Resilience (organizational)

For other uses, see Resilience (disambiguation).

British Standard, BS65000(2014) defines "organisational resilience" as "ability of an organization to anticipate, prepare for, and respond and adapt to incremental change and sudden disruptions in order to survive and prosper."[1]

In recent years, a new consensus of the concept of resilience emerged as a practical response to the decreasing lifespan of organisations[2] and the from key stakeholders, including boards, governments, regulators, shareholders, staff, suppliers and customers to effectively address the issues of security, preparedness, risk, and survivability.

  1. Being resilient is a proactive and determined attitude to remain a thriving enterprise (country, region, organization or company) despite the anticipated and unanticipated challenges that will emerge;
  2. Resilience moves beyond a defensive security and protection posture and applies the entity’s inherent strength to withstand crisis and deflect attacks of any nature;
  3. Resilience is the empowerment of being aware of your situation, your risks, vulnerabilities and current capabilities to deal with them, and being able to make informed tactical and strategic decisions; and,
  4. Resilience is an objectively measurable competitive differentiator (i.e., more secure, increased stakeholder and shareholder value).

An organization that realizes the benefits of the above definitions of resilience will have a high likelihood of maintaining a successful and thriving enterprise.

Previously, it was considered that 'organisational resilience' could only be generated from processes and functions such as Risk Management, Business Continuity, IT Disaster Recovery, Crisis Management, Information Security, Physical Security and so on. These are recognised as key contributors to operational resilience, and “the positive ability of a system or company to adapt itself to the consequences of a catastrophic failure caused by power outage, a fire, a bomb or similar” event[3] or as "the ability of a [system] to cope with change".[4] However, research from many academics including as Hamel & Valikangas in the Harvard Business Review,[5] Boin, Comfort & Demchak[6] and research facility ResOrgs[7] has influenced understanding and lead to new viewpoints on resilience, including that from the BSI Group,[8] being developed by ISO,[9] the Australian government,[10] ResOrgs,[11] ICSA,[12] and professional services firms such as PwC,[13] all of which recognises that processes and functions are but one element of an organisation's resilience web.

The Importance of Organizational Resilience

Global turbulence is expected. Competition, instability and uncertainty are constants in a changing world. Organizations face an unprecedented and growing number of potential disruptions to the status quo and the best laid strategic plans. As history repeats itself, prominent organizations will fail unless modern risk management and governance models incorporate scalable resilience metrics.

To survive and prosper in this new environment of heightened uncertainty and change, organizations must move past traditional risk and governance models and focus instead on resilience. Resilience applies at all levels: national, regional, organizational and corporate. At the national level, major infrastructure concerns and societal institutions must be robust enough, and unencumbered by legal and regulatory constraints, to serve the national good in normal operations, in crisis, and in recovery. At the regional levels, specific infrastructure assets come together in highly interdependent ways to serve local constituents and be a part of a national infrastructure. At the organizational and corporate level (which owns or operates the vast majority of our critical infrastructure assets), individual companies and operating units must ensure their business operations and service delivery capacities remain able to perform their primary business functions.

Business Continuity and Competitiveness

Yossi Sheffi extended the resilience concept to business continuity initiatives in his 2005 book The Resilient Enterprise.[14] Sheffi analyzed how disruptions can adversely affect the operations of corporations and how investments in resilience can give a business a competitive advantage over entities not prepared for various contingencies. Business organizations such as the Council on Competitiveness have embraced resilience and have tied economic competitiveness to security.[15] The Reform Institute has highlighted the need to enhance the resilience of the supply chain and electrical grid against disruptions that could cripple the U.S. economy.[16][17] Many corporations are adopting resilience and business continuity initiatives and sharing best practices.[18]

Many experts and leaders see resilience as a vital component to a homeland security strategy.[19][20] Hurricane Katrina demonstrated that not all catastrophic events can be prevented and a focus on response and recovery is needed.

Growing Support in Washington, D.C.

Prominent members in the United States Congress are embracing resilience. The Chairman of the Homeland Security Committee of the U.S. House of Representatives, Bennie Thompson (D-MS) declared May 2008 “Resilience Month” as the committee and its subcommittees held a series of hearings to examine the issue.[21][22] President Obama[23] and the Department of Homeland Security[24][25] have also made resilience an integral component of homeland security policy.

The Quadrennial Homeland Security Review, released by the Department of Homeland Security in February 2010, made resilience a prominent theme and one of the core missions of the U.S. homeland security enterprise.[26]

The Resilience of an Enterprise - Competitive Advantage

Business and government enterprises that are able to quickly adapt to or seize competitive advantage from sudden and/or significant changes in their environments, with minimal interruption to their enterprise missions and manageable impact to their market value, as well as adapt to change in an apparently slower, more evolutionary manner - sometimes over many years or decades - can be described as being more resilient. Leading management consultancies and national governments including the Australia, U.S. Department of Homeland Security and the UK Cabinet Office believe that an organization’s resilience, properly understood, has critical implications for its competitive posture, profitability and shareholder value.

