1

Organisational Resilience

MARCH 2012

2

ThispaperrespondstoaneedexpressedbymembersoftheBCIPartnershipforclarityonwhatOrganisationalResilienceis,whatisrequiredtoachieveresilienceinorganisationsandwhatdisciplinescontribute,andhowtheycontributetoacoherentandoptimisedapproachtodealingwithissuesofOrganisationalResilience.

Itaimswereto:

Provideaworkingdefinitionoforganisationalresilience Identify the existing independent disciplines that contribute to achieving

organisationalresilience

Discussthepotentialutilityofmappingtherelationshipsbetweenthesedisciplinestoresiliencewhymapresilience?

Presentvariouspossiblemethodstomapresiliencehowtomapresilience? Proposefuturestepsforthedevelopmentandutilityofanorganisationalresilience

model

ThepaperistheoutputofaBCImembershipsubgroupcoordinatedbytheBCIPartnership.It does not set out to provide a comprehensive one size fits all approach ormodel oforganisational resilience, nor does it represent the views of the BCI or any otherorganisation. It is intended to be used as a platform for stimulating debate among BCIpractitionersaboutorganisationalresiliencetoprogressunderstandinganddevelopmentatapracticallevel.

AuthorsandEditors:

DominicCockram,DrClaudiaVanDenHeuvel

Contributors:

SteveWicks,KenSimpson,CharleyNewnham,RayFerrara,LyndaMcMullen,RogerKember,MikeLees,DavidLloyd,RobertHall,KenWratten,JackieWoodland,JohnMatthews,EugeneTaylor,PhilIrwin,DrRobertMacfarlane,JeffLewis

To comment directly on this paper, please contact Dominic Cockram, Chair of the BCIPartnershipSubgroup:dc@steelhenge.co.uk

3

APPROACH Theapproachtakenhasbeentobuildthepaperinclearstages:

1) Establishanunderstandingoftheresiliencelandscapeandadefinitionofresilience

2) Use the landscape and definition to set out the key requirements of a resilientorganisation

3) Provide an assessment of the capabilities needed to deliver the resilientrequirements

4) Establishwhatdisciplineswillprovideorsupportthosekeycapabilities

5) Developa seriesofdiagramsormodels thathelp to show the interactionsof thedisciplinesandpromotediscussion

This approach was derived after several initial stages and was established as the mostlogicalwayinwhichtodevelopthepaper.

WHAT IS ORGANISATIONAL RESILIENCE? Resilienceisanabstracttermthatisusedsubstantiallyacrossarangeofdisciplines,suchaspsychology,sociology,economics,ecology,engineeringandnetworktheory,tonamebutafew. What constitutes resilience is a topic of considerable debate, and meanings differdependingonthenatureofthedisciplineorcontextinwhichtheyarebeingused.Initsmostgeneralhumancontext,resilienceisdefinedastheabilitytorecoverfromoradjusteasilytomisfortuneorchange.1 Definitionsstemmingfromasystemsthinkingapproachexpandonthisand includetheabilitytoanticipate,respondandadaptto,and/orrapidlyrecoverfrom a disruptive event.2 Tensions remain across the various disciplines that defineresilience,wheresome focusentirelyonanentitysability toabsorbandadapt to impact,and others include the ability to anticipate and mitigate damage. However, in its mostgenerallyacceptedform,thetermresiliencereferstothewayinwhichanyentityorsystemachievesanendstateofkeepinggoing.

Whiledefinitionsfromthesesectorsareusefulforaidinganunderstandingofwhatismeantbyresilienceingeneral,thispaperisconcernedwiththemeaningoftheterminthecontextofanorganisation.Thetermorganisationhereisproposedtoincludeanentitywithineitherthe private or public sector, for profit and nonprofit, and of any given size. This paperfocusesonwhatanorganisation requires todemonstrate resilience,anddoesnotdiscuss

1Webstersdictionary2Tierney,K.J.(2005).Response,Recovery,andResilience.PanelPresentationattheUnitedNationsWorldConferenceonDisasterReduction,Kobe,Japan,January21.

4

theconceptsofsocietalorcommunityresiliencewhichhavebeencomprehensivelycoveredinotherrecentBCIpapers3.

