Ashish Deshpande FBCS is an independent consultant specialising in business systems that optimise operations in the global oil and gas industry. Here he takes a look at the importance of building resilience for today’s businesses.
There has been a steady stream of threats and disruptions this century — not all bad, but seemingly occurring ever more frequently: financial crises; the 9/11 attacks; the ubiquity of broadband internet and the rapid adoption of smart phones; the rise of ecommerce and social media; the global reach and dominance of a handful of tech giants; wars around the globe; refugee crises; climate change and global warming; block chain and crypto currency; the pandemic; supply chain disruptions; the rise of remote work and cybersecurity threats; and the most recent addition to this list - Artificial Intelligence (AI) and ChatGPT.
In each of these cases there is no going back. Depending on the nature and severity of the disruption, the specifics of your business and the preparedness and response of your organisation, you could have a minor emergency, a crisis or even a disaster on your hands. In some of the more extreme scenarios listed above, resilience could mean the difference between an organisation that survives in reasonably good shape, and one that is severely damaged or even completely overcome by the disruption. A natural consequence of this is that survivors are now more likely to thrive as they have fewer competitors than before, making resilience a potential source of competitive advantage (at least for a while, until new competitors emerge).
Damage limitation
Classic risk mitigation practices are still necessary as they help to limit damage, but they cannot help the organisation thrive in the new, altered environment. Two well established practices illustrate this point: Disaster Recovery Planning (DRP) and Business Continuity Planning (BCP). DRP is designed to achieve a certain recovery time for IT systems and to limit data loss, but it cannot help the business react to certain shocks, such as to the business model of the company. BCP is broader in scope in that it includes processes and people, but its primary function of returning the business or certain processes within the business to normal operations is also rearward looking in its intent. Both are a form of insurance focused on compensating for a temporary event, and spending on DRP and BCP are thus seen as a necessary cost rather than an investment in the future.
In contrast, resilience demands a different way of imagining possible future scenarios and the capabilities that could create a more resilient organisation. If DRP and BCP seek to prepare for known unknowns, resilience must build capacity to handle unknown unknowns. These capabilities do not come without cost and effort, but the potential for future payoff is much larger, and they can help current operations run better.
A structured approach
This raises questions. How resilient is your organisation today? What are the gaps that need to be addressed? Unfortunately, there is no standard checklist one can easily refer to, as the nature of future unknowns can vary greatly from one organisation to the next, as can the attributes that support resilience.
It therefore becomes necessary to begin designing your company’s approach to resilience top-down, with the executive management taking the lead. First and foremost, it is essential to make a commitment to survival and the readiness to adapt, and to make resilience part of the everyday fabric and operation of the business.
Next would come a series of scenario building and what-if exercises, specifically to identify the longer-term effects of conditions which are not transient, but rather persist or escalate in a certain direction. This is distinct from the thinking behind DRP or BCP, both of which envisage a temporary disruption, after which conditions revert to the status quo.
For you
Be part of something bigger, join BCS, The Chartered Institute for IT.
Next would come a series of scenario building and what-if exercises, specifically to identify the longer-term effects of conditions which are not transient, but rather persist or escalate in a certain direction. This is distinct from the thinking behind DRP or BCP, both of which envisage a temporary disruption, after which conditions revert to the status quo.
Then, consideration should turn to how to prepare for each scenario in a manner that strengthens the organisation today while simultaneously priming it to be successful in the future. As these scenarios are discussed and clarified, there will be some clustering of the various actions needed, and a few dominant resilience themes will emerge. Examples include: diversifying the supplier or customer base or product range; systematically phasing out legacy technologies and starting to implement newer ones; seeking to diversify employee profiles and their skill sets.
Once these themes are identified, appropriate resilience metrics can be defined and tracked, and therefore improved. Distinct from typical financial or operational metrics particular to your industry, these metrics would be custom tailored to your organisation’s unique values, ambitions, risks, and opportunities. A system of periodic review of resilience metrics would be implemented, and the big themes themselves would need to be revisited regularly as time passed and the business environment changed.
Challenges and doubts
Given that the various themes identified are likely to be broad in scope, they will need the involvement of large numbers of people — both within your organisation and outside — and clear communication at all levels will be essential. This is easier said than done, and any slippage on this front should be carefully monitored and expeditiously addressed.
To see improvements as the organisation builds resilience, it will be essential to have an empowered workforce regularly sharing knowledge and information across the different functions and units of the company. This goes to the heart of the culture of the business, and those that have been functioning in a hierarchical or siloed way will find it difficult to make progress. Whether things are working well or not, the reality of the situation should be reflected in the resilience metrics decided earlier.
It is in the early stages that the top leadership will have to be most alert, where the resilience effort itself seems like a disruption and internal disagreements and lack of co-ordination can quickly render it ineffectual or even sink it. To avert these dire scenarios, it will be important for the organisation to consciously identify and distribute employees who are committed to the resilience effort and are drivers of positive change.
Another element which can make the resilience journey particularly challenging is legacy processes and the systems that support them. Here it is critical that an architectural road map is established and used to guide decisions and transitions over an extended time frame, during which many individuals might move on, and others take their place.
Allocating resources could be contentious, especially in the early days when the costs are immediate and front of mind, but the benefits are a long way away and harder to feel confident about. Here again, top management needs to step in and provide the necessary support and encouragement, taking care to bring along employees who are perhaps less convinced or do not feel the urgency in what is being requested of them, but are nonetheless loyal to the business and believe they are doing the right thing.
External factors could also pose challenges; these could be supply-chain related, developments in the competitive landscape, regulatory, geopolitical, or macroeconomic. In each case the specifics would need examination and suitable action would have to be taken.
Conclusion
Today’s world is complex and uncertainties abound, many of which will result in dire consequences for the unprepared. Building resilience is therefore no longer an optional topic or something which can take care of itself. Rather, it needs to become part of every organisation’s conscious culture, incorporated into the mindset of every individual within the business.
Leadership will have to come from the very top, and feedback loops must be nurtured so there is good visibility of what is working well, what needs tweaking, who needs help, and how much progress has been made.
Resources, talent, and training will have to be made available, and building and maintaining a resilient organisation will have to be seen as an ongoing activity and way of working, rather than a one-time project.
