Skip to main content

Business continuity management and organizational resiliency

Learning the lessons from COVID-19

Casualty|Risk & Analytics|Property
COVID 19 Coronavirus

By Frederick Gentile and David Gluckman | May 7, 2020

Learning from COVID-19 can help organizations respond to future events in a more effective manner.

Emergencies or crises are rarely welcomed and can be quite traumatic events. COVID-19 is no different when one considers the number of lives lost, the effect on society following restrictions on behavior and movement and of course the impacts of the situation on world markets.
Most people would agree that the quicker we can get over this virus the sooner we can get back to normality (although this ‘normality’ may not necessarily be the one we had in mind).

What can we learn?

Nevertheless, even as we begin to resume normal patterns of behavior and come to terms with the consequences of what has happened, there are still lessons to be learned. Were companies prepared for such an event? Did we see this coming and should we have? Did health systems have sufficient capacity to cope with the surge in patients requiring intensive care or ventilators? These are some of the higher-level questions that need to be considered. At a lower level, companies may be asking themselves how they coped with the financial pressures of potentially drastic reductions in revenue, mitigated the impact on their supply chain and dealt with the sudden shift to remote working. Equally, some may reflect on how they managed the surge in demand (e.g., food retailers) or change of production to meet government requests (e.g., ventilator production or personal protective equipment).

A recent article from Willis Towers Watson reminded us that ‘risk managers and their risk management partners need to start talking and planning now for a very different insurance landscape. Insurance companies will immediately look at your previous claims history. If you filed a claim, it’s important to put a well-documented story around it – for example, what you learned from the incident behind the claim, remedial efforts you’ve taken to avoid or mitigate a recurrence. The ability to learn from our experiences enables us to respond and manage future similar events in a more effective and efficient manner.

The U.K. national guidance on emergencies sets out clear instructions on the need to ‘ensure that a continuous evaluation of the recovery phase takes place, and that any issues identified are captured and actioned as necessary.1 In the U.S., FEMA guidance states ‘The lessons learned during a disaster or other emergency provide the basis for plan revisions and improvements in preparation for the next event.’2 Furthermore, the development of a “debrief” or “after action report” (AAR) is an extremely valuable tool designed to provide feedback post-event. These documents are designed to summarize the event, analyze the actions of participants and identify areas needing improvement.

What’s the best approach to identifying key learnings?

The method chosen to carry out a debrief/AAR will be a matter of choice and dependent to some extent on factors such as scope, geography, company size and culture. Whatever the choice the following are some basic considerations you should include3:

  1. Incident overview: What happened, when did it happen, how did it happen, etc.
  2. Analysis: What was observed? What was expected? Was anything unexpected? Who was involved in the incident? What are the strengths? What are the areas of opportunity? The analysis portion of your post-action report should be the longest and most detailed portion of your report. Were the stated response and recovery objectives met? Where plans exist, how did actual actions differ from planned actions? Did your risk assessment and business impact analysis fulfill your needs and expectations?
  3. Recommendations: In the recommendations section of your report, detail ways to improve performance for future incidences.
  4. Improvement/action plan: In the improvement plan, you will detail corrective actions to be taken for future incidences. Be sure to include any additional training requirements, equipment needs or any additional planning that needs to be completed. Be sure to list the party responsible for completing these steps and include due date, timelines and owners.
  5. Conclusion: The conclusion is a summary of all the sections of your report.

Furthermore, debriefs and AARs can come in various shapes and sizes and might include the use of:

  • Questionnaires
  • Focus group
  • Websites
  • Existing stakeholder networks (e.g., business networks, key suppliers, unions, etc community groups, etc)

Other factors to bear in mind are:

  • A debrief/AAR should be held as soon as possible after the event and preferably within 30 days.
  • Debriefs/AARs are not about attributing blame but focusing on what can be learned and improved.
  • Due consideration should be given to ensuring that the most appropriate and relevant stakeholders are invited to participate. A debrief/ARR is not a tick box exercise.
  • The environment must be constructive and designed to make people feel comfortable about being honest with their views.
  • Consider whether an external facilitator is better placed to manage the event (subject to security, confidentiality etc).

There are undoubtedly many templates available but a simple approach such as described below may help:

  • What did we do well?
  • What would we do differently?
  • What do we need to change?
  • Action list with timelines

The use of materials such as notes or flipcharts to collate people’s views will assist in the process.

Looking forward to a more resilient future

While a debrief/AAR may be the last thing on people’s minds, it does provide a powerful learning opportunity and can contribute to making the organization better prepared to deal with abnormal events in the future.

Companies must begin to build their resilience by using techniques such as:

  • Using data and analytics to model scenarios and impact so that they can create more effective mitigation and contingency.
  • Looking more carefully at business impact analyses to understand the consequences of a major disruption over time and across their key parameter (e.g., financial, reputational, customer, operations, people, etc.).
  • Improving the utilization of risk assessments to contextualize and evaluate the threats both short and long term.
  • Establishing the issue of resilience as an ongoing board priority.
  • Where appropriate, employ forensic accounting and complex claims services that help organizations across all industry sectors globally recover from catastrophic events and can add value by:
    • Simplifying the claim process so clients can focus on returning to normal day-to-day business activities
    • Quantifying the loss amounts and gathering the necessary supporting documents
    • Minimizing the overall disruption to business operations by obtaining cash advances in the early stages of a loss
    • Preparing and submitting the claim on your behalf in a format that is familiar to insurers
    • Working directly with the adjuster and the carrier’s experts
    • Participating in meetings to explain the methodology behind loss calculations and respond to requests for additional documentation

The lessons learned must in reality be used as the catalyst for a new mindset that organizations need to adopt (i.e., a step change in organizational resilience).


Each applicable policy of insurance must be reviewed to determine the extent, if any, of coverage for COVID-19. Coverage may vary depending on the jurisdiction and circumstances. For global client programs it is critical to consider all local operations and how policies may or may not include COVID-19 coverage. The information contained herein is not intended to constitute legal or other professional advice and should not be relied upon in lieu of consultation with your own legal and/or other professional advisors. Some of the information in this publication may be compiled by third party sources we consider to be reliable, however we do not guarantee and are not responsible for the accuracy of such information. We assume no duty in contract, tort, or otherwise in connection with this publication and expressly disclaim, to the fullest extent permitted by law, any liability in connection with this publication. Willis Towers Watson offers insurance-related services through its appropriately licensed entities in each jurisdiction in which it operates. COVID-19 is a rapidly evolving situation and changes are occurring frequently. Willis Towers Watson does not undertake to update the information included herein after the date of publication. Accordingly, readers should be aware that certain content may have changed since the date of this publication. Please reach out to the author or your Willis Towers Watson contact for more information.






Senior Risk Control Consultant

Related content tags, list of links Article Casualty Risk & Analytics Property COVID-19 (Coronavirus)
Contact Us