Organisational ResilienceWhere are we now and where to next?

Where are we nowDefining resilienceContext: confined to organisations the capacity of an organisation to plan for and adapt to change or disruption, through anticipation, protection, responsive capacity and recoverability.

Global viewsInstitutesUK: UCL Institute for Security & Resilience Studies; The Centre for International Security and Resilience (CISR)Australia: Canterbury University Resilient OrganisationsUS: Community and Regional Resilience Insititute; Western Washington UniversityResilience InstituteStandardsUK: ISO 22301, BSI, 2011, RM ISO 2009Australia: National Security Science and Innovation Strategy documentUS: ANSI/ASIS SPC.1-2009, ANSOR (American National Standard, Organizational Resilience: Security, Preparedness, And Continuity Management Systems)- also adopted in the Netherlands

Global views- researchAustraliaRecent study: CEO perspectives of organisational resilienceSome interesting findings:Short term resilience = ability to change and adaptLong term resilience = ability to shape the environment90% of CEOs were changers and reactors.10% were shapersShapers more concerned with culture & innovationCommon understanding of the pieces of resilience, but NOT of how to assemble all the bits

CEO perspectives of key source of resilienceKey source of resilience = culture & trust1) engineered culture2) emergent culture

CEOs perspective on key stakeholders

UK: BCI SubgroupBCI Subgroup Paper Aim: to answer the main research question: What is organisational resilience and how can we map its contributing disciplines?Objectivesto discuss whether there is value to mapping organisational resilience,to discover which model is most effective Follow-up Survey: reactions to the paper

Characteristics of Organisational Resilience

Capabilities of a resilient organisation

Core disciplines that support organisational resilience

Model 1

Model 2

Model 3

Is there value to mapping resilience?Measurement & assessment metrics

Identifying overlap across disciplines & Integration of management systems

Guidance/standards

Where to next?1) Are there more/other characteristics of resilience?2) Are there more/other resilience capabilities?3) Are there more/other disciplines that contribute to organisational resilience?4)Can organisational resilience as a concept offer any value to an organisation for internal development and management? Does it the understanding of this concept strengthen the organisation?

Platform for open discussion!*Resilience is a very broad term, and its meaning differs depending on the context within which it is being defined (individual resilience, societal, or corporate)- the definition that is chosen or fits best is very contextually sensitiveOne study by the Australian department of homeland security identified 119 legitimate definitions of resilience.We focus here on the definition of organisational resilience, and so confine the meaning to what it may infer for corporations that require resilience in the face of potential adverse events.

*Although it is a relatively new management philosophy, Organisational Resilience is a growing concept globally, with institutes being formed to research the concept and standards being implemented in the UK, US, and Australia specifically.

Institutes include, for example:

Resilience handbooks and manuals have appeared across the world published by consultancy firms and governments alike, these are augmented by an increasing array of standards, either published or under development including national standards in theUK (ISO, 2009), Australia (National Security Science and Innovation strategy document), and U.S.A (ASIS, 2009); (as well as Denmark (Dansk, 2009) and the Netherlands (Normalisatie, 2010).

*Resilience as a concept is growing quickly among BC, risk, and HR practitioners globally. Australia and New Zealand are at the forefront of much research being done into the role of organisational resilience within the business continuity discipline.90% of CEOs were changers and reactors. Defined resilience as the ability to change and adapt. Very reactive concept of resilience.

10% were shapers shaping/creating the environment rather than reacting to it.

CEos all had a common view of the cultural bits they wanted to see in their organization; they were less clear on how to assemble all those bits to get what they were after

*The single most important source of resilience was culture. Trust most important factor- but they had a particular definition of trust in this case. CEOs perspective of trust was ALL about patterns of prediction (not a moral thing). Can I trust that these employees, systems etc are going to behave as I expect them to behave?Resilience comes from 2 cultural/ trust based patterns: 1) engineered- patterns that came from purposeful activities (scenarios, training etc).2) emergent- how engaged and committed are people to the organization? (become engaged not through a one off course but because toy believe in your leader etc- over time through interactions)BC fits in engineered, but all CEOs think they principally come from emergent. Engineered is important but remains a relatively narrow part of it.

Scenarios and simulations as most important activities to support this culture of resilience. These activities all seen as culture enablers- this is about putting the organization under stress, bringing people together, seeing how they will respond, and demonstrate capability.

