Our thinking

Risky business

29 September, 2023

In a world where uncertainty seems to lurk around every corner, the British government has a tool to assess the impacts and likelihoods of potential disasters. Enter the latest edition of the National Risk Register: a pretty overwhelming catalogue of risks – or a set of ‘apocalyptic Top Trumps’ – that scores and categorises the many and various ways in which life as we know it may come to a gruesome end.

Its purpose? To identify and help manage the risks that could threaten the UK and its interests.

The register plots acute risks – those that are event-driven – which range from pandemics to terrorist attacks to public disorder and disruptions to global oil trade, on a matrix based on likelihood and impact. It serves as a resource for experts tasked with devising contingency plans and aims to assist businesses in understanding the risks that threaten their ability to operate.

But here lies a missed opportunity. Despite being designed for businesses to use, businesses without a proper risk function will struggle to use the register, because it doesn’t explicitly outline the ways they can manage the risks they may face or how to identify which specific risks may be particularly relevant to them.

Interestingly, one omission from the register is climate change, despite its undeniable status as one of the most formidable threats to business and society at large. It is excluded because it is considered a ‘chronic risk’: one that manifests over a longer timeframe and will contribute to the increased severity and frequency of other (acute) risks such as wildfires, droughts, heatwaves, and flooding (which are captured on the risk register). The preamble to the risk register says that chronic risks (others include antimicrobial resistance and AI systems) will now be addressed elsewhere, but guidance on chronic risks is not currently available in an updated form.

In our view, this sends a dangerous message to businesses who are encouraged to use the risk register for their planning. If one of the biggest risks to business continuity is missing from a “National Risk Register”, even as many businesses are being asked to consider the risks of climate change through the framework of the TCFD, how can it be fit for purpose? While the distinction between chronic and acute risks is a helpful one in terms of framing responses to disasters, an opportunity to communicate the importance of adaptation strategies to the business community, particularly SMEs who are not currently within scope of TCFD, has been missed.

By Bertie Bateman