Perhaps 1st order adaptation using existing plans and resources doesn’t qualify as resilience

This morning I read an excellent post by Ken Simpson about a BCI lecture by Dr Robert Kay of Incept Labs.

The BCI lecture focused on providing more depth and discussion around a recent research report and introducing the idea of organisational resilience to a new audience. The research paper ‘CEO Perspectives on Organisational Resilience’ is exactly that, the result of interviews with over 50 CEOs to explore what resilience means to them, how they think about it and where it falls in their range of priorities.

In Ken’s post about other points raised by Dr Kay, he notes:

While our disruption is within the realm of the risks we have anticipated and the plans we have developed, then the core discipline of execution applies, not the step off into the realms of resilience. Adapting is what you have to do if you don’t have a plan, if the plan doesn’t work, or if you never thought about the risk/disruption that has occurred. Adapting is not following a procedure or pre-detailed plan.

So to explain what this 1st order and 2nd order are all about…

In 2008 Woods and Wreathall use the analogy of how organisations and materials cope with stress and strain to think about organisational resilience as adaptive capacity. They identify two regions, the first – the uniform response region, when an organisation copes using its existing capacity and capabilities; this is 1st order adaptive capacity and I would argue this is also the space of Business Continuity Management (BCM).

The second region, the extra region, occurs when the organisation can no longer cope using its pre-determined plans or business as usual resources, and must innovate and develop new ways of working. This is 2nd order adaptive capacity and Woods and Wreathall argue that only this emergent adaptation can be labelled as resilience.

Reference

Woods, D. D. and Wreathall, J. (2008) Stress-Strain Plots as a Basis for Assessing System Resilience. in Hollnagel, E. et al. (Eds.) Remaining Sensitive to the Possibility of Failure, Vol. 1, pp. 143-158, Padstow: Ashgate

Resilience is a yound field and is difficult to define…

Yes yes, every paper I read starts with the same sentiment. Sometimes they add a bit of the story of the evlolution of resilience, but after what must now be about 8-10 years of organisational resilience research, haven’t we moved on from that yet?

It seems like we are going around in circles because despite all of the definitions and approaches to resilience that have been published, even based on empirical research, none has been widely accepted or adopted. Although many important papers have been published which discuss examples of resilience, we are still scrabbling to find the seminal paper which will set out and define the basic theory of organisational resilience, which all others will acknowledge.

But where does this leave practitioners?….it leaves them with a lot of questions and not many answers! A  friend of mine who recently started reading about resilience, was convinced he was missing something. He could find lots of papers discussing what resilience is, but could not find any that would tell him how to do it. While there are a few that could contribute, I told him that what he was looking for probably didn’t exist yet.

Every academic or practitioner researching resilience seems to start from the beginning. In research, we all understand the need to go back to first principles and examine the concept at its ‘roots’ by when then, after reviewing all of the available resilience literature, why does everyone seem to reject what is already there, and try to define resilience all over again….why isn’t what’s already available good enough, and what are we looking for?

The challenge

To answer this question, over the next few weeks I’ll be blogging to try and identify some criteria for a definition and theory of resilience. Armed with this criteria we should at least be able to recognise a good resilience theory and definition when it comes along, if not be able to create it ourselves. It’s important to recognise that the challenge is not to come up with a theory and definition of resilience, not at this stage, but to develop criteria that tells us what a theory and definition of resilience should include or look like.

The is a challenge for all of us, and if reading this you think you might like to volunteer to write a guest blog on how you think we could identify, recognise or define a theory and definition of organisational resilience then please email amy@stephensonresilience.co.uk

A few of our clients have asked about the questions in our Resilience Measurement Tool and have remarked on how it appears to measure cultural resilience very well, but may not seem to cover more operational areas.

Yes and no

Yes the Resilience Measurement Tool does measure the more cultural aspects of resilience. That is what enables us to get right to the capabilities that actually make organisations resilient, rather than just measuring the extent to which they have the right paperwork.

At the same time, each question in our tool is specifically designed to measure resilience using common every day language. While our questions appear cultural or ‘soft’ we are in fact measuring more operational areas by asking about peoples’ actual experience of these areas. It’s the difference between having a policy in place, and that policy actually being embedded into the organisation’s way of working – it’s culture.

