A confluence of events, trends and changing conditions are prompting organizations to pay closer attention to their resilience. The pandemic, climate-related catastrophes, supply-chain issues, acute skilled labor shortages, rising inflation, cybercrime, the war in Ukraine, and the realignment of global trade away from unfriendly countries are among the many factors driving the need for greater organizational resilience. Other factors include disruptive technologies such as artificial intelligence, advanced robotics, augmented reality, 3D printing, renewable energies, etc.

Resilience has always been part of risk management. However, it is not very well understood and often confused with traditional fields such as business continuity, emergency preparedness, disaster recovery and crisis management. Resilience does not exclude or replace these fields, but it is much broader in scope. It is a holistic concept that helps organizations make it through adversity and come out on top. In a complex and volatile world, resilience is much more than a defense mechanism. It is a competitive advantage that helps organizations survive and thrive.

Definitions of Resilience

The International Standards Organization (ISO) defines organizational resilience as “the ability of an organization to absorb and adapt in a changing environment to enable it to deliver its objectives and to survive and prosper.” According to ISO, “more resilient organizations can anticipate and respond to threats and opportunities, arising from sudden or gradual changes in their internal and external context.” ISO further states that “enhancing resilience can be a strategic organizational goal, and is the outcome of good business practice and effectively managing risk.” ¹

Deloitte, a globally integrated professional services firm describes organizational resilience as follows: “the capability of an organization to be prepared for disruption and to adapt and thrive in a changing environment. It isn’t purely defensive in orientation. It is also progressive, building the capacity for agility, adaptation, learning, and regeneration to ensure that organizations are able to deal with more complex and severe events, and be fit for the future.” ²

McKinsey, a global management consulting firm, describes organizational resilience as “the ability to not only recover quickly from a crisis but to bounce back better – and even thrive. (…) In business, resilience means dealing with adversity and shocks, and continuously adapting for growth. Truly resilient organizations don’t just bounce back better; they actually thrive in hostile environments.” ³

In short, resilient organizations are robust, agile and innovative. They absorb shocks, adapt to disruptive trends and changing conditions, and innovate to take advantage of new opportunities.

Survey Findings

A global survey of approximately 700 senior executives conducted by Deloitte in 2022 indicates that most organizations need to expand their focus from operational resilience, to other important areas associated with financial, human resources, reputation and environmental concerns. Based on the survey results, only 31 percent of organizations have a strategic approach for resilience, and less than 50 percent integrate resilience across multiple functions. Figure 1 outlines the perceived levels of capability related to organizational resilience based on the status and scope of activities reported by the non-risk management executives surveyed by Deloitte.⁴

Another survey of approximately 200 senior executives conducted in 2022 by McKinsey reflects similar findings. In this survey, only 60% of respondents report having very good or excellent organizational resilience capabilities, “meaning that they are well equipped to build and manage resilience overall.” ⁵ The remaining 40% only have limited or basic capabilities. The McKinsey survey indicates a strong desire for managing resilience strategically and holistically:⁶

• Strategic progress – Nearly two-thirds of respondents mention that resilience is central to their organization’s strategic progress (either as “a top priority or to an important extent”), and that the four most important areas of focus are digital, technology, finance, and operations.

• Foresight capabilities – Foresight capabilities (defined as scenario planning and stress testing) is a “core area” cited for improvement. Only half of the organizations surveyed conduct scenario planning and stress-testing exercises on a regular basis when making strategic decisions.

• Stronger resilience – Seventy-five percent of the risk management professionals responding to the survey believe that improving risk culture and integrating resilience into the strategy process are the two most important actions that will strengthen organizational resilience.

Resilience Models

Deloitte considers that resilience needs to be developed across five domains “that comprise the ecosystem in which organizations operate.” These domains encompass human, operational, financial, social and natural considerations. Table 1 provides a summary of each domain, also referred to as “capitals of resilience.” ⁷ According to the Deloitte, “a deficiency in any single one of these capitals can put the organization in jeopardy and even bring it down. Organizational resilience therefore consists of robust capabilities in each of these five domains. While the emphasis on a given capital will differ across industries and companies, superior capabilities in one domain will not make up for deficiencies in another. Therefore, each organization needs an individualized way of addressing and balancing investments in each domain.” ⁸

Interestingly, McKinsey proposes a similar resilience model of six domains that incorporate the above. The main differences with the McKinsey model are that it separates operational resilience in three distinct components (business model, operations, technologies), and considers environmental resilience as part of reputational resilience. McKinsey also emphasizes that a holistic approach is required for overall resilience to be effective and develop into a competitive advantage.⁹

Resilience Management Framework

There is currently no definitive management framework that supports building organizational resilience in relation to the domains identified by Deloitte and McKinsey. Developing such a framework would require a considerable amount of research. Figure 2 outlines an approach commonly used for strategic planning and stress testing.

Organizational resilience should be stress tested and updated as external and internal conditions change. Stress testing is much easier to do for the operational and financial domains than it is for the people, reputation and environmental domains. The key is to develop meaningful indicators and simulate the effects of potential stressors. The simulations do not necessarily have to rely on complex models. If the risk exposures are well understood, the effects of possible stressors should be relatively easy to estimate. Resilience needs to be assessed from a risk perspective.

Choices to Make

Despite the current context, few organizations have a strategic approach to resilience.¹⁰ Many factors explain this unfortunate state of affairs per McKinsey. Building resilience involves making investments that typically do not provide immediate benefits and value creation. Such investments can be a tough sell to business leaders focused on short term results. Organizational forgetfulness is another factor. Major disruptive events may not occur frequently enough to prevent resilience priorities from being downplayed over time. There is also no clear-cut approach or methodology for measuring resilience and quantifying its value objectively. Accordingly, it may be difficult to justify a business case for improving resilience if scarce resources are needed elsewhere.

Building resilience is a strategic choice. The current global context suggests that it is a wise choice. Doubters and sceptics may want to consult the latest global risk assessment conducted by the World Economic Forum (WEF) to better understand the imperative for building organizational resilience.

Examine or download the World Economic Forum Global Risks Report 2023 using this link:

https://www.weforum.org/reports/global-risks-report-2023/

__________________________

¹ International Standards Organization (ISO), Security and Resilience (22316:2017).
² Nathan Spitse, et al., Toward True Organizational Resilience, (Deloitte Global Resilience Report, October 2022), p.7.
³ McKinsey & Company, What is resilience? (January 17, 2023).
⁴ Nathan Spitse, et al., Toward True Organizational Resilience, (Deloitte Global Resilience Report, October 2022), p.18.
⁵ Alfonso Natale, et al., From Risk Management to Strategic Resilience, (McKinsey, 2022), pp.2-3.
⁶ McKinsey & Company, What is resilience? (January 17, 2023).
⁷ Nathan Spitse, et al., Toward True Organizational Resilience, (Deloitte Global Resilience Report, October 2022), pp.10-11
⁸ Nathan Spitse, et al., Toward True Organizational Resilience, (Deloitte Global Resilience Report, October 2022), p.11.
⁹ Alfonso Natale, et al., From Risk Management to Strategic Resilience, (McKinsey, 2022), p.5.
¹⁰ Alfonso Natale, et al., From Risk Management to Strategic Resilience, (McKinsey, 2022), p.6.