Organisational Resilience

MARCH 2012

ThispaperrespondstoaneedexpressedbymembersoftheBCIPartnershipforclarityon whatOrganisationalResilienceis,whatisrequiredtoachieveresilienceinorganisations andwhatdisciplinescontribute,andhowtheycontributetoacoherentandoptimised approachtodealingwithissuesofOrganisationalResilience. Itaimswereto:

Provideaworkingdefinitionoforganisationalresilience Identify the existing independent disciplines that contribute to achieving organisationalresilience Discussthe potentialutilityofmappingtherelationshipsbetweenthesedisciplines toresiliencewhymapresilience? Presentvariouspossiblemethodstomapresiliencehowtomapresilience? Proposefuturestepsforthedevelopmentandutilityofanorganisationalresilience model

ThepaperistheoutputofaBCImembershipsubgroupcoordinatedbytheBCIPartnership. It does not set out to provide a comprehensive one size fits all approach or model of organisational resilience, nor does it represent the views of the BCI or any other organisation. It is intended to be used as a platform for stimulating debate among BCI practitionersaboutorganisationalresiliencetoprogressunderstandinganddevelopmentat apracticallevel. AuthorsandEditors: DominicCockram,DrClaudiaVanDenHeuvel Contributors: SteveWicks,KenSimpson,CharleyNewnham,RayFerrara,LyndaMcMullen,RogerKember, MikeLees,DavidLloyd,RobertHall,KenWratten,JackieWoodland,JohnMatthews,Eugene Taylor,PhilIrwin,DrRobertMacfarlane,JeffLewis To comment directly on this paper, please contact Dominic Cockram, Chair of the BCI PartnershipSubgroup:dc@steelhenge.co.uk


APPROACH

Theapproachtakenhasbeentobuildthepaperinclearstages: 1) Establishanunderstandingoftheresiliencelandscapeandadefinitionofresilience 2) Use the landscape and definition to set out the key requirements of a resilient organisation 3) Provide an assessment of the capabilities needed to deliver the resilient requirements 4) Establishwhatdisciplineswillprovideorsupportthosekeycapabilities 5) Develop a series of diagrams or models that help to show the interactions of the disciplinesandpromotediscussion This approach was derived after several initial stages and was established as the most logicalwayinwhichtodevelopthepaper.
WHAT IS ORGANISATIONAL RESILIENCE?

Resilienceisanabstracttermthatisusedsubstantiallyacrossarangeofdisciplines,suchas psychology,sociology,economics,ecology,engineeringandnetworktheory,tonamebuta few. What constitutes resilience is a topic of considerable debate, and meanings differ dependingonthenatureofthedisciplineorcontextinwhichtheyarebeingused.Initsmost generalhumancontext,resilienceisdefinedastheabilitytorecoverfromoradjusteasily tomisfortuneorchange.1 Definitionsstemmingfromasystemsthinkingapproachexpand onthisandincludetheabilitytoanticipate,respondandadaptto,and/orrapidlyrecover from a disruptive event.2 Tensions remain across the various disciplines that define resilience, where some focus entirely on an entitys ability to absorb and adapt to impact, and others include the ability to anticipate and mitigate damage. However, in its most generallyacceptedform,thetermresiliencereferstothewayinwhichanyentityorsystem achievesanendstateofkeepinggoing. Whiledefinitionsfromthesesectorsareusefulforaidinganunderstandingofwhatismeant byresilienceingeneral,thispaperisconcernedwiththemeaningoftheterminthecontext ofanorganisation.Thetermorganisationhereisproposedtoincludeanentitywithineither the private or public sector, for profit and nonprofit, and of any given size. This paper focuses on what an organisation requires to demonstrate resilience, and does not discuss
1Webstersdictionary 2 Tierney,K.J.(2005).Response,Recovery,andResilience.PanelPresentationattheUnitedNationsWorldConference onDisasterReduction,Kobe,Japan,January21.