Perhapsmost informative to constructing a definition of organisational resilience are thedefinitions stemming from the field of Resilience Engineering. This field takes on aproactiveapproachthatisaimedprimarilyatunderstandinganorganisationsabilitytocopewith complexity under pressure in order to obtain success.Additionally, it adopts both aprocessfocused and systems thinking approach todefinehowpeople learn and adapt tocreatesafetyamidstadversityandstrain,orwithina faultyenvironment.Resilience in thisfieldisdefinedastheintrinsicabilityofanorganisation(orsystem)tomaintainorregainadynamicallystablestate,whichallowsittocontinueoperationafteramajormishapand/orthepresenceofacontinuousstress.4Morespecifically,thefieldcoinsthetermOperationalResiliencetodescribewhatresiliencemeansforanentireorganisationafteracrisisornonstrategic disruption; this is defined as the processes and related practices bywhich anorganisation designs, develops, implements, and controls strategies for protecting andsustaininghighvalueservices,relatedbusinessprocesses,andassociatedassets.5

Whileeveryorganisationisuniqueinthepathwayittakestoachievethedesiredendstateofbeingresilient,thispaperpositsthatorganisationalresiliencerequiresbothapreventativecapacityaswellasanadaptivecapacityinresponsetotheoccurrenceofdisruptions.

Thispaperthereforedefinesorganisationalresilienceas

the capacity ofanorganisation toplan forandadapt to change ordisruption, throughanticipation,protection,responsivecapacityandrecoverability.

KEY REQUIREMENTS OF RESILIENT ORGANISATIONS Previous studies have identified many organisational mechanisms and characteristicsembedded in everyday practices that contribute to an organisations resilience. Theseinclude organisational cultures that are flexible, just and promote learning, and thecorrespondingbehaviouralmanifestationsoftheseculturesdisplayedbystaffmembersatalloperationallevelsduringbusinessasusual.

Specifically, behaviours that have been identified as being displayed by resilientorganisationsincludemonitoring,detectingandreactingtoissuesthatcouldhaveanimpacton the organisations performance (thereby building awareness), and the promotion of

3Benn,P.(2011).ManagingforResilience 4Hollnagel,E.,Woods,D.D.,Leveson,N.(2004).ResilienceEngineering,conceptsandprecepts.ISBN0754646416.Hampshire:AshgatePublishingLimited,pp.229233.5Caralli,R.etal.(2010).ImprovingOperationalResilienceProcesses:TheCERTResilienceManagementModel.IEEEInternationalConferenceonPrivacy,Security,RiskandTrust.

5

continuous improvement through sensitivity to failures and tolerance of errors. Theexistenceof these cultures and their accompanyingbehaviouralmanifestations thereforedirectly enhance organisational resilience by creating the following characteristics to agreaterorlesserdegree:

Redundancy Reliability Anticipation Preparedness Adaptivecapacity Learningcapacity

Cultureandbehaviourplayalargeroleinsuccessfullyresilientorganisationsandtheyhavebeenplacedtoonesideheretosomeextentinourreviewofthedisciplinesandtheirmapping.Theysupportthecharacteristicsinmanydifferentwaysandshouldbethesubjectoffurtherworkfollowingthispaper.

THE CAPABILITIES THAT PROVIDE RESILIENCE Resilienceisaconceptratherthanadiscipline,functionorprocess,andorganisationsstrivetoachieve itasagoal. Thus ithaskeydimensionsorcapabilitiesthatformthepartsthatmake itawhole,whereorganisations requireallcapabilities inorder tobe fully resilient.Theseinclude:

i) the capability to assess risks and threats, to anticipate adisruption andmitigate,avoiditorpreventitfromoccurring

ii) the capability to plan and prepare for disruption, thereby protecting theorganisation

iii) thecapabilitytoadaptorrespondtoandmanageadisruptionsuccessfully,therebypreventingadisruptionfromspreadingitsimpacts

iv) thecapabilitytorecovertoanewnormalstateafteradisruption.

If an organisation builds these capabilities itwill have built a resilient capacity for itselfwhichwillensureitkeepsgoingafterdisruptionsandisabletoreturntobusinessasusual

6

in a timelymanner. Competence in one area of resilience does not necessarily predictcompetence ina latter stage ina lineardeterministicway;however, itdoes increase theprobabilityofcompetenceacrosstheotherstages.

Disruptiveeventshereareseenasconditionsorevents that interruptor impedenormaloperationsbycreatingdiscontinuity,confusion,disorder,ordisplacement.6Disruptionscanbeofvaryingsizeandorigin,where,forexample,majorexternaldisruptionsincludenaturaldisasters or terrorism, and small internal disruptions include errors in the form ofinterferenceswithroutinesorinternalstressesonbusinessprocessesorsystems.

Failure of resilience represents an inability to respond and adapt to such disruptions orchanges in thesystemanda lossofperformance inachievingobjectivesorgoals insomeway. This isoften referred to as systembrittleness7whichdescribes the systemof anorganisation that is unable to adapt to unanticipated disruptions, and whereby (somesectionof)thatsystemcollapsesorbreaksdownwhen it isaffectedbythe interferenceofinternalorexternalfactors.

