Stefan Heissner, Senior Managing Director and risk and forensics expert at FTI Consulting
Economist impact study commissioned by FTI Consulting: companies have no specific contingency plans for crises in the drawer / North American companies better positioned
Only about half of 600 companies surveyed worldwide have a specific contingency plan in the event of a cyber attack (56 percent), a supply chain failure (58 percent) or an attack by an activist investor (54 percent) in the drawer. There are noticeable differences between North American and European companies – in particular, companies in Europe and other countries in the Middle East and Africa (EMEA) still have room for improvement in many areas. These are the findings of a survey conducted by the think tank Economist Impact on behalf of the management consultancy FTI Consulting (NYSE: FCN).
- 56 per cent of companies in EMEA have a contingency plan for a cyber attack, compared to 65 per cent in the US
- American companies are clearer in their assessment of their deficiencies in the risk area
- A lack of structures and processes often leads to inefficient response times when a crisis occurs.
While in North America, 70 per cent of respondents are specifically prepared for an activist investor and 65 per cent for cyber attacks with an emergency plan, only 53 and 56 per cent respectively of European companies have such plans. Nevertheless, almost three out of five companies on both sides of the Atlantic are prepared for supply chain disruptions. But there are further differences: while 70 per cent of American companies are very well prepared for compliance-related misconduct by executives, only slightly more than half of the respondents in Europe and other EMEA countries (56 per cent) indicated that they were prepared for this. When it comes to dealing with geopolitical risks, 67 per cent on the other side of the Atlantic have developed specific plans, compared to 54 per cent in Europe.
‘Companies in the US are accustomed to intensive legal disputes. That is why they often have a much stronger focus on dealing with risks,’ says Stefan Heissner, Senior Managing Director and risk and forensics expert at FTI Consulting. ‘In the US, regulation often occurs ex-post through court rulings, whereas in Europe it is usually ex-ante through legislation. Regardless of the regulatory framework, however, companies should establish a solid risk management system. The majority of companies have done this. However, it is noteworthy that a significant proportion of companies, including large ones, say that they explicitly do not have adequate contingency plans in place.’
Consulting practice confirms research results: a lack of structures makes it difficult to manage crises quickly.
42 per cent of the companies surveyed in EMEA explicitly stated that they had no contingency plans at all for geopolitical risks (cf. North America: 31 per cent). According to their own statements, 40 and 39 per cent respectively are not at all prepared for cyber attacks (see North America: 33 per cent) and misconduct by executives (see North America: 29 per cent). On both sides of the Atlantic, more than a third (37 and 35 per cent respectively) of companies have no response to supply chain failures.
‘It is surprising that a significant proportion of the companies surveyed have not made any clear preparations for specific risks,’ says Stefan Heissner. ’On the other hand, it certainly confirms our impression from practice: we see too often that companies that have to react to a crisis struggle with long reaction times – because there are no clearly defined teams, processes or responsibilities in place. This not only makes it more difficult to get the crisis under control, but also to protect corporate assets.’
Companies in Europe and the EMEA region as a whole are less critical of themselves than their North American counterparts when it comes to risk management.
North American companies have not only developed concrete plans for more crisis scenarios. They are also much more critical of themselves when it comes to their own risk management. For example, 41 per cent of American companies say that unclear responsibilities in crisis management prevent them from being even better prepared for unexpected events – in EMEA, around one in four companies (26 per cent) recognises this problem.
A lack of a clear strategy with regard to risk tolerance is seen as an obstacle by 35 per cent of North American companies, while in EMEA only around a quarter of respondents recognise this. And while 28 per cent of companies in North America criticise a lack of risk culture in their own company, the figure here is only 23 per cent.
‘Companies in North America are more self-critical when it comes to their crisis prevention capabilities. It is therefore not surprising that they have more often developed specific contingency plans,’ says Stefan Heissner. ’Particularly for companies that are in a weaker financial position, one-time crisis events can cause significant damage. This can weaken them in the long term or even threaten their existence. It is therefore high time that European companies also intensified their risk management and developed specific contingency plans.’
About the study
The Economist Impact think tank conducted this research on behalf of FTI Consulting. This survey-based study examines the perspectives of key legal decision-makers regarding the nature of today’s crisis landscape, their preparedness for handling their company’s crises, and how their role in managing such events is evolving.
The survey was conducted in 2024. It included a total of 600 primarily legal decision-makers in North America (25 percent), EMEA (50 percent) and Asia-Pacific (25 percent). All respondents worked for companies with annual revenues of more than $1 billion.
The full report can be found at:
About FTI Consulting
FTI Consulting, Inc. is the world’s leading advisory firm for businesses in crisis and transformation. With more than 8,300 experts in 34 countries, FTI Consulting generated revenues of US$3.69 billion for the fiscal year ended Jan. 1, 2024. In certain countries, FTI Consulting’s services are provided by separate legal entities that are separately capitalised and independently managed. For more information, visit the company’s website at www.fticonsulting.com.
