What Brexit teaches operational risk management

Receptiveness, resilience and reflection are crucial for avoiding nasty surprises

It will take more than a crystal ball to assess Brexit's impact on the industry

Ariane Chapelle is honorary reader in operational risk at University College London and the director of Chapelle Consulting, a UK-based risk management advisory firm

Like others, my main emotion was one of incredulity on the morning of June 24. The result of the UK's referendum on membership of the European Union was a surprise for most and terrible news for many. In common with The Economist, I believe there is "much to lament" over this outcome, as well as the whole process that led to it. Besides the astonishment and political storm we are still very much feeling today, Brexit has taught me three lessons in risk management that I would like to share.

Receptiveness: don't rule out the unlikely

I never thought Brexit would happen. I trusted the bookies, distrusted the opinion polls and was convinced the old populist arguments for protectionism and curbs on immigration would seduce only a minority. I wasn't alone in being wrong, but I was wrong. I was so convinced of a 'remain' vote that I didn't prepare for it.

One of the companies I work with, a French financial firm, felt similarly. Its risk management department prepared nothing except a vague internal note on Brexit – and only then because it was encouraged to do so by the European Banking Authority. On the morning of June 24 it appeared unprepared, with no contingent communication to offer its clients.

Not everybody was so blind or so careless. At the other end of the spectrum, a UK-based firm I have worked with closely didn't leave anything to chance. The firm, which is active in foreign exchange markets, didn't expect a 'leave' outcome any more than I did, but the chief risk officer and his team made sure to prepare for every possible market scenario, no matter how remote it looked.

The 40 traders and risk managers who spent the evening of June 23 at their desks did not waste their time. Many stayed up for more than 30 hours in a row. What happened exceeded all their expectations, but did not reach their worst-case scenario either, and the firm actually did very well that night.

That firm and its chief risk officer taught me a risk management lesson: don't ever let your personal convictions come in the way of prevention and contingency. Be open-minded and receptive to others' ideas and opinions when preparing for the future, however unlikely or bizarre they might seem. Life is vastly unpredictable, and human minds are particularly ill-equipped at predicting future events, so be humble in your forecasts.

Resilience: management is as important as prevention

Prevention is better than cure, according to common wisdom. For a long time, operational risk management in financial services has focused, sometimes solely, on risk assessment, prevention and internal controls. This can foster overconfidence in the safety of your business, leaving you disarmed and vulnerable when accidents strike. By the bank's own acknowledgment, the damage caused at NatWest by IT breakdowns was as much down to poor incident management as the breakdowns themselves. Similarly, it is public knowledge that the regrettable way BNP Paribas tried to resist the US Department of Justice over historical sanctions violations did not lessen the eventual penalties.

There are many examples of incidents and accidents that were either mitigated or aggravated by efficient or poor crisis management. In 2011, jazz improvisation player Stefon Harris gave an interesting talk at a TED event explaining how many actions are perceived as mistakes only because we don't react to them appropriately. This view from the world of music is also relevant to risk management.

From technological breakthroughs to political changes and regulatory reforms, our increasingly volatile environment forces firms and individuals to be more adaptable, reactive and resilient. The UK education system has also embraced resilience and adaptability: rather than trying to teach our children knowledge that will soon be outdated or that doesn't yet exist, primary and preparatory schools aim to teach the skills of inquisitiveness, curiosity and perseverance. That way, they equip children with the skills to learn and adjust to whatever technology and knowledge they will need in the future.

This idea is just as applicable to organisational resilience. It is pointless to try to guess future incidents and much wiser to learn to adjust to them, so that firms can adapt to whatever comes their way. I know of one UK-based international bank that has launched a risk management theme around resilience: the objective is to reflect upon and improve the resiliency of the firm to whatever major event that may strike, whether it is economic, physical, reputational, or anything else.

Reflection: take time to learn the lessons

Reflection is my third Brexit lesson. Brexit should encourage risk managers to reflect on their past mistakes and successes to get the most out of their experiences. There is much to learn from Brexit and not only from a political standpoint. How we, as risk managers and professionals, have prepared for it – or not – is rich with teachings.

As part of their operational risk management framework, some firms have a 'lessons learnt' element. This consists of the action plans and other transformations determined following a large incident, or a significant near-miss.

'Lessons learnt' is more explicit and therefore a more advisable wording than the classic 'action plan'. It highlights the need for reflection before the need for action. In a fast-moving world it is difficult, but important, to take the time for reflection. Too few of us do it, so it also confers an interesting competitive advantage.

So what did I learn from Brexit? I learnt that, even if we must be aware of our environment, our exposure and our vulnerabilities, only fools can pretend to know what the future holds. We must be humble about our capacity to foresee the future and to anticipate disruptive changes. By definition, no-one can see what is 'around the corner'. To me, even with a set date and tight polls, Brexit was 'around the corner'. I would have bet confidently that it wouldn't happen. Then it did. My convictions made me blind.

We all have blind spots. Being aware of them is a first step. To accept and prepare for a seemingly impossible event is better. And because the future is so hard to predict and risk is so difficult to assess, the resilience of firms and individuals to change is a skill that needs to be further developed, both in schools and the financial sector. Finally, reflecting on our mistakes and successes in relation to Brexit, or any other significant event, will help us to adapt and adjust to the next one.