theconceptsofsocietalorcommunityresiliencewhichhavebeencomprehensivelycovered inotherrecentBCIpapers3. Perhaps most informative to constructing a definition of organisational resilience are the definitions stemming from the field of Resilience Engineering. This field takes on a proactiveapproachthatisaimedprimarilyatunderstandinganorganisationsabilitytocope with complexity under pressure in order to obtain success. Additionally, it adopts both a processfocused and systems thinking approach to define how people learn and adapt to create safety amidst adversity and strain, or within a faulty environment. Resilience in this fieldisdefinedastheintrinsicabilityofanorganisation(orsystem)tomaintainorregaina dynamicallystablestate,whichallowsittocontinueoperationafteramajormishapand/or thepresenceofacontinuousstress.4Morespecifically,thefieldcoinsthetermOperational Resiliencetodescribewhatresiliencemeansforanentireorganisationafteracrisisornon strategic disruption; this is defined as the processes and related practices by which an organisation designs, develops, implements, and controls strategies for protecting and sustaininghighvalueservices,relatedbusinessprocesses,andassociatedassets.5 Whileeveryorganisationisuniqueinthepathwayittakestoachievethedesiredendstateof beingresilient,thispaperpositsthatorganisationalresiliencerequiresbothapreventative capacityaswellasanadaptivecapacityinresponsetotheoccurrenceofdisruptions. Thispaperthereforedefinesorganisationalresilienceas the capacity of an organisation to plan for and adapt to change or disruption, through anticipation,protection,responsivecapacityandrecoverability.
KEY REQUIREMENTS OF RESILIENT ORGANISATIONS

Previous studies have identified many organisational mechanisms and characteristics embedded in everyday practices that contribute to an organisations resilience. These include organisational cultures that are flexible, just and promote learning, and the correspondingbehaviouralmanifestationsoftheseculturesdisplayedbystaffmembersat alloperationallevelsduringbusinessasusual. Specifically, behaviours that have been identified as being displayed by resilient organisationsincludemonitoring,detectingandreactingtoissuesthatcouldhaveanimpact on the organisations performance (thereby building awareness), and the promotion of
3 4

Benn,P.(2011).ManagingforResilience Hollnagel,E.,Woods,D.D.,Leveson,N.(2004).ResilienceEngineering,conceptsandprecepts.ISBN0754646416. Hampshire:AshgatePublishingLimited,pp.229233. 5 Caralli,R.etal.(2010).ImprovingOperationalResilienceProcesses:TheCERTResilienceManagementModel.IEEE InternationalConferenceonPrivacy,Security,RiskandTrust.

continuous improvement through sensitivity to failures and tolerance of errors. The existence of these cultures and their accompanying behavioural manifestations therefore directly enhance organisational resilience by creating the following characteristics to a greaterorlesserdegree: Redundancy Reliability Anticipation Preparedness Adaptivecapacity Learningcapacity Cultureandbehaviourplayalargeroleinsuccessfullyresilientorganisationsandtheyhave beenplacedtoonesideheretosomeextentinourreviewofthedisciplinesandtheir mapping.Theysupportthecharacteristicsinmanydifferentwaysandshouldbethesubject offurtherworkfollowingthispaper.
THE CAPABILITIES THAT PROVIDE RESILIENCE

Resilienceisaconceptratherthanadiscipline,functionorprocess,andorganisationsstrive toachieveitasagoal.Thusithaskeydimensionsorcapabilitiesthatformthepartsthat make it a whole, where organisations require all capabilities in order to be fully resilient. Theseinclude: i) the capability to assess risks and threats, to anticipate a disruption and mitigate, avoiditorpreventitfromoccurring the capability to plan and prepare for disruption, thereby protecting the organisation thecapabilitytoadaptorrespondtoandmanageadisruptionsuccessfully,thereby preventingadisruptionfromspreadingitsimpacts thecapabilitytorecovertoanewnormalstateafteradisruption.

ii)

iii)

iv)

If an organisation builds these capabilities it will have built a resilient capacity for itself whichwillensureitkeepsgoingafterdisruptionsandisabletoreturntobusinessasusual
5

in a timely manner. Competence in one area of resilience does not necessarily predict competence in a latter stage in a linear deterministic way; however, it does increase the probabilityofcompetenceacrosstheotherstages. Disruptive events here are seen as conditions or events that interrupt or impede normal operationsbycreatingdiscontinuity,confusion,disorder,ordisplacement.6Disruptionscan beofvaryingsizeandorigin,where,forexample,majorexternaldisruptionsincludenatural disasters or terrorism, and small internal disruptions include errors in the form of interferenceswithroutinesorinternalstressesonbusinessprocessesorsystems. Failure of resilience represents an inability to respond and adapt to such disruptions or changes in the system and a loss of performance in achieving objectives or goals in some way. This is often referred to as system brittleness7 which describes the system of an organisation that is unable to adapt to unanticipated disruptions, and whereby (some sectionof)thatsystemcollapsesorbreaksdownwhenitisaffectedbytheinterferenceof internalorexternalfactors. In order to expand an understanding of organisational resilience, those disciplines that contribute to the development of these capabilities above must be identified, and the relationshipsbetweenthosedisciplinesandresilienceestablished. Tomaintainsuccessfulbutseparatedisciplinesisnotenoughtocreateresilienceandthey mustbeintegratedandcoherenttogenerateacloselyknittedandthereforestrongblanket ofresilience.
MAPPINGORGANISATIONALRESILIENCE

