Roads to Resilience

Data analysis The data were analysed in three main stages (between which there was some iteration): 1. For each of the case study organisations, the three different types of data were compared to gain an understanding of how each company manages risk. The data from the transcripts and other documents were then collated and summarised as the typically six-page case studies that are given in Appendix A. The case study summaries were deliberately written in a factual style, with the key approaches of the company listed under the emergent headings: people and culture; business structure and strategy, tactics and operations; and leadership and governance . Other than sorting the data into the emergent headings, this stage did not draw conclusions on the individual companies’ practices and so the case studies (technically referred to in the case study methodology as case write-ups) are semi-raw data. 2. Members of the research team then conducted a systematic cross-case analysis, comparing and contrasting the case studies to gain a deeper insight into the different ways that companies achieve resilience. At this stage, the first level of analysis was to identify all of the different approaches to managing p eople and culture; business structure and strategy, tactics and operations; and leadership and governance across the case studies. An example of the output of this analysis is the ‘Summary of the evidence across the case studies’ given in Table B-3. Key examples from the companies’ approaches were selected for the relevant sections of the report. Then, excerpts from the case studies (set out in full in Appendix A) were selected to provide the illustrative boxed extracts given in the text. 3. Key findings from the cross-case analysis were compared to managers’ responses to the semi- structured questionnaire distributed at the workshop held at Cranfield School of Management on 11 July 2013 Limitations of the research 1. The main source of data was the semi-structured interviews, which of course are ‘manager-reported’ views on risk management and resilience. However, where possible, managers’ statements were cross- checked with other interviewees and with other sources of data, such as company internal process documentation. In addition, as multiple interviews could be conducted at different levels of an organisation, this made it possible to verify how risk was managed throughout the organisations visited.

2. The processes used, the approaches taken and examples from the past were described by managers and employees, but it was not possible to observe an organisation reacting ‘live’ to a potential crisis. Recommendations for further research 1. Based on this report, there is a need for a survey 2. This report used interviews, websites and company documents as the main sources of data. Although providing many insights, this approach did not focus on how organisations deal with an actual crisis. Although difficult to achieve, there is a real need for an in-depth longitudinal study of the way in which resilient organisations actively avoid, contain and quickly recover from an actual crisis. To collect the amount of data needed in tracking how a crisis is dealt with in real-time would require an ethnographic approach and unlimited access to internal and external company communications. Only a very forward-looking organisation would be willing to give such access, although capturing data on how a crisis unfolded and how the organisation dealt with it could be an excellent learning opportunity for the organisation studied. 3. Probably the most important area for further research would be to track the progress of a number of companies that had decided to try and achieve resilience. Based on the findings of the current research, it would be insightful to observe how organisations utilise the business enablers to achieve resilience. Particularly interesting for instance would be to observe the changes initiated to create a culture of risk management. Similar to the previous point, ethnographic research would give detailed insights. organisations manage risk and achieve increased resilience, in-depth case studies were conducted. Eight organisations were selected, which were known for their focus on risk management: AIG, Drax, InterContinental Hotels Group (IHG), Jaguar Land Rover, Olympic Delivery Authority (ODA), The Technology Partnership (TTP), Virgin Airlines and Zurich Insurance. The types of data collected included interviews, public domain information on the organisations and confidential internal documents. More than 80 interviews were conducted with managers and staff, leading to more than 1,000 pages of transcripts. Summary of the research methodology To gain the necessary insight into how successful of a wider number of companies to identify their approaches to risk management and resilience.

165

Roads to Resilience: Building dynamic approaches to risk to achieve future success