If you’d like to understand this in more detail, feel free to contact us.

One of the questions that we sometimes get asked about resilience, is how is resilience different from disciplines like business continuity, risk management etc?

If you’ve read our other posts you’ll notice that we see resilience as an organisational goal or aim which can be acheived through integrating and balancing those other continuity, risk and crisis disciplines; however we also know that resilience is different. Resilience is an entirely new way to look at your organisation, it has a different approach, a different focus, and different assumptions.

The resilience approach

Resilient organisations approach the problem of disruption differently. They organise their thinking around the idea that there are different resilience strategies for different organisations in different situations. Organisations often assume that resilience is costly, and that it relies on creating redundancy of facilities and inventory through duplication and stock piling. Resilient organisations do not see it this way at all!

The trick is to focus not on the redundancy of materials or facilities, but rather the redundancy of capabilities.

Cavanagh, T. E., Klauber, S. and Luhrs, M. (2010) Bouncing Back: How Companies Approach Resilience. New York: The Conference Board Inc. p6

Redundant capabilities refer to the flexibility to be able to reasign, reallocate and rebalance existing resources so that they meet the needs of the emerging situation. On the face of it this sounds like nothing new, but imagine the level of adaptive capacity, flexibility, innovation and creativity required, imagine the spread and planning of capabilities that goes into providing redundant capabilities. These capabilities also play a role in day to day business, redundant capabilities not only help to manage disruption, but also help to respond more quickly and effectively to market changes – it all links to competitiveness.

Thus, a focus on resilience can improve the firm’s ability to adapt to its strategic environment at all points in the value chain.

Cavanagh, T. E., Klauber, S. and Luhrs, M. (2010) Bouncing Back: How Companies Approach Resilience. New York: The Conference Board Inc. p6

Resilience also relies not on plans and documentation, but on people, and this is because resilience takes whatever other disciplines provide in terms of planning, documentation and preparedness, and internalises it as part of the organisation’s culture. Resilience takes planning, and turns it into capabilities!

The resilience focus

Resilient organisations focus not on specific scenarios, but on impacts and outcomes. It doesn’t matter whether it’s a flood, fire, security breach, fraud etc. what’s important is how will it impact the organisation and what will the outcome be? This is the essence of creating a capabilities-based approach. Resilient organisations realise how important it is, and they focus on adaopting resilience principles such as those outlined by Weick and Sutcliffe (2007):

• Preoccupation with failure
• Reluctance to simplify
• Sensitivity to operations
• Committment to resilience
• Deference to expertise

 Weick, K. E. and Sutcliffe, K. M. (2007) Managing the Unexpected: Resilient Performance in an Age of Uncertainty (2nd Ed.), San Francisco, CA: Jossey-Bass

The assumptions of resilience

Resilient organisations make very few assumptions, however as with any discipline, there are assumptions built into the resilience paradigm.

• Assumption 1 – we want to survive and thrive

While many organisations would like to be very successful and would like to be around for many years, there are those who would rather close their doors in the event of a crisis rather than invest in being resilient. Resilience is not for everyone!

• Assumption 2 – resilient people and resilient organisations are linked

The resilience of an organisation is not always linked, or necessarily determined, by the individual resilience of staff, however link is being studied more closely. As resilience researchers begin to look at the resilience of projects in complex environments and resilient teams, the resilience of individuals and it’s role in creating resilient organisations is also being investigated.

• Assumption 3 – resilience can exist at different scales

We’ve mentioned that you can get resilience individuals, teams, projects and organisations, but the idea of resilience is also applied to other scales. The assumption is that any social, ecological or technical system can exhibit resilience – economies, geographic areas, ecosystems,

The day is finally here and the secret is out!….the Resilience Measurement Tool is available and you can take a sneaky peak at mini version of the tool by clicking here which will give you an idea of what the full version looks and feels like, and we’ll even send you some results!

So what is the Resilience Measurement Tool?