Iforganisationswishtobecomemoreresilientinanincreasinglythreateningworld,acrucial first step involves creating an understanding of how organisational resilience actually is developed, and how it may be fostered by assessing the contributions of its constituent parts. Twopertinentquestionsthatemergearetherefore:whyshouldorganisationalresiliencebe mapped, and if it is to be mapped, how should that be done in order to create an informativeandclearunderstandingoftheconcept? Organisational resilience is an evolving concept and as yet there are a limited number of researchstudiesthataddresstheconcept,withagrowinggroupprovidinganapproachto modelling,creating,andmeasuringorganisationalresilience.

A.M.Madni,S.Jackson.(2009).TowardsaConceptualFrameworkforResilienceEngineering.IEEESystemsJournal3(2): 181191 7 Costa,W.,Voshell,M.,Branlat,M.,Woods,D.,Gomes,J.,Buarque,L.Resilienceandbrittlenessinanuclearemergency responsesimulation:focusingonteamcoordinationactivity.In:Proceedingsofthethirdsymposiumonresilience engineering,JuanlesPins,France,October2830,2008.

Thecurrentstatusisthatmanyorganisationsretainsilosofexcellence,withverylittlecross over in key areas and often not much central control within an overarching resilience approach. There are those who maintain that Risk should become the overarching discipline,andsomethatBCMistheonlytrulyholisticsolutionwhichcrossesallboundaries. Therearemanyviewsandseveralinstitutesandassociationsallofwhomespousetheirown approachasbeingthebest. Thispapershouldnotanddoesnotsetouttoseekasolutiontothissituationbutratherto demonstratewherethekeycontributionslieintermsofthedisciplinesandhowtheycould be mapped usefully. From an initial perspective, by mapping the disciplines we can establishthoseareasofoverlaporinterconnectivity.Thisshouldthenallowusto: assess and measure the areas of overlap for integration benefits and possible economies developmetricsfortheassessmentandmeasurementofresiliencebasedagainsta singledisciplinaryauditandanoverlap/interconnectionassessment developaclearresilienceconceptbaseduponalandscapeofrequiredconnections andbehaviourswithinanorganisation buildKeyPerformanceIndicatorsbasedagainstamoredetailedsetofrequirements developplansbaseduponbetterintegrationandinterconnectionexpectations Mappingresiliencemayprovideabasisorplatformfordesigningaresiliencemeasurement orbenchmarkingtool.Thistypeofbenchmarkingtoolmaybetailoredtoanyorganisations individualneedsandbusinessprocessesinordertomeasuretheirlevelofresilience,which willfosterincreasedunderstandingofwhatresilienceisforthemandhowtheycanimprove theirresiliencecapability. Specifically, a tailored resilience measurement tool can be used by an organisation to measure their strengths or points of resilience within their systems, as well as identify crucial gaps or vulnerabilities that require addressing to prevent future disruption. Identifying and measuring commonalities across an organisations (as of yet) independent disciplineswillreduceduplicateeffortsandexpenditures,therebyenhancingbothefficacy andefficiencyintheirapproachtobothcreatingandenhancingorganisationalresilience. Different approaches to mapping organisational resilience may fulfil the above aims to a greaterorlesserextent;forexample,somemaybebetteratidentifyingthecommonalities between fields while others may more clearly illustrate the main unique contributions of everydiscipline.Themethodchosentomappingorganisationalresilienceisthereforeone that warrants careful consideration and may differ per organisation or entity doing the mapping.

