Congratulations, you have worked hard to reach your current position as a senior executive, so it is only fitting that you have been handed accountability for one of the most important capabilities for the future of your organization – to build and maintain resiliency across the entire enterprise.
Resiliency, or resilience as it is more commonly referred to in Australia and Europe, is a subject that is increasingly discussed and explored in the boardroom. Professor Rosabeth Moss Kanter of Harvard Business School wrote a review of lessons to be learned from events in the year 2010. Her essay listed the No. 1 lesson of the year as, “Surprises are the new normal. Resilience is the new skill.”
Perhaps you thought resiliency was a subject for just the CIO or IT Department to address, or was it a problem that was simply addressed by purchasing some new software or installing new hardware? There are many who will try to sell you on that idea, but hopefully I can show you a range of management-thought leaders – like Professor Kanter – who will highlight that true enterprise resiliency can only be achieved via top executive commitment and active leadership.
The first idea we should embrace is that resilience demands innovative approaches and solutions. It’s important to note Kanter’s No. 2 lesson to learn from 2010: “Innovation takes courage and the willingness to be out in front rather than following the herd.” Everybody wants to be resilient, but most don’t want to be the first or want to approach it differently!
In part the reluctance to stand out from the herd is because true enterprise-level resiliency is very hard to measure. Most executives are resorting to systems, process, and compliance as a substitute.
You actually won’t know if you have succeeded in your quest to become resilient until you are confronted with a disruptive event. Even then, if the event does not disrupt your organization, then many may fail to recognize the level of maturity you have achieved. On the other hand, you will very quickly know if you failed to achieve resiliency.
The demand for resiliency is a function of the growing complexity of our organizations and the environments they operate in, coupled with increasing uncertainty. Significant and unexpected events are occurring with greater frequency. In response to these stimuli, more process is not a solution. We have seen that unfold with our approaches to risk management. Expanding the approach of risk management into the discipline of enterprise risk management did not create resiliency. We simply moved the process beyond the narrow confines of a single functional silo and established a form of enterprise risk coordination.
True resiliency requires the capability to adapt. It is adaptive management that enables us to respond to “Black Swan” events and to a range of new, unanticipated, hybrid risks that emerge as a result of complex interactions.
To help you meet this challenge, and to understand the true executive nature of enterprise resiliency, I offer you the following advice and guidance. These are things I have discovered on my resilience journey and I may help to guide other executives on the quest.
R-e-s-i-l-i-e-n-c-y, find out what it means to me
The first step is to understand what we mean when we talk about resiliency. In this area you will be spoiled for choice. There are so many different meanings and definitions of resilience from which you can choose. Unfortunately, many of these definitions contradict one another. This is not surprising when you come to understand that the concept is used differently in areas as diverse as psychology, engineering, and environmental science.
I have found the best option is not to try and generate a dictionary-style definition of resilience. Instead, I encourage you to think about and complete these two statements for your organization and its operating environment.
- Resiliency of ...
- Resilient to ...
These questions are intended to get you thinking. They are suggested by a research group in New Zealand that spans academia and industry and have been researching resiliency as it applies to organizations for almost 10 years. Like most executives, neither of us has the time to read numerous articles and books, so be practical and leverage what other people have already discovered!
You will find the true meaning of enterprise resiliency when you seek to define it in the context of your enterprise, your industry, and your position in that industry. As such it can only be defined by top executives, reflecting their strategic intent and direction for the organization.
All good executives will regularly review and adjust your strategy in response to changes in markets and the operating environment. Similarly what it means for your enterprise to be resilient will need to reflect these changes.
True enterprise resiliency is a journey, not a destination.
Gary Hamel, one of the world’s leading experts on business strategy, wrote a Harvard Business Review article in 2003 that described this journey as “the quest for resilience.” This was one of the earliest attempts to describe what it means for an enterprise to be resilient. Hamel highlighted the significant role that strategic resilience plays in making an enterprise truly resilient.
What you will find is that many of the operational areas within your organization (such as IT, business continuity management, risk management, security, and compliance areas) will promote initiatives that they label as resiliency. These areas will all contribute in their own way to achieving a level of operational resilience. This is important but is not the complete picture.
Enterprise resilience is more than just addressing operational aspects. When done correctly it will span both the strategic and operational levels, address all functional areas of the enterprise, and extend to cover all the significant components of your enterprise’s value chain.
Resiliency needs top down leadership
Because true enterprise resilience starts with strategy and the long-term commitment to the journey, it can only be achieved with strong, top-down leadership. In fact resiliency is something that chief executives seem to understand and want to develop, not very surprising considering the current assignment you’ve been given.
Last year, a researcher in Australia named Robert Kay interviewed 50 CEOs to get their views on resilience. The research supported the need to define resiliency within your own context and the view that resilient operations is merely the first step, not the complete picture. What the research highlighted is that culture is a critical enabler of resiliency, and such CEOs tended to look to the HR department to play a leading role.
We often see the impact of culture only when organizations fail, rather than recognizing the effect when they are resilient and survive. The official report on the recent Fukushima disaster also highlights the role that culture plays in promoting or undermining resiliency. Top leadership plays a central role in establishing and promoting a “resiliency culture.”