Ah good question…..it’s a web-based tool that enables us to measure and compare your organisation’s resilience. The idea behind the tool is very simple…

As business continuity, resilience, emergency and crisis managers we can often struggle to actually quantify how resilient our organisations are, and also to demonstrate progress or success towards becoming more resilient as a result of our efforts and investment. The Resilience Measurement Tool solves those problems for you.

The tool provides a quantitative measurement of your resilience and clearly identifies your organisation’s resilience strengths and weaknesses. We’re in the process of developing some case studies so that you can see how it works from start to finish (keep your eyes peeled for these in the near future), but you can also see an example of an organisation’s resilience results summary graph here.

In addition to measuring your organisation’s resilience, the tool can also compare it. So, say for example you decide you would like to compare resilience between your office or site in the UK, and another office or site in Switzerland – no problem, we can do that for you! You can also compare resilience between departments or business functions, parts of the organisation with different cultures (common in acquisitions and mergers) etc.

Once we have collected data on your organisation’s resilience we go away and analyse your data and present you with a full customised results report.

So how do you measure resilience then?

We asked ourselves the same thing back in 2007, and since then we have been working through the Resilient Organisations Research Programme at the University of Canterbury in New Zealand to find an answer! The Business Resilience Intelligence Tool is the result of over three years robust research, and we’re continuously working to tweak and improve it.

You can find a research report that summarises the development of the tool on our Publications page. For more information about resilience in general and to answer questions like What is resilience? click on this link.

How is this tool different?

There are a few tools around which measure business continuity or organisational preparedness to some degree, and many of them are very useful as audit tools for programme management. However the Resilience Measurement Tool provides actual data about how resilient your organisation is. Instead of focusing on whether senior managers and continuity professionals have the right intentions and documentation, it measures whether those cultural resilience values have actually been embedded across the organisation.

As many business continuity managers know, embedding plans and strategies into the organisations culture is a critical part of the business continuity lifecycle, but it is also the step which converts documents and plans into real resilience capabilities! The Resilience Measurement Tool enables you to measure, check and demonstrate that.

If you would like to discuss the tool in more detail, get to know us as a company, and find out how the tool might work at your organisation and what it could deliver, give us a ring on +44 1582 227872 or email amy@stephensonresilience.co.uk

Both academics and practitioners in the fields of resilience, continuity, emergency, crisis and disaster management write articles, posts and papers about topics important to their field. Some of the most interesting of these outputs share lessons from previous events, provide case studies, introduce new tools and technologies and share research findings and results.

But where does this important information get published and how can we find it?

I have increasingly seen requests for information from a variety of sources asking this very question…I’ve written, or would like to write, a paper about …. where could I publish it?

The social networks have also provided a simple and effective solution! I have started a list of the publications, websites and places in which we can all publish, search for and find information on resilience and related fields. It can be accessed through the following link, and if you know of any others, please feel free to add them!

http://tiny.cc/extmx

Ooooooo…..I can feel the anticipation and as we’re putting the last few touches to a new service which we will launch over the next few weeks.

You’ll have to keep your eyes and ears peeled for details, but it should be a good opportunity for businesses to take adavantage of a great marriage between business resilience and business intelligence!

Since evidence of the recent security breach at Sony was discovered on 20th April, Sony have hesitated and stumbled over their communications with the Police and their own customers. According to a BBC News report this morning (http://www.bbc.co.uk/news/business-13304551) there is no evidence of personal information or credit card data being misued but Sony has shut down a website displaying some data belonging to American customers. The Sony crisis has now been going on for 20 days, and many customers are still unsure of when the crisis might end!

How long can a crisis last?

Crises come in all shapes and sizes, some are sudden shocks and some seems to accumulate over time; they can be over quickly or can last for a very long time. In 2005 the Buncefield Oil Depot explosion and fire was a crisis which lasted different periods of time for each different party involved; this is quite common and provides a good example of the different perspectives.