THE DISCIPLINES THAT SUPPORT ORGANISATIONAL RESILIENCE

This paper is concerned with how independent yet related disciplines that exist within organisations may serve to both create and enhance organisational resilience. Those that contributetothekeydimensionsshouldinclude: RiskmanagementANTICIPATION BusinessContinuitymanagementANTICIPATION,ADAPTATION,RECOVERY CrisisandCommunicationManagementRESPONSEandRECOVERY Securitymanagement(includingbuilding&facilitiesmanagement)PROTECTION InformationAssuranceandSecurityPROTECTIONandRESPONSE Health,safetyandenvironmentalmanagementANTICIPATION Thecontributionoftheseandotherdisciplinesissubjectiveandwilldifferbyorganisation. There are arguments for the inclusion of Human Resources, Financial Management and StrategicPlanningaswellasotherkeyareasthatcanbecontributorytoresiliencebutfor the purposes of this paper, it is felt that these disciplines outlined above are the most relevantandprovideagoodstartingpoint.
POTENTIALMAPPINGAPPROACHES

Multiplemethodsexistwhichmaybeutilisedinthemappingprocess,whicharegenericand subjecttowhicheverdisciplinesareidentifiedandincludedbythosedoingthemapping. Potentialmappingmethodsidentifiedbythesubgroupduringtheproductionofthispaper include: i) tablesormatricesillustratingthedisciplinesrequiredduringbothbusinessasusual andduringincidentresponseandrecovery,andinwhichofthesephaseseachdiscipline contributesmostto ii) diagramsdepictingtherelationshipsorprocessesbywhichtheindividualdisciplines createorfosterresilience iii) mindmaps and Venn diagrams depicting the commonalities, and overlapping functionsofeachofthecontributingdisciplinesintheircontributionstoresilience


MAPPING ORGANISATIONAL RESILIENCE IN A TABLE OR MATRIX

Thetablebelowpresentsanattempttotabulatethedisciplinesaccordingtothefourphases ofresilienceidentifiedabove.
Table1:Thedisciplinesexistingwithineachphaseofdevelopment

Anticipation Threats

Protection&Planning Security

Response CrisisManagement

Recovery Business Continuity Insurance Leadership

Insuranceawareness Strategicrisk

InformationAssurance Health,Safetyand Environment Insurance Governance, ComplianceandAudit BusinessContinuity

Communications ITDisasterRecovery

Operationalrisk Financialrisk

BusinessContinuity

HR ITandWorkarea DR

BusinessContinuity

Thismethodwasusefultoidentifywhere,oratwhichphaseoftheresilienceprocessina chronological timeline each discipline potentially provides the greatest contribution, and therefore may help focus an organisations efforts and attention at any given time in the resilienceprocess.Tablesserveagoodinitialstartingpointtoorganiseonesthinkingand structuretheorganisationalresiliencedebate. At the same time, this approach did not fully inform our understanding of organisational resilience, as the constrictions imposed by the nature of the table and its boundaries createdahighlystaticmap.Thispreventedtheabilitytoidentifyordepictcommonalities or overlaps among the disciplines and phases of resilience, and resulted in a repetitive or redundant presentation of information across any of the tables cells with regards to the disciplinesrequiredforresilience.


MAPPING ORGANISATIONAL RESILIENCE USING DIAGRAMS

Severaldiagramsarepresentedbelowwhichweredevelopedtomapthedisciplinesandthe specificbehavioursorgoalswithineachofthosedisciplinesrequiredforresilience. Figure1incorporatesachronologicalfeatureandtakesaprocessapproachtodefiningwhat phase of resilience each discipline contributes greatest to; indicating that one phase of resiliencecannotfullybemetiftheearlierphasehasnotbeenaddressed.Atitscentreis presented core set or list of generic behaviours or skills that are believed to be required acrossalldisciplines,andthereforeacrossallphases,tofosterresilience.

Figure1:Thechronologicalprocessbywhichdisciplinescontributetothedevelopmentofa resiliencecapabilityandthecorebehavioursrequired

10

Figure2isbasedaroundthecoreaspectsofanyorganisationandsetsoutthedisciplines andbehavioursrequiredwithineachofthosetocreatearesilientorganisation.Itismore complexbutitdoesallowgreaterflexibilityinshowingallaspectsofresilienceandhas scopetogrowintoamorecomprehensiveconcept.

