another on publication. For this unhappy circumstance is also not a “black swan” – we know it will happen. We just don’t know when.

Predictability

The world has suffered from a pandemic driven by person-to-person infection before. Several times. Spanish flu, swine flu and SARS are all close analogues to the way that Covid-19 has played out. And most authorities had at least a plan in place for dealing with future versions – here’s the Westminster Government guidance for local planners from July 2013 and Department of Health response plan from August 2014.

Did your university have a pandemic flu plan? It perhaps wasn’t specific to such an infectious disease, but you almost certainly had a plan in place for if you were unable to use your campus for a sustained period of time. You will have had a “business continuity plan”, which formed your response to any number of possible crises and would have set out the decision making process and likely mitigations that would be put in place.

Coupled with this, there would be a risk register – which covered a measure of likelihood, a measure of severity, and a mitigation plan for a number of identifiable risks. A pandemic is unlikely to have been on there (too unlikely), but providers have been making use of mitigations designed for other risks. Thinking about being able to use the campus would have been informed by scenarios linked to fire damage or industrial action, plans dealing with a sudden drop in income and international recruitment may have begun with thinking about everything from geopolitical instability, to Brexit, to the Augar review.

In other sectors, for example the NHS where risks can materialise on a register quickly – risk registers will change in timescales measured in weeks. By contrast university boards tend to look at risk termly (focusing on things like recruitment, retention, and continuation data) – so we’ve seen some serious picking up of the pace.

Keeping things going

Business continuity was the first tool in the box that many reached for once the scale of Covid-19 became apparent – most or all universities already had business continuity plan plans, and had tested them in the last two or three years perhaps with industrial action as a scenario. A continuity plan puts infrastructure (largely IT) and decision making capability in place in the face of disaster. And the ability of universities to keep going through such radical change is testament to the quality of these plans.

That’s not to say the journey was painless. Some aspects of continuity planning have been overridden as events overtook processes, and sometimes decisions needed to be taken at speed rather than via the appropriate structure. But overall, plans would have served reasonably well.

Assurance in a crisis

It’s the job of internal auditors, and by extension audit committees to keep an eye on these in-the-moment contingencies, and to ensure that decisions are made appropriately. When you are in the teeth of a global pandemic and lockdown dealing with audit is initially very low on the list of front line priorities. But it is essential – an institution’s risk appetite will have changed, or the volumes of activity and operating environment will have changed and assurance is needed by management and governors.

One key aspect that internal audit should be looking at is business continuity and IT resilience. This is not because there has been a problem, indeed institutions appear to have adapted well to the change, but governors should be assured that IT systems have the right level of resilience in the medium term and that lessons learned are reflected in the approach to business continuity.

There will no doubt have been extensive communications with staff and students throughout the period of transitioning from ‘on’ to ‘off campus’, but as time passes this could have fallen away. It is essential that information is shared and used appropriately, and audit is the tool to follow this up in the short to medium term and provide insight to management on whether there are any cold spots.

Likewise, assurance is needed over the many changes in governance that may have been needed to operate during this emergency. Internal auditors will also be looking at the way financial controls and cyber-security standards have worked – unusual working patterns mean that the risk of fraud or malicious attack will be higher than in “normal” times.

Finance will be another key area of attention – procurement (especially in IT as the sector scaled up remote learning) will have happened quickly, but did it happen well?

External audit will need, as always, to vouch for the continuation of a provider as a going concern, a far more complex question than in recent times. As we don’t yet know the scale and nature of any possible sector bailout by the government, and there are serious concerns about recruitment for 2020-21, it is difficult to know what income a university will have – and with the duration (or repetition) of lockdown unknown there are also questions about expenditure. But as in other years, external audit will also focus on policy and process, and on safeguards and contingencies.

From planning to delivery

Planning in recent years has benefited from the availability of high quality data and the capacity to use it. But for 2020-21 and beyond, we need another approach – and scenario planning will be far more important than extrapolating from pre-pandemic trends.

To give you an example – a decline in international recruitment means a decline in fee income, which will have a direct impact on the availability resource to meet provider costs. But it also has an impact on everything from demand for accommodation to sales in catering outlets. Few providers will have models that cover all of this (though this can be addressed), but even if they did the question would be which scenarios to plug in? There are so many possible outcomes that the temptation is to wait until more information is available – but holding off planning runs its own risks. Decisions need to be made, even though reliable information and certainty does not exist to support them.

Getting a handle on what these needs might be is complex. Survey data, especially from international students, via the British Council and elsewhere, will be helpful, as will qualitative insight from recruitment teams. This proximate intelligence can be used to develop scenarios.

But keep an eye, too, on what levers the government may be adding to the system. Several providers are expecting a new emphasis on place based strategies. There is also the possibility of collaborations and even mergers – governors and management can make or break these putative relationships, so the capacity for wider strategic thought needs to be there.

Back to the campus

When the lockdown lifts, and when normal life begins to resume, it will be a long drawn-out process, both to manage a possible second peak as social mixing returns and to support our anxious and shattered minds. We should not underestimate the stress that both the current situation and the transition to and from it has put people under.

Governor decisions should be informed by good quality internal and external data as far as possible, but without compromising timeliness for accuracy. A high functioning governing body should ask for the insight and information it needs, and be able to challenge this as needed.

But one of the first tasks, for everyone, will be to reflect (both formally and informally) on how we managed what we have been through, and to update our emergency planning as appropriate. Because this is not a “black swan”, it will happen again, perhaps as soon as later this year. And we need to be ready.

We’re grateful to Fleur Nieboer, Andrew Bush, and Clare Partridge from KPMG for their support in developing this article.