In order to expand an understanding of organisational resilience, those disciplines thatcontribute to the development of these capabilities above must be identified, and therelationshipsbetweenthosedisciplinesandresilienceestablished.

Tomaintainsuccessfulbutseparatedisciplines isnotenoughtocreateresilienceandtheymustbeintegratedandcoherenttogenerateacloselyknittedandthereforestrongblanketofresilience.

MAPPING ORGANISATIONALRESILIENCE

Iforganisationswishtobecomemoreresilientinanincreasinglythreateningworld,acrucialfirst step involves creating an understanding of how organisational resilience actually isdeveloped, and how itmay be fostered by assessing the contributions of its constituentparts.

Twopertinentquestionsthatemergearetherefore:whyshouldorganisationalresiliencebemapped, and if it is to be mapped, how should that be done in order to create aninformativeandclearunderstandingoftheconcept?

Organisational resilience isanevolving conceptandasyet therearea limitednumberofresearchstudiesthataddresstheconcept,withagrowinggroupprovidinganapproachtomodelling,creating,andmeasuringorganisationalresilience.

6A.M.Madni,S.Jackson.(2009).TowardsaConceptualFrameworkforResilienceEngineering.IEEESystemsJournal3(2):1811917Costa,W.,Voshell,M.,Branlat,M.,Woods,D.,Gomes,J.,Buarque,L.Resilienceandbrittlenessinanuclearemergencyresponsesimulation:focusingonteamcoordinationactivity.In:Proceedingsofthethirdsymposiumonresilienceengineering,JuanlesPins,France,October2830,2008.

7

Thecurrentstatusisthatmanyorganisationsretainsilosofexcellence,withverylittlecrossover in key areas and often not much central control within an overarching resilienceapproach. There are those who maintain that Risk should become the overarchingdiscipline,andsomethatBCMistheonlytrulyholisticsolutionwhichcrossesallboundaries.Therearemanyviewsandseveralinstitutesandassociationsallofwhomespousetheirownapproachasbeingthebest.

Thispapershouldnotanddoesnotsetouttoseekasolutiontothissituationbutrathertodemonstratewherethekeycontributionslieintermsofthedisciplinesandhowtheycouldbe mapped usefully. From an initial perspective, by mapping the disciplines we canestablishthoseareasofoverlaporinterconnectivity.Thisshouldthenallowusto:

assess and measure the areas of overlap for integration benefits and possibleeconomies

developmetricsfortheassessmentandmeasurementofresiliencebasedagainstasingledisciplinaryauditandanoverlap/interconnectionassessment

developaclearresilienceconceptbasedupona landscapeofrequiredconnectionsandbehaviourswithinanorganisation

buildKeyPerformanceIndicatorsbasedagainstamoredetailedsetofrequirements developplansbaseduponbetterintegrationandinterconnectionexpectations

Mappingresiliencemayprovideabasisorplatformfordesigningaresiliencemeasurementorbenchmarkingtool.Thistypeofbenchmarkingtoolmaybetailoredtoanyorganisationsindividualneedsandbusinessprocessesinordertomeasuretheirlevelofresilience,whichwillfosterincreasedunderstandingofwhatresilienceisforthemandhowtheycanimprovetheirresiliencecapability.

Specifically, a tailored resilience measurement tool can be used by an organisation tomeasure their strengths or points of resilience within their systems, as well as identifycrucial gaps or vulnerabilities that require addressing to prevent future disruption.Identifyingandmeasuringcommonalitiesacrossanorganisations (asofyet) independentdisciplineswillreduceduplicateeffortsandexpenditures,therebyenhancingbothefficacyandefficiencyintheirapproachtobothcreatingandenhancingorganisationalresilience.

Different approaches tomappingorganisational resiliencemay fulfil the above aims to agreaterorlesserextent;forexample,somemaybebetteratidentifyingthecommonalitiesbetween fieldswhileothersmaymore clearly illustrate themainunique contributionsofeverydiscipline.Themethodchosentomappingorganisationalresilience isthereforeonethat warrants careful consideration and may differ per organisation or entity doing themapping.

