Roads to Resilience

points of success: singular types of customers, products, markets, geographies, investors and suppliers. To spread these risks and drive growth, the sample organisations invest in diversification, aligned with their purpose, where possible. For example, Zurich Insurance’s diversified portfolio of businesses within the insurance industry and its global spread is a key aspect of resilience, reducing its dependence on any particular sector and financial exposure to unpredictable changes in macro-economic conditions. Equally, the organisation’s extensive long-term partnerships or alliances with banks in many countries, as well as affinity groups acting as distributors, give it access to large customer bases without additional fixed costs. Like all insurers, major risks are spread across a number of organisations and also with reinsurers. Trying to compete in the same way, year-on-year is likely to be a recipe for failure. A senior manager summed up the view held by all the case study organisations when he stated, “ If you do business in the same way as you did three years ago, you’re probably doing it wrong ” (SVP Head of Global Risk Management, IHG). Risk professionals need to support their organisation in planning how to respond to changing business environments and emerging risks. To avoid or mitigate the risk of losing customers to more nimble rivals and to seize opportunities to attract new customers, organisations need to generate new, better, or more value-adding offerings to remain resilient. At the same time, political, economic, socio-cultural, technological, environmental, legal 1 and other drivers of change constantly evolve, often at different rates in different parts of the world. This means that organisations must be able to deliver consistently on their promises under a wide range of challenging conditions and adapt their operations constantly to stay in business. In addition, they need to have the capacity to absorb the hits of sudden and unexpected disruptive events. The ability to deliver customer satisfaction in these challenging circumstances underpins an organisation’s reputation, which is its most valuable asset. For the case study organisations, this means that risk management and achieving resilience are tightly integrated with strategy, tactics and operations . This starts with clearly defining their purpose and values. By doing so, these organisations also indicate what they are not about. For example, Drax does not deal with certain types of customer: “ In the SME world there are certain industries 1 Generic business drivers are often identified using the acronym PESTEL for political, economic, socio-cultural, technological, environmental, and legal factors. Strategy, tactics and operations

Business structure The case study organisations have structures and systems to deal with risks and disruptions. For example, Virgin Atlantic has had to deal with a range of security, terrorist and weather-related incidents and is therefore prepared to deal with the consequences: “ ... what we do have a contingency plan for is airspace closure, for whatever reason. Further, we have a two-tier approach. We have an Amber Team that deals with very specific events and a Red Crisis Team that deals with major aircraft accidents. We have never had to activate our Red Team as such, but we do activate the Amber Team for a lot of events. When they are activated, we will go through a set of procedures in terms of accounting for staff, finding out where our aircraft are, making sure people are safe and secure, determining what we are going to say to passengers and the media, and what we need to do to get operations back to normal” (Manager Resilience and Business Continuity, Virgin Atlantic). The role of the IHG Risk Management team is to inculcate appropriate systems and practices in the business. This involves conveying the broad nature of risk, which it views as being about “physical safety, commercial success and emotional trust” (SVP Head of Global Risk Management, IHG). The team has created a comprehensive set of electronic tools, checklists and training materials that can be accessed by all corporate employees and at every hotel. More than 100 different training materials have been prepared, including risk management policies and procedures, checklists, templates, posters, videos, e-learning and access to face-to-face training, which underpin the risk management framework. Investing in risk training plays a vital role in embedding IHG’s risk management capability throughout its business. Such an approach is intended to extend beyond operational concerns to protection of the brands and reputation of an organisation. At TTP, where there are various development projects being run in parallel, the senior management team monitors the overall risk exposure. This is supported by delegation (or empowerment), with the project leaders responsible for identifying and dealing with project risks, but in addition the organisation encourages rapid response ; project and team leaders are expected to recognise and fix problems quickly. As the TTP Chairman commented: “ A simple definition of risk supposes that the magnitude of potential loss and the probability of that loss occurring can be forecast with some confidence. We believe that speed of response to the unexpected is more important than the predictions of a soothsayer. ” To avoid upfront overexposure to known risks, resilient organisations try to limit their dependency on few or single

37

Roads to Resilience: Building dynamic approaches to risk to achieve future success