MAP Insights

Summary

 

Resilience gives organizations a competitive edge. Boards must monitor, anticipate, and respond quickly. Stress testing, once the preserve of banks, is now essential for all large organizations. To turn this urgency into action, Boards can take immediate steps: (1) Request a stress testing overview from management to understand current capabilities and gaps; (2) Add stress testing results as a standing agenda item in risk or strategy meetings; and (3) Mandate the development of a scenario library tailored to the organization’s unique risks. These practical actions help ensure that stress testing becomes a Boardroom priority rather than just a technical exercise, ensuring the organization’s resilience.

 

Cybersecurity issues, the negative effects of AI, the Middle East wars and the closures of the Strait of Hormuz are driving organizations to perform stress testing and execute mitigation strategies. To understand why stress testing is now a Boardroom priority, it is important to review its origins in risk management and consider how its purpose has evolved over time.

 

The Origins: Crisis as Catalyst

 

Major crises such as the 1997 Asian Financial Crisis and the 2008 Global Financial Crisis exposed hidden risks and spurred the development of modern stress testing. Regulators in most countries require banks to demonstrate resilience in adverse scenarios, ensuring adequate capital and liquidity. This built discipline but focused only on static monetary results.

 

Most nonbank Boards ignored stress testing until new risks forced every industry to rethink priorities and methods. Most non-bank Boards ignored stress testing until new risks forced every industry to rethink priorities and methods.

 

The Shift: From Risk Measurement to Strategic Perspective

 

Stress testing now centers on risk management, not just compliance. New risks—cybersecurity, climate, geopolitical, and supply chain—rival financial ones, yet models often miss them. Analytics and judgment are crucial. In the energy sector, stress testing revealed that supplier disruption could affect regulatory compliance and customer trust. In technology firms, it uncovered vulnerabilities in cloud infrastructure, letting companies invest early in resilience. Such examples show stress testing uncovers risks traditional assessments might miss.

 

In addition, organizations are even more interconnected each year. Disruptions now spread quickly across all functions. Worse, historical data can’t predict current risks. Organizations must design tough, unprecedented scenarios. Leading firms use stress testing to set strategy, allocate capital, and manage operations—not just to measure risk.

 

What Good Looks Like Today

 

Advanced stress testing alone isn’t enough. High performers combine modeling with expert judgment to assess risks across reputation, regulatory, and operational dimensions. Firms now model for shocks such as cyberattacks that affect their own supply chain or currency shocks—reflecting how crises cascade in real life. Reverse stress testing asks, “What caused failures?”, to better understand the underlying factors, and to identify hidden assumptions and weaknesses, such as liquidity or access issues. Finally, better computing power enables wide-ranging simulations, such as stochastic methods, to produce more detailed results and a broader range of outcomes.

 

Stress testing extends beyond banks. Companies in consumer, energy, technology, and logistics make it part of their strategy. Corporate resilience demands that organizations understand what might lead to demise: loss of suppliers, lack of access to cash, significant uncollected receivables, unsustainable debt levels, or a combination of these and other adverse conditions. These organizations then use stress testing to answer the question: What if a critical supplier fails? How could a cyber incident hit operations or revenue? Can our balance sheet endure prolonged shocks? Where are hidden risk concentrations? Leading firms use stress test results to drive a Board’s investment, diversification, and risk appetite decisions. This results in a “playbook” the organization can already implement or execute when a “black swan” event happens.

 

The “Black Swan” Problem—and What to Do About It

 

Nassim Nicholas Taleb in his book “The Black Swan: The Impact of the Highly Improbable” popularized the term “black swan” event. Such events—rare and high impact—force a rethink of risk. Hindsight explains them, but experience can’t prevent them. Stress testing can’t predict nor account for all “black swan” events. Rather, it tests “severe but plausible” scenarios to improve preparedness, not prediction. Effective approaches include assuming extreme hypotheticals, including shocks and knock-on effects, convening cross-functional workshops, and continuously updating scenarios. Crises show organizations fail when they ignore risks, not because risks are unknowable.

 

Embedding Resilience into the Organization

 

Leaders must shape decisions with stress testing. They must drive this culture shift. Here are three starting points:

 

1. Integrate into Strategy and Planning – Boards and executive management must make stress testing an embedded part of strategy reviews, capital decisions, and investments. Use it to check assumptions.

 

2. Align to Risk Appetite — Boards must define their risk appetite and apply stress-test results accordingly, supporting transparency and accountability.

 

3. Establish Resilience Metrics – Boards must track more than finances and instead focus on a few critical metrics that reflect resilience. For most, liquidity (ability to meet obligations during a crisis) and recovery time (speed of restoring operations after disruption) are vital. For example, companies that rely on partners, such as manufacturers or logistics providers, supplier diversity matters. Companies in technology or data-driven fields might focus on cybersecurity readines. By homing in on these key, industry-relevant metrics, Boards can keep oversight sharply focused.

 

Organizations should not limit stress testing to risk or finance teams, but rather involve operations, IT, strategy, and communications. Then base crisis plans on stress test results. This ensures decisive action, not improvisation under pressure. Organizations that embed these practices recover more quickly, experience less disruption, and build greater partner trust.

 

The Role of the Board

 

For Boards, stress testing is a governance essential, not just a technical task. Effective engagement starts with clear ownership: Risk Committees or other Board subcommittees are usually charged with oversight. Boards should make stress testing a regular agenda item to review scenarios, results, and action plans. Embedding stress testing in agendas and charters clarifies responsibilities, drives accountability, and makes resilience a core focus.

 

Key questions Boards should ask include:

 

• Are we testing the right scenarios, including those that challenge our core assumptions?
• Do we understand the organization’s breaking points—and how close we are to them?
• Are stress test results influencing strategic decisions, or are they treated as compliance outputs?
• Do we have sufficient visibility of non-financial risks?
• Is resilience embedded in our culture, or concentrated in a single function?
• What mitigation strategies are in place, and is there a ready playbook for a crisis?

 

Boards that ask these questions steer organizations through uncertainty.

 

From Defense to Advantage

 

The real shift: stress testing now drives success, not just failure avoidance. Robust stress testing leads to better strategy, capital allocation, speed, and trust. Resilience now differentiates organizations; it’s not just a cost.

 

Conclusion

 

Stress testing, which grew out of crises and subsequent bank regulation, became a strategic imperative for large firms. Boards must prepare for crises in advance. To strengthen stress testing, organizations must ensure access to financial, risk, and technology experts. External advisors or consultants with industry knowledge can reveal blind spots. And adding members skilled in crisis management or operational resilience enhances readiness to address evolving threats. Stress testing ensures readiness, not prediction, for the future.

 

When is the best time to build organizational resilience? The best time was a decade ago. The second-best time is now.

 

(The author is Governor and Secretary of the Management Association of the Philippines or MAP.  He is a retired banker and Globe and Ayala executive, and a member of the Analytics and AI Association of the Philippines and the Institute of Corporate Directors. He is an Independent Director at GT Capital Holdings, Puregold Price Club and Megawide Construction. Feedback at <map@map.org.ph> and <iamgilgenio@gmail.com>).