BC plans not at all top of mind/priority. Doesnt mean they think BC plans are unimportant but they do NOT think they are the differentiating factor that makes you resilient. The BC plan does not help you build a culture- more of a hygiene factor- yes we have one, and it should be effective and in place, but the key feature that is going to make a difference to resilience in long term is how the culture comes together, patterns of trust are maintained and generated. And THAT is more likely to come through scenarios, sims, training, effective communication, etc.

*BC is only seen as a relatively narrow part of resilienceBC is in top 4 of the important stakeholdersBC still seen as an important team- level of engagement varies a lot across orgs and so importance of BC is contextually defined.Engagement with CEO important to make BC a part of culture (as with HR).

CEOs have a very clear and defined concept of resilience and find it an important role. Very wide scope- far beyond what BC managers can offer. Arguably by engaging with other stakeholders (especially HR), the emergent resilient culture can be created.Youre not going to change what your role is, but if it is going to match what the CEO thinks resilience is, it needs to be much more engaged with the rest of the organization.

*Basic stats on survey responses:When issuesHow many respondedWho responded

The aim of the paper was to respond to two main research questions: why should organisational resilience be mapped, and if it is to be mapped, how should that be done in order to create an informative and clear understanding of the concept?

*Survey: 69.8% strongly agreed that an adaptive capacity is a core characteristic of any resilient organisation, closely followed by preparedness (65.1%)54% strongly agreed anticipation was an important characteristic of resilience47.6% strongly agreed learning capacity was an important characteristic40.3% strongly agreed reliability was a core characteristicAnd only 25.4% strongly agreed redundancy was a core characteristic of resilience*Survey: 80.6% strongly agreed that the capability to adapt and respond was a salient feature of org res

the capability to asses risks and threats, to anticipate a disruption and mitigate, avoid it or prevent it from occurringthe capability to plan and prepare for disruption, thereby protecting the organisation the capability to adapt or respond to and manage a disruption successfully, thereby preventing a disruption from spreading its impacts the capability to recover to a new normal state after a disruption.

*80.6% strongly agreed that BCM was a core discipline in resilience and 19.4% agreed BC should be included (note: so every respondent either agreed or strongly agreed that BC should be included as a core discipline in supporting resilience) Only 41.0% strongly agreed with HSE being a core discipline, and 39.3% agreed. (contrast to CEO perspective paper!) NOT surprising considering the audience that responded to the survey- mostly BC practitioners, not CEOs!*Is this model helpful for you?YES- 71% OF SURVEY RESPONDENTS THOUGHT THIS WAS A HELPFUL MODELComments on why it was helpful included:Sound concept, clear and directional

Problems with this model included:Too wordyImplies discrete chronological stages, resilience is about culture and thinkingIt does not map the concept by showing the linkages and connections or overlaps

*YES- 61.3% SAID THIS MODEL WAS HELPFUL

Positive comments included:Good starting point, although there might be more overlapsI like this one because I feel executives could be shown this and understand itVenn diagrams are a familiar concept to most and highlights the crossover between key disciplines

Negative comments included:Some overlaps not shownCant account for all relationshipsDiffering Opinions about where certain disciplines should be and how bug/prominent some are: ie risk management in the middle, crisis management in the middle, etc., risk management is too prominent.

Key discussion point: would be interested to hear elaboration on where the circles cross. What goes on there and by who?*NO- ONLY 37.1% SAID THIS MODEL WAS HELPFUL

Positive comments:It clearly raises the cultural elements

Negative comments:Gets too complicated/messy at the bottomLevels displayed are confusingConcepts are too theoretical and not something we can put into practice in our organisation

Difficulty with all models is how to extend without introducing so much detail that the diagram becomes unreadable.How do we ensure a model that is practically applicable? (discussion question further down).

*Benefits of mapping resilience:-Assess and measure the areas of overlap for integration benefits and possible economies-Develop metrics for the assessment and measurement of resilience based against a single disciplinary audit and an overlap/inter-connection assessment -Develop a clear resilience concept based upon a landscape of required connections and behaviours within an organisation-Build Key Performance Indicators based against a more detailed set of requirements-Develop plans based upon better integration and inter-connection expectations

71% OF SURVEY RESPONDENTS THOUGHT THERE IS VALUE IN THE DEVELOPMENT OF AN ORGANISATIONAL RESILIENCE MEASUREMENT TOOL23% THOUGH GUIDANCE ON ORGANISATIONAL RESILIENCE WOULD BE OF VALUE TO THE ORGANISATIONThese are some of the benefits we came up with to mapping resilience in the context of organisations.*Identifying the touch points towards an integrated management system of improvementWhich topics are worthwhile for BC practitioners?

*