Over the past years, business, academic and government leaders have become aware that certain organizations respond better to disruptions than other, often similarly situated, organizations. For example, a September 2003 Harvard Business Review article[27] stated that “momentum is not the force it once was” in ensuring an organization’s success. They noted the emergence of several disruptive trends — including technological discontinuities, regulatory upheavals, geopolitical shocks, industry deverticalization and disintermediation, abrupt shifts in consumer tastes, and hordes of nontraditional competitors — that require companies to become resilient to remain successful. The authors concluded that “strategic resilience is not about responding to a one-time crisis. It’s not about rebounding from a setback. It’s about continuously anticipating and adjusting to deep, secular trends that can permanently impair the earning power of a core business. It’s about having the capacity to change before the case for change becomes desperately obvious.”

Resilience also has important implications for governance processes and systems. In a 2004 white paper[28] the authors wrote that “enterprise resilience marries risk assessment, information reporting, and governance processes with strategic and business planning to create an enterprise-wide early warning capability that is embedded in the business of the company.” They explained that “Enterprise Resilience is predicated on an expanded view of risk—one that focuses on value, and therefore encompasses not only traditional risks (e.g., financial, natural hazards, physical security, legal, compliance) but also risks relating to earnings drivers (e.g., innovation, channel relationships, intellectual property) and company culture.”

Over the past decade, governments worldwide have also become increasingly focused on protecting their facilities, technologies, networks, personnel and other mission-critical assets from attack or misappropriation. The risk of cyber-terrorism and other threats to critical infrastructure are of particular concern. On March 31, 2011, the President issued Presidential Policy Directive Eight (PPD-8)[29] that directed the Secretary of the Department of Homeland Security to develop a national preparedness system with the objective of strengthening the security and resilience of the United States through systematic preparation for the threats that pose the greatest risk to the security of the Nation, including acts of terrorism, cyber attacks, pandemics, and catastrophic natural disasters. The directive defined resilience as “the ability to adapt to changing conditions and withstand and rapidly recover from disruption due to emergencies.”

Resilience & Security

Security, whether applied to physical, financial, personnel, cyber information or any other asset, entails the measures to protect against danger or loss with emphasis on being protected from dangers that originate from outside. A significant breach in security could certainly impair an organizations ability to exist, and thus is a critical concept underlying the organization’s capacity to be resilient. Resilience is proactive in positioning the company to survive and thrive given known and unknown challenges. Security, as generally practiced, provides specific protection against identified or projected circumstances.

Resilience & Protection

Protection is often associated with the set of actions to harden assets to withstand identified contingencies, mitigate the damage, or make them an unattractive target. The focus is to maintain the assets’ core function and ward off harm. Typically, protection performance objectives are stated as an absolute capability against varying levels of threat (category II or greater hurricane, defined types of breaches, specific acts). Organizations plan for protection against specific threats or categories of threats. Resilience approaches the issue from a standpoint of taking reasonable protective actions, but having alternative capabilities as needed or the ability to withstand the disruption.

Resilience & Crisis Management

Crisis management generally refers to the set of actions and capabilities in place to effectively respond to and contain a situation. The situation can vary from natural, man-made, or environmental challenges, whether internally or externally generated. Most consider crisis management to largely consist of actions that go into play when the crisis occurs and subside after it is considered “over”. There are plans and preparations, but the actions are not often dealt with as part of normal operations. Resilience depends on effective crisis management, but would encourage more prominent treatment of crisis management capabilities throughout the company’s operation than is often the case.

Resilience & Preparedness

Preparedness consists of the plans of actions for when the disaster or crisis strikes. Preparedness efforts are very specific sets of tactical actions (evacuation plans, sheltering plans, rehearsals, stockpiles, etc.) that the company and individuals will take to mitigate the effects of predicted disasters/crises. Resilience requires prudent and serious attention to preparations for known likely disasters, particularly those that are highly likely (e.g., hurricanes in Florida). Resiliency would address preparedness as a specific emergency management business function; but more importantly, as being impacted by numerous functions across the organization. These may include human resources, strategic planning, financial management, information technology, and risk management.

Resilience & Risk Management

Risk management consists of formal processes to identify threats and vulnerabilities to the company, and the mitigation approaches it will employ. Risk management is highly sophisticated and the results have application in managing the business, insurance coverage, and in attracting investors. The risk management profession is moving toward a more proactive and return on investment focus, but the traditional focus has been defensive in nature. Identifying and managing risks, particularly operational risks, is arguably the most important factor in achieving resilience; however, it is one of many factors. Resiliency has a healthy consideration of posturing for future opportunities. That is not a traditional consideration in risk management.

Making Resilience Reality

Some scholars have identified the four facets of resilience as preparedness, protection, response and recovery.[30] Other countries, such as the United Kingdom and Australia, are adopting the resilience concept.[31][32] In the United Kingdom, resilience is implemented locally by the Local Resilience Forum.

