Roads to Resilience

Section 1: Introduction to ‘Resilience’

Overview of Section 1

organisation. These business enablers are identified in the research as people and culture ; business structure ; strategy, tactics and operations ; and leadership and governance . A resilient organisation achieves greater stakeholder trust, is more confident in dealing with risk, and has robust controls in place for the anticipated risks, as well as the ability to successfully respond to an unexpected crisis, learn the lessons and emerge stronger.

Rationale for the research In complex and changing business environments, one of the key questions that boards should ask themselves is : “What can we do to ensure the future success of our organisation against the growing array of risks?” To answer this question, new research, conducted by Cranfield School of Management together with Airmic, looked at eight leading organisations that constantly have to deal with complexity and uncertainty, but have created a culture and systems to protect their business, brand and reputation, and thereby achieve a greater level of organisational resilience. A key driver of the new research was the 2011 ‘ Roads to Ruin’ 1 report. Based on information in the public domain, it looked at 18 high-profile crises involving a total of 23 companies. Each crisis left corporate reputations in tatters. The report concluded that the “firms most badly affected had underlying weaknesses that made them especially prone both to crisis and to the crisis escalating into a disaster” 2 . Such organisations were liable to have a risk information ‘glass ceiling’ preventing timely and appropriate risk information being passed to the board, resulting in board risk blindness. The 2011 report painted a picture of organisations struggling to deal with crises. However, the report did not investigate how some organisations achieve high levels of stakeholder loyalty, manage to avoid crises and/or prevent a crisis turning into disaster. Therefore, new and probing research was necessary. The new research described in this report generated detailed insights by conducting primary case study research 3 . The ways in which risk is managed in order to achieve greater resilience was investigated at: AIG, 1 Atkins, D., Fitzsimmons, A., Parsons, C. and Punter, A., ‘ Roads to Ruin’: A Study of Major Risk Events: Their Origins, Impact and Implications, Airmic, 2011. 2 ibid, page 1. 3 For a detailed description of the methodology used for the case studies, refer to Appendix B. ‘Resilience’ is a developing concept that expands the scope of risk management and reflects the increasing need for organisations to protect their reputation and achieve their goals. It is characterised by the five related and inter-dependent principles of risk radar, resources and assets, relationships and networks, rapid response and review and adapt. The research described in this report found that in the case study organisations, each of the resilience principles can be embedded through the ‘business enablers’ of the

Drax, InterContinental Hotels Group (IHG), Jaguar Land Rover, Olympic Delivery Authority (ODA), The Technology Partnership (TTP), Virgin Atlantic and Zurich Insurance. The research found that these organisations go far beyond what would be regarded as traditional risk management. They recognise that volatile business environments require an original and dynamic approach to risk management. These organisations were selected for study because they were willing to discuss the actions they had taken to develop and enhance their approach to risk management. In the eight organisations studied, the traditional tools, techniques and structures of risk management were understood and extensively applied. However, it is clear that these approaches are regarded by management as necessary but not sufficient to achieve the desired level of organisational resilience. Managers perceive risk management to be about protecting and championing the reputation of the organisation and creating resilience. Such organisations are adaptive to change, as they do not just focus on building stronger defence mechanisms. Instead, they build the capability to deal with both the expected and the unexpected, protecting reputation and integrity, while still remaining focused on achieving their business goals. Furthermore, resilient organisations not only develop the ability to quickly identify emerging risks, but they are also better placed to recognise and take advantage of business opportunities – the upside of risk-taking. Risk professionals and the boards of these organisations understand that risk is a strategic and tactical priority, not just an operational one, and are acutely aware that risks reside at every level and in all business decisions. Consequently, boards and senior executives understand that their challenge is to influence the corporate culture and embed risk awareness throughout the organisation. It is clear from the research that the attitude of the board to risk and risk management is a major factor in making resilience possible.

16

Section 1: Introduction to ‘Resilience’