The importance of culture and leadership is also highlighted in the book “The Resilient Enterprise” by Dr Yossi Sheffi, professor of engineering systems at the Massachusetts Institute of Technology. In particular, his opening story is about a small-scale incident in New Mexico and its long-term impact on the Scandinavian companies Nokia and Erikson. I am sure we all remember when Erikson was actually in the business of making cell phones!
I refer to the need to consider resiliency as a “four-way street,” which covers many of the aspects Sheffi and the others suggest. From the top down is the first step, essential for reflecting strategy and establishing culture. But Sheffi and others show that we need to address our end-to-end value chain, both as the customer perceives it (from the outside in) and as we understand the linkages and to confirm we have the alignment correct (from the inside out). Sheffi in particular highlighted the need for alternate suppliers and flexibility in our supply chain.
Finally there is a need for a range of “bottom up” contingency planning initiatives. This is where much of your traditional risk and business continuity planning will occur. This aspect of developing resiliency should not be overlooked. Sheffi also highlights the need for this work which will address redundancy in your critical infrastructure, layered defences, and the importance of tracking and learning from near-misses.
As the executive accountable for enterprise resiliency, your ongoing challenge is to ensure these four streams remain aligned and connected.
Take Action
Lisa Valikangas, a professor of innovation management who co-wrote the “quest for resilience” article with Hamel, exhorts us to remember that “resilience is not a strategy; it is a rehearsal. In fact, it is a constant practice.”
Enough thinking and reflecting. Perhaps – like many managers and executives – you have adopted David Allen’s “Getting Things Done” technique. We now need to identify the next action here!
Here are some actions I encourage you to take (in the order listed):
Source the Hamel/Valikangas article and the Robert Kay research paper. Both are freely available on the Internet.
Read both papers as well as anything you find interesting in their references.
- We need to act on this, so limit the reading at this point.
- Compile your future reading list for when you have time and need to explore additional dimensions of resilience, a couple of items to seed this list.
- Read the last chapter of Valikangas’ book, “Conclusion: Bridging the Resilience Gap.”
- Read this benchmarking study for New Zealand, which discusses promoting some attributes and measurement for resiliency.
Compose a description of resilience in your context. Consider the two thought-starter questions I posed earlier.
- This could include examples of resiliency behavior you see in your organization today.
Undertake one or more of the types of executive simulation exercises described in the Kay research paper.
- This needs to engage the top level of the organization and anybody else they need to trust and rely on in a significant event.
- You will be well advised to use external specialists for this, at least in the early days. You don’t want this to bomb with your peers at the outset.
- Be ready to deal with those who think this is the same activity as an emergency, BC, or crisis plan rehearsal, which it is not. The idea is to go beyond what you have planned.
Make sure the debrief and learning from the simulation exercise are comprehensive.
- Lay out areas of improvement that were identified.
- You will need to champion adequate funding and resources to ensure these improvements are implemented.
Don’t waste a lot of time at this point developing elaborate metrics to measure resilience as an end goal. Instead focus on measuring changes and that things are generally heading in the right direction.
- Remember it is the journey, the movement, you are measuring and not the distance to the destination.
Finally, you will be doing some experimenting. Make sure you have created an environment in which it is safe for people and their experiments to fail.
- There is no one-size-fits-all approach to true resiliency, so a degree of experimentation is essential.
- Allowing “safe-to-fail” contributes to the type of culture that promotes overall resiliency.
Conclusion
As an experienced manager you may have recognized this advice as a dynamic form of gap analysis: an approach that all executives will be familiar with and can apply to this new field of endeavour.
You need to determine your desired future state by defining what resiliency looks like in your context – not a generic or dictionary definition, but what it means to your organization and its people.
You need to assess your as-is state against reality: what people will actually do, rather than what a document says they will do. The Kay research highlighted that “trust” was the most essential attribute, and these simulation exercises help to build that trust.
Finally, you need to close the “resilience gap,” which Valikangas describes as the gap between “today’s organizational capabilities and tomorrow’s need for resilience.” We will never know exactly what the future need for resilience might be. As a result to bridge this gap you will most likely have to blend proven technology solutions with new and innovative approaches, hence the importance of safe-to-fail experiments.
Good luck with your new assignment. I look forward to hearing how you go.
Ken Simpson is an independent management consultant based in Australia who has worked in and around the field of business continuity for more than 20 years. His multiple careers have spanned public and private sectors, IT (where he held roles as a CIO and CTO), leading internal BCM functions, hands-on experience recovering from a major disaster, and 15 years working in his own boutique consulting firm where he has gained extensive international experience delivering executive-level risk, continuity, and crisis management engagements. Simpson holds a master’s of business administration, is a member of Business Continuity Institute, and a Certified Organizational Resilience Professional (ICOR).
Links:
- http://blogs.hbr.org/kanter/2011/01/five-lessons-from-2010-worth-r.html
- http://www.resorgs.org.nz
- http://hbr.org/product/quest-for-resilience/an/R0309C-PDF-ENG
- http://www.tisn.gov.au/Documents/Research%20paper%201%20-%20CEO%20perspectives%20on%20organisational%20resilience.pdf
- http://www.nirs.org/fukushima/naiic_report.pdf
- http://www.blog.vrg.net.au/informed/resilience-thinking/case-study-of-resilience-adaptation-and-culture-in-the-real-world/
- http://ir.canterbury.ac.nz/bitstream/10092/4275/1/12626182_Benchmark%20Resilience-ResOrgs%20ResearchReportbAuckland.pdf