Figure2:Thekeyfacetsofresilienceandtheirassociateddisciplines,functionsorareas

Thesesortsofdiagramsmaybemorebeneficialtounderstandingtheuniquecontributions of each discipline to overall resilience, the potential outputs created by those disciplines. Additionally,theybetterservetoillustrateachronologicalorsequentialpathtotheprocess ofcreatingresilience. However,thepotentialoverlapsbetweenthedisciplinesintermsoftherequiredbehaviours foroptimalcreationofresiliencewereonceagaindifficulttodisplayusingthisformat.As withthetable,thismethodwasfoundtobetoostaticinnaturetotrulycapturethelinksor relationships between the individual disciplines and overall resilience. Specifically, the disciplines could not easily be assigned to one chronological phase of the resilience process, and the varying degrees or levels of influence of the disciplines across multiple phases, and, importantly overlaps between the disciplines contributions were not illustrated.

11


MAPPING ORGANISATIONAL RESILIENCE USING A MINDMAP

Twodifferenttypesofmindmapswerecreatedinanattempttoaddressthisshortcoming and illustrate the overlaps between the individual disciplines in terms of contributions to organisationalresilience. Figure3isamindmapinwhichthemainactivitiesofeachdisciplineandthelinksbetween thedisciplinesaresetout.Thisisquiteinformativeandcouldhavescopetobebuiltupinto a broader view, detailing more specifically the key discipline activities. Ultimately all it wouldshow,however,iswheretherearetouchpointsinotherdisciplines.

Figure3:Mindmapofthedisciplinesandtheirpotentialrelationshiplinksorinterfaces

12

Figure4extrapolatestheinformationgainedfromthelinksdepictedinthemindmapabove into a Venn diagram, which more clearly depicts the existing overlaps between the disciplines. This is much more limited in showing only broad areas but could develop if thoseoverlapscontainedtheareasthatcausedthem.

Figure4:AVenndiagramdepictingtheoverlappingrelationshipsbetweenthedisciplinesthatcontributeto resilience

Figure5illustratesthedisciplinesasthebuildingblocksofresilienceassetoutearlierand attempts to demonstrate their relationships through their contribution to each aspect requiredtodeliveraresilientorganisation. Althoughsomewhatsimplisticatthisstage,thehierarchicalapproachseemstoworkwellin terms of demonstrating the various disciplines and how they directly interact through systems,processesandbehaviourswhichareallkeytoaresilientorganisation.Following this stage of development, the next would be to identify the cross over point and inter actions in each key area at Level 2 as those areas whereby resilience can be improved beyondsilosandwhereintegrationshouldbeoccurring.

13


Figure5:Resilienceasahierarchicalmodel

ACONTINUINGJOURNEY:FUTURESTEPS

Mindmaps were found to be most useful for depicting the interlinking relationships between the individual disciplines, and, with more work, this may serve to allow an organisationtofocuseffortsonreducingduplicatedorredundanteffortswhencreatingor fosteringresilience. The levels of detail beyond the scope of this paper must be investigated next, where the groups of disciplines meet, to identify the synergies, supporting activities, redundancy, duplication and integrationor not in order to derive a better understanding of how the resiliencecanbeimproved.

14


CONCLUSION

Theendeavourtomapthecontributionsofindividualresiliencedisciplinestoorganisational resilienceisafruitfulyetchallengingone.Thispaperhaspresentedmultiplemethodstried and tested by contributors in an initial attempt to pave the road towards creating a structured resilience map. It illustrates the existing debate in response to the question what is organisational resilience and how can we map its contributing disciplines? Pursuing this work will begin to provide a structured and systematic approach that organisations may tailor to their own needs to ensure resilience is being fostered across their systems and processes. Such an approach or tool or benchmark can only serve to improve and help organisations become stronger and more resilient in todays world of closelyintegratedthreatsandrisks. Itisinterestingalsotonotethatworkiscurrentlyunderwayandhasbeenforsometime to establish an ISO 22323 Standard for Organisational Resilience, and that there is also an ASISOperationalResilienceStandardSPC.1.2009inplaceintheUSA.Thesubjecthasbeen, andisbeing,approachedfromavarietyofdirectionsandaspectsandfurtherdevelopment here should aim to support and add clarity by delivering clear views from the key communitiessuchasthemembershipoftheBCI. AttachedtothispaperistheopportunityforcommentintheBCIsurvey (https://www.surveymonkey.com/s/OrganisationalResilience2012)inordertodevelopa furtherviewofhowtheusercommunityseesthesemattersbeingtakenforwardandwhere theyperceivethebestuseofefforttobeapplied.Inthisway,furtherworkcanbefocused onthoseareaswhichaddbestvaluetothosewhoneedit.

15