8

THE DISCIPLINES THAT SUPPORT ORGANISATIONAL RESILIENCE This paper is concerned with how independent yet related disciplines that exist withinorganisationsmay serve tobothcreateandenhanceorganisational resilience.Those thatcontributetothekeydimensionsshouldinclude:

RiskmanagementANTICIPATION BusinessContinuitymanagementANTICIPATION,ADAPTATION,RECOVERY CrisisandCommunicationManagementRESPONSEandRECOVERY Securitymanagement(includingbuilding&facilitiesmanagement)PROTECTION InformationAssuranceandSecurityPROTECTIONandRESPONSE Health,safetyandenvironmentalmanagementANTICIPATION

Thecontributionoftheseandotherdisciplinesissubjectiveandwilldifferbyorganisation.There are arguments for the inclusion of Human Resources, Financial Management andStrategicPlanningaswellasotherkeyareasthatcanbecontributorytoresiliencebutforthe purposes of this paper, it is felt that these disciplines outlined above are the mostrelevantandprovideagoodstartingpoint.

POTENTIAL MAPPING APPROACHES

Multiplemethodsexistwhichmaybeutilisedinthemappingprocess,whicharegenericandsubjecttowhicheverdisciplinesare identifiedand includedbythosedoingthemapping.Potentialmappingmethods identifiedbythesubgroupduringtheproductionofthispaperinclude:

i) tablesormatrices illustratingthedisciplinesrequiredduringbothbusinessasusualandduring incidentresponseandrecovery,and inwhichofthesephaseseachdisciplinecontributesmostto

ii) diagramsdepictingtherelationshipsorprocessesbywhichtheindividualdisciplinescreateorfosterresilience

iii) mindmaps and Venn diagrams depicting the commonalities, and overlappingfunctionsofeachofthecontributingdisciplinesintheircontributionstoresilience

9

MAPPING ORGANISATIONAL RESILIENCE IN A TABLE OR MATRIX Thetablebelowpresentsanattempttotabulatethedisciplinesaccordingtothefourphasesofresilienceidentifiedabove.

Table1:Thedisciplinesexistingwithineachphaseofdevelopment

Anticipation Protection&Planning Response Recovery

Threats Security CrisisManagement BusinessContinuity

Insuranceawareness InformationAssurance Communications Insurance

Strategicrisk Health,SafetyandEnvironment

ITDisasterRecovery Leadership

Operationalrisk Insurance BusinessContinuity HR

Financialrisk Governance,ComplianceandAudit

ITandWorkareaDR

BusinessContinuity BusinessContinuity

Thismethodwasusefulto identifywhere,oratwhichphaseoftheresilienceprocess inachronological timeline each discipline potentially provides the greatest contribution, andthereforemayhelp focusanorganisationseffortsandattentionatanygiven time in theresilienceprocess.Tablesserveagood initialstartingpointtoorganiseonesthinkingandstructuretheorganisationalresiliencedebate.

At the same time, thisapproachdidnot fully informourunderstandingoforganisationalresilience, as the constrictions imposed by the nature of the table and its boundariescreatedahighlystaticmap.Thispreventedtheabilitytoidentifyordepictcommonalitiesoroverlapsamong thedisciplinesandphasesof resilience,and resulted ina repetitiveorredundantpresentationof informationacrossanyof the tables cellswith regards to thedisciplinesrequiredforresilience.

10

MAPPING ORGANISATIONAL RESILIENCE USING DIAGRAMS Severaldiagramsarepresentedbelowwhichweredevelopedtomapthedisciplinesandthespecificbehavioursorgoalswithineachofthosedisciplinesrequiredforresilience.

Figure1incorporatesachronologicalfeatureandtakesaprocessapproachtodefiningwhatphase of resilience each discipline contributes greatest to; indicating that one phase ofresiliencecannot fullybemet iftheearlierphasehasnotbeenaddressed.At itscentre ispresented core setor listofgenericbehavioursor skills thatarebelieved tobe requiredacrossalldisciplines,andthereforeacrossallphases,tofosterresilience.

Figure1:Thechronologicalprocessbywhichdisciplinescontributetothedevelopmentofaresiliencecapabilityandthecorebehavioursrequired

11

Figure2isbasedaroundthecoreaspectsofanyorganisationandsetsoutthedisciplinesandbehavioursrequiredwithineachofthosetocreatearesilientorganisation.Itismorecomplexbutitdoesallowgreaterflexibilityinshowingallaspectsofresilienceandhasscopetogrowintoamorecomprehensiveconcept.

Figure2:Thekeyfacetsofresilienceandtheirassociateddisciplines,functionsorareas

Thesesortsofdiagramsmaybemorebeneficialtounderstandingtheuniquecontributionsofeachdiscipline tooverall resilience, thepotentialoutputs createdby thosedisciplines.Additionally,theybetterservetoillustrateachronologicalorsequentialpathtotheprocessofcreatingresilience.

