Roads to Resilience

Business structure

Strategy, tactics and operations

Structures need to support the capability to respond rapidly. One aspect of this is that understanding and responding to risk is, by its nature, a cross-functional task. At AIG, there was previously a silo mentality: “There was minimal corporate infrastructure and so the ability to look horizontally across the business was weak” (Chief Risk Officer and Head of Strategy for the Property Casualty Business , AIG). Senior managers now take a more horizontal view and the risk management function looks across the business more than it did in the past. Within Drax, there is a reliance on a functional structure and expertise, but at the same time, “we always aim to do things cross-functionally so the teams that are assembled are drawn from the various functions within the business … the production side and the finance, procurement, fuel purchasing, logistics so there’s a team assembled that is truly cross-functional” (Engineering and Safety Manager, Drax). Working in parallel with the functional structure is a strong system of risk management committees in every area of the three businesses and regular risk management meetings. Another example of internal liaison in Drax is “meetings where we look at major tasks that we’re going to perform and we get key people together, we’ve got a technical risk steering committee” (Generation Manager, Drax). It is seen as essential that different functions come together to assess different types of risk. In addition, rapid response needs to be co-ordinated with