Purposeful resilience

Any organisation that has been around for a long time, no matter how large or small, has demonstrated resilience and adaptability to change. Never more so than during the COVID-crisis. They will have coped through tough times, which will have included making tough decisions during major disruption and during one or more crisis events. They will also have maintained (and strengthened) their state of resilience during the good times.

There are many great examples of businesses which have demonstrated people-focused and societal purpose through the COVID-crisis, taking actions that have contributed towards sustainable goals. These actions are being led by people who are innovating and finding solutions to urgent problems.

For example, pharmaceutical and medical businesses have donated PPE and switched their focus to collaboration to develop a vaccine for the novel coronavirus responsible for COVID-19.

Various types of manufacturers, large and small, have retooled production lines to make ventilators; clothing retailers have switched to making healthcare PPE; breweries have adapted production processes to make hand sanitiser.

The supply chains of supermarket retailers around the world are demonstrating admirable resilience, and many hospitality businesses have showed extraordinary robustness at a time of enormous pressure.

Other examples of purposeful resilience can be seen in how businesses are addressing climate change and broader sustainability matters, natural disasters, cyber attacks, terrorism, operational breakdowns and disruption to trade or supply chains.

Organisations that demonstrate a culture and a good state of purposeful resilience have people who are adept at looking ahead, planning, anticipating, adapting, and responding effectively to events and change. These people are ready for, and often anticipate or see changes and events occurring on their horizon.

The ISO standard, ISO 22300:2018, defines resilience as the ability to absorb and adapt in a changing environment. Note that it does not specifically focus on a negative changing environment – though this is clearly a major focus area for resilience. 

No pressure!

Many actions and steps taken now by people who make decisions in businesses will have implications for their organisation and across their value chains for quite some time. COVID-19 is raising many questions, and some shifts in thinking on ways to maximise resilience (for example, with supply chains).

Although negative events and situations are clearly a major focus area, resilience also means responding to change in general. This includes ongoing shifts such as advances in new technology and digitisation, data analytics, sustainability risk, complexity in our business environments and the need to ensure the ecosystems and value chains that we exist in work well and can respond to change and withstand shocks.

‘Purposeful resilience’ starts with having a people-focused approach, empowering us to achieve sustainable outcomes and to innovate. It starts with showing trust in people, allowing them to adapt and imagine possibilities in a manner that fits with the organisation’s context and their values.

Sometimes innovation is a result of what may be termed “creative desperation”, when things urgently need to be addressed. At other times, it is a result of having a continuous improvement mindset.

It is not easy to maintain an effective balance of agility and control, but it is important. A starting point for understanding your true state of organisational resilience is to look at your structure, your commitment to people and their wellbeing, and to achieving sustainable and purposeful goals. Do you place people and sustainability at the heart of having a good state of organisational resilience?

Looking outside your own organisation, do the relationships you have with customers and suppliers in your value chain also demonstrate this approach? Potential vulnerabilities (which can appear and change quickly) need to be identified and addressed.

A practical framework

Tools and techniques that we use for risk management, and general business strategy and management, can help us understand our state of resilience and ensure it is purposeful and appropriate.

It is worth having a practical framework for purposeful resilience, scaled to suit the size of your organisation and its context. ISO 22301 (Security and resilience – Business continuity management systems – Requirements) and the accompanying standards offer guidance for resilience and business continuity, and they link to other standards such as ISO/IEC 27001 and ISO 31000. A few examples of tools and techniques are listed below:

1. Scenario analysis

Scenario analysis is a useful technique to help with resilience reviews. It adds most value when it is carried out regularly for a constant exploration of ideas, not as a one-off or occasional exercise. By regularly considering a range of scenarios that could put our resilience under pressure, we can ask ourselves how resilient we are to change and stress test our ability to respond to major changes or events. Scenario analysis is most effective when we think broadly about plausible possibilities and apply them to our context.

2. Horizon scanning

Horizon scanning has a natural link to scenario analysis. It includes looking at “weak signals” that are not immediately obvious, of possible changes and events “on the horizon”.

3. Stakeholder analysis

Analysing and mapping the stakeholders in your ecosystem, and understanding the resilience that exists in this map, can show you areas of strength and weakness. You can gain an understanding of which stakeholders really are critical.

3. ‘What if?’ decision trees

This involves plotting different paths of how events could take shape and impact your ability to respond based upon different decisions.

4. Business impact analysis

ISO 22300 describes business impact analysis (BIA) as the process of analysing activities and the effect that a business disruption can have upon them. It is about understanding your activities, what’s critical to them, and what kind of workarounds are sensible if they are disrupted in different ways. BIAs are usually used to inform a business continuity strategy.

5. Business continuity plans

ISO 22300 describes a Business Continuity Plan (BCP) as documented procedures that guide an organisation to respond, recover, resume and restore itself to a pre-defined level of operation following a disruption. A BCP must be practical, not theoretical. It should be informed by a good risk assessment and high-quality BIA. It should represent your focus on people and sustainability. How people work together to respond to disruption and maintain resilience is key. You don’t want things to fall through gaps between teams.

An important point about using any tool or technique is to always ensure that it is used in context to contribute towards your resilience strategy, and to help towards your overall business objectives.

Risk managers can be the glue

Activities towards achieving a good state of purposeful resilience should not be standalone measures that are carried out or maintained by just one function or team. They must be embedded into the regular activities of people across the organisation, and its partners.

Working towards a purposeful state of resilience therefore requires an integrated effort, with an agile and collaborative structure. Perhaps one team in an organisation can act as a central resilience function to coordinate and bind other departments together, to be the glue to coordinate practical actions that make a difference and improve the business’ resilience to future shocks. Maybe in your organisation this could be the risk team?

Gareth Byatt is an independent risk consultant and owner of Risk Insight Consulting.