For members of the public, the crisis lasted a few days as black smoke billowed out and closed a section of the M1 for a short time. For local residents in the Hemel Hempsted area, property damage, fear and anger lasted for weeks and months as they faced uncertainty about why the depot had exploded and whether it would be rebuilt. For the organisations based at the industrial estate alongside the oil depot, the crisis lasted months as some of them failed and they too faced uncertainty about the future security of the site. For the Hertfordshire Fire & Rescue Service and the Hertfordshire County Council the crisis lasted for many months as the irs continued to burn and the social and planning implications of the event became clearer. For the the fuel companies involved, BP and Total, the crises also continued for many months as hey struggled with the ongoing Government inquirey and restructured their resources. In many ways the crisis has yet to be fully resolved. Although a full report was released about the explosion and fire, when you drive up to the site on Cherry Tree Road it’s a desolate forgotten waste land, cordoned off by temporary fencing.

Other examples are provided by the BP Deepwater Horizon oil spill last year and the recent earthquake and tsunami in Japan, both of which will continue to affect communities and organisations for many years.

How do you know when a crisis is over?

If you talk to some people in the NHS hey would argue that the crisis is never over, they seem to be in constant crisis! However luckily for most organisations this is not the case and most people can distinctly remember the moment when they realised that business as usual rules no longer applied, that the situation has changed and that this was crisis….so how do you know when a crisis is over?

The end of a crisis is usually not as sudden as its beginning. The urgency of meetings and decisions seems to slowly fade, funding that was available is reallocated to more urgent projects, and the executive board don’t seem as interested in crisis updates or planning.

Perhaps the NHS staff in question are right, perhaps we are all always in a state of crisis. Some from smaller organisations have also commented that they are always in a state of crisis, either struggling because they are doing poorly or struggling because things are going so well that they need to keep up and are desperately trying to maintain momentum!

If this is the case then perhaps, as the business world continues to increase in complexity, we need to ask ourselves why our business as usual and crisis methods are different? and whether crisis tools and structures could help during business as usual?

We come across so many questions about resilience ranging from what is resilience to how can resilience protect my bottom line… So we thought it was about time we started an FAQ with frequently asked questions about business resilience and because we have both academic and practitioner experience, if we don’t know the answer, we’ll find it anyone else does! So feel free to have a read and pose any business resilience question you like by clicking on the comment bubble next to the title of the post.

We’ll Start with an Obvious One – What is Resilience?

It’s all about surviving and thriving! Business resilience is an organisation’s ability to identify, plan for and mitigate potential threats and respond adaptively to disruption, even creating opportunities and finding the silver lining from crises. IT disaster recovery alone is not enough!

Resilience is about more than ensuring continuity through disruption or recovering and bouncing back from disaster; resilience is about protecting your bottom line and thriving and bouncing forward to create advantage over less adaptive competitors.

A resilient organization effectively aligns its strategy, operations, management systems, governance structure, and decision-support capabilities so that it can uncover and adjust to continually changing risks, endure disruptions to its primary earnings drivers, and create advantages over less adaptive competitors.

Starr, R. Newfrock, J. and Delurey, M. (2003) Enterprise Resilience: Managing Risk in the Networked Economy, Strategy and Business (30), 2-10

You can think of resilience as un umbrella term which is used to describe the way your business survives and thrives, even when things go wrong. Resilience results from a combination of planning, innovating and training before a crisis, and adapting and innovating and learning during and after a crisis.

Steve Clarke – What constitutes business resilience?

Ok so we have our first question via a group on LinkedIn! Steve Clarke has asked – what constitutes business resilience? Well we have included an answer to the question ‘what is business resilience’ in the original post, but I feel perhaps what constitutes business resilience is a slightly different question, so here’s your answer Steve….

Business resilience is an organisational outcome; it’s a goal which organisations can aim for. Disciplines such as business continuity management, risk management, crisis management, security, IT disaster recovery and high reliability leadership are all tools which organisations can use to help them achieve resilience.

The Resilient Organisations Research Programme (www.resorgs.org.nz) model of organisational resilience suggests that resilience is made up of 2 dimensions (planning and adaptive capacity) which in turn can be measured using 13 indicators. A research report about the development of the model is included on our Publications page.

Sayed Harir Shah – How do you consider the role of risk, policy, safety, HR, disaster recovery and business continuity in business resilience?