However,thepotentialoverlapsbetweenthedisciplinesintermsoftherequiredbehavioursforoptimalcreationofresiliencewereonceagaindifficulttodisplayusingthisformat. Aswiththetable,thismethodwasfoundtobetoostaticinnaturetotrulycapturethelinksorrelationships between the individual disciplines and overall resilience. Specifically, thedisciplines could not easily be assigned to one chronological phase of the resilienceprocess, and the varying degrees or levels of influence of the disciplines acrossmultiplephases, and, importantly overlaps between the disciplines contributions were notillustrated.

12

MAPPING ORGANISATIONAL RESILIENCE USING A MINDMAP Twodifferenttypesofmindmapswerecreated inanattempttoaddressthisshortcomingand illustrate theoverlapsbetween the individualdisciplines in termsof contributions toorganisationalresilience.

Figure3isamindmapinwhichthemainactivitiesofeachdisciplineandthelinksbetweenthedisciplinesaresetout.Thisisquiteinformativeandcouldhavescopetobebuiltupintoa broader view, detailing more specifically the key discipline activities. Ultimately all itwouldshow,however,iswheretherearetouchpointsinotherdisciplines.

Figure3:Mindmapofthedisciplinesandtheirpotentialrelationshiplinksorinterfaces

13

Figure4extrapolatestheinformationgainedfromthelinksdepictedinthemindmapaboveinto a Venn diagram, which more clearly depicts the existing overlaps between thedisciplines. This ismuchmore limited in showingonly broad areasbut could develop ifthoseoverlapscontainedtheareasthatcausedthem.

Figure4:AVenndiagramdepictingtheoverlappingrelationshipsbetweenthedisciplinesthatcontributetoresilience

Figure5 illustratesthedisciplinesasthebuildingblocksofresilienceassetoutearlierandattempts to demonstrate their relationships through their contribution to each aspectrequiredtodeliveraresilientorganisation.

Althoughsomewhatsimplisticatthisstage,thehierarchicalapproachseemstoworkwellinterms of demonstrating the various disciplines and how they directly interact throughsystems,processesandbehaviourswhichareallkeytoaresilientorganisation. Followingthis stageofdevelopment, thenextwouldbe to identify the crossoverpoint and interactions in each key area at Level 2 as those areaswhereby resilience can be improvedbeyondsilosandwhereintegrationshouldbeoccurring.

14

Figure5:Resilienceasahierarchicalmodel

A CONTINUING JOURNEY: FUTURESTEPS

Mindmaps were found to be most useful for depicting the interlinking relationshipsbetween the individual disciplines, and, with more work, this may serve to allow anorganisationtofocuseffortsonreducingduplicatedorredundanteffortswhencreatingorfosteringresilience.

The levelsofdetailbeyond the scopeof thispapermustbe investigatednext,where thegroups of disciplines meet, to identify the synergies, supporting activities, redundancy,duplication and integrationornot inorder toderive abetterunderstandingofhow theresiliencecanbeimproved.

15

CONCLUSION

Theendeavourtomapthecontributionsofindividualresiliencedisciplinestoorganisationalresilienceisafruitfulyetchallengingone.Thispaperhaspresentedmultiplemethodstriedand tested by contributors in an initial attempt to pave the road towards creating astructured resiliencemap. It illustrates the existing debate in response to the questionwhat is organisational resilience and how can we map its contributing disciplines?Pursuing this work will begin to provide a structured and systematic approach thatorganisationsmay tailor to theirownneeds toensure resilience isbeing fostered acrosstheir systems andprocesses. Such an approachor toolorbenchmark canonly serve toimprove and help organisations become stronger andmore resilient in todaysworld ofcloselyintegratedthreatsandrisks.

Itisinterestingalsotonotethatworkiscurrentlyunderwayandhasbeenforsometimetoestablishan ISO22323Standard forOrganisationalResilience,and that there isalsoanASISOperationalResilienceStandardSPC.1.2009inplaceintheUSA.Thesubjecthasbeen,and isbeing,approachedfromavarietyofdirectionsandaspectsandfurtherdevelopmenthere should aim to support and add clarity by delivering clear views from the keycommunitiessuchasthemembershipoftheBCI.

AttachedtothispaperistheopportunityforcommentintheBCIsurvey(https://www.surveymonkey.com/s/OrganisationalResilience2012)inordertodevelopafurtherviewofhowtheusercommunityseesthesemattersbeingtakenforwardandwheretheyperceivethebestuseofefforttobeapplied.Inthisway,furtherworkcanbefocusedonthoseareaswhichaddbestvaluetothosewhoneedit.