Measuring Resilience

As part of the Canterbury University Resilient Organisations programme, ResOrgs have developed a tool for benchmarking the Resilience of Organisations.[33]

Resilience as an Acquired Skill

In Organizational Studies, resilience is often referred to as the maintenance of positive adjustment under challenging conditions. Here, resilience emerges as the response to specific interruptions of the normal. Sutcliffe and Vogus[34] argue that resilience should rather be viewed from a developmental perspective, as an ability that develops over time from continually handling risks. Resilience, then, is "the continuing ability to use internal and external resources successfully to resolve new issues". Thus, "resilience is the capacity to rebound from adversity strengthened and more resourceful".

Organizational Resilience Management Standard

ASIS International have developed and published the definitive Organizational Resilience Management Standard SPC.1-2009. Approved by ANSI and adopted by the Department of Homeland Security under the PS-Prep program, this American Standard provides a practical basis for implementation of preparedness objectives supported by ASIS ORMS (Organizational Resilience Management System) software.

References

  1. ↑ http://shop.bsigroup.com/ProductDetail/?pid=000000000030258792
  2. ↑ http://www.amazon.co.uk/Upside-Turbulence-Seizing-Opportunity-Uncertain/dp/0061771155/
  3. ↑ Resilience. Wiktionary.
  4. ↑ Wieland, A. & Wallenburg, C.M. (2013): The influence of relational competencies on supply chain resilience: a relational view. International Journal of Physical Distribution & Logistics Management. Vol. 43, No. 4, pp. 300-320.
  5. ↑ https://hbr.org/2003/09/the-quest-for-resilience
  6. ↑ http://www.amazon.co.uk/Designing-Resilience-Preparing-Extreme-Events-ebook/dp/B0084FAQ84/ref=sr_1_1?ie=UTF8&qid=1430227936&sr=8-1&keywords=boin+comfort+demchak
  7. ↑ http://www.resorgs.org.nz/
  8. ↑ http://shop.bsigroup.com/ProductDetail/?pid=000000000030258792
  9. ↑ http://www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=50053
  10. ↑ http://www.organisationalresilience.gov.au/resources/Pages/default.aspx
  11. ↑ http://www.resorgs.org.nz/
  12. ↑ https://www.icsa.org.uk/shop/books/solutions-series/building-a-resilient-organisation-icsa-solutions
  13. ↑ http://www.pwc.com/resilience
  14. ↑ Sheffi, Yossi (October 2005), The Resilient Enterprise: Overcoming Vulnerability for Competitive Enterprise, MIT Press
  15. ↑ Transform. The Resilient Economy. Integrating Competitiveness and Security. Council on Competitiveness. July 2007.
  16. ↑ Chain of Perils: Hardening the Global Supply Chain and Strengthening America's Resilience. Reform Institute. March 2008.
  17. ↑ The Smart Alternative: Securing and Strengthening Our Nation's Vulnerable Electric Grid. Reform Institute. June 2008.
  18. ↑ Building A Resilient Nation: Enhancing Security, Ensuring a Strong Economy. Reform Institute. October 2008.
  19. ↑ Katherine McIntire Peters. Government Urged to Focus on Resilience in Homeland Security. Government Executive. October 1, 2008
  20. ↑ James Jay Carafano. Risk and Resiliency: Developing the Right Homeland Security Public Policies for the Post-Bush Era. Testimony Before the Subcommittee on Transportation Security and Infrastructure Protection. Committee on Homeland Security. United States House of Representatives. June 24, 2008.
  21. ↑ 'Resilience' Blooming Into Its Own. Homeland Security Watch. May 1, 2008.
  22. ↑ Committee Leaders Pleased With Month of Hearings on Resiliency. CQ Homeland Security. May 23, 2008.
  23. ↑ Homeland Security. whitehouse.gov. Retrieved 2009-04-05.
  24. ↑ One Team, One Mission, Securing Our Homeland. U.S. Department of Homeland Security Strategic Plan. Fiscal Years 2008-2013. U.S. Department of Homeland Security. September 2008.
  25. ↑ Top Ten Challenges Facing the Next Secretary of Homeland Security. Homeland Security Advisory Council. September 2008.
  26. ↑ Quadrennial Homeland Security Review Report: A Strategic Framework for a Secure Homeland. U.S. Dept. of Homeland Security. February 2010.
  27. ↑ Gary Hamel and Liisa Välikangis (2003). "The Quest for Resilience". Harvard Business Review.
  28. ↑ "Redefining the Corporate Governance Agenda" (PDF). Booz Allen Hamilton and Weil, Gotschal and Manges LLP. 2004.
  29. ↑ "PPD-8".
  30. ↑ Building A Resilient Nation: Enhancing Security, Ensuring a Strong Economy report. Reform Institute. October 2008.
  31. ↑ Resilient Nation. Demos. April 2009.
  32. ↑ Improving Disaster Resilience. Australian Government. May 12, 2009.
  33. ↑ Resilient Organisations. March 22, 2011.
  34. ↑ Organizing for Resilience Sutcliffe, K. M., & Vogus, T. J. (2003). In K. S. Cameron, J. E. Dutton & R. E. Quinn (Eds.), Positive Organizational Scholarship: Foundations of a New Discipline (pp. 94-110). San Francisco: Berett-Koehler Publishers

External links

Further reading

This article is issued from Wikipedia - version of the Monday, November 09, 2015. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.