 Another question from Sayed Harir Shah on a LinkedIn group who asks,

“I am a disaster risk management consultant and practitioner and for me Resilience is a very wide concept. Regarding Business Resilience, it is interconnect and interdependent mechanism based on legal reform of risk reduction, adaption and implementation of policies and plans, physical, social and economic safety of assets, availability of human and financial resources for developing and designing disaster recovery and business continuity planning. How you consider these aspects in your business resilience concept?”

Thanks for your question Sayed. We think of resilience in a similar way to yourself, business resilience is an organisational goal achieved through the art of integrating resilience disciplines such as business continuity and risk management (see our previous answer to Steve’s question. We consider these resilience disciplines as tools which, when balance in combination can build business resilience. The trick is knowing the strengths of each resilience discipline, being able to combine them successfully, and then continuously readdressing and realigning that balance as the organisation changes.

Sayed Harir Shah – How difficult it is to combine all of these multi-dimension and multi-sectoral functions together to make businesses resilient?

Combining all of the resilience disciplines together to actually build resilience is definitely one of the challenges that we face. It’s different for every business and even within organisations the approach needs to be continuously adjusted and tweaked in relation to changes in the business environment and its risk profile.

To do it we use all of the disciplines and their associated tools as a bit of a pick n’ mix, and then we choose the most appropriate tool for the job. In many ways BCM managers have been doing this for years, but we need to take it further. In practice it’s about integrating your approach right from the start with integrated holistic policies, governance, oversight, evaluation and measurement. After all if the purpose of disciplines such as BCM and risk management is to help build resilience, then their effectiveness can only be judged by the extent to which they achieve that.

We use tools from each discipline to improve organisations’ planning and make them more responsive, adaptive, agile and competitive during ‘business as usual’. Through training and awareness we then transfer the knowledge locked up in documents and management boards into actual capabilities.

Following our instinct

People have increasingly been trying to link resilience to performance in the business world over the last 10 years. Common reasons for trying to find a link between resilience and performance include:

• The need to identify a return on investment (ROI) for resilience
• Gaining and maintaining Board level interest by demonstrating the link
• Identifying additional business as usual benefits of resilience on top of the usual crisis ones
• Recognition of the similarities between definitions of resilience and competitiveness
• ….and of course businesses are always looking for new ways to boost performance

Many business continuity and resilience practitioners are confident that there is a link between resilience and organisational performance, however proving it has remained difficult. In his blog, Ken Simpson discusses a Continuity Magazine article by Rick Cudworth and Chris Apps and agrees that resilience can deliver benefits to day-to-day operations. While this does not specifically address performance, Ken notes,

“They position resilience as something that has to be driven top-down and embedded into the organization, not an extra bolt-on piece. As a result resilience can deliver some benefits for day-to-day operations. I would certainly agree with that view!”

What about evidence?

Until recently evidence for a link between resilience and performance was mainly drawn from personal experience and intuition; however research is now beginning to find quantitative evidence. Researchers at the Resilient Organisations Research Programme have found a measurable link between resilience and cash flow, return on investment and profitability. This makes for very interesting thinking because although they have not yet identified a causal link, they can show that more resilient organisations have better cash flow, return on investment and profitability. It is entirely possible that in these organisations, there is a third factor which affects resilience and performance – I imagine it might be ‘Adaptive Leadership’, the ability of organisational leaders to constantly readdress and adjust the balance and investment between resilience and efficiency.

Resilience and competitiveness

Many popular definitions of organisational resilience include some notions of being more adaptive, flexible and responsive to changing conditions in the business environment. It would seem then that resilience and competitiveness certainly have plenty in common. Dr John Vargo and Dr Erica Seville at the Resilient Organisations Research Programme at the University of Canterbury in New Zealand have provided the table below. It shows the direct similarities in the relationship between resilience and world class competitiveness.

Vargo, J. and Seville, E. (2010) Resilient Organizations: Trying to Thrive When You Are Struggling to Survive, a Paper Presented at the 4th Annual Business Continuity Summit 2010 Resilience over Uncertainty, 24-25th March 2010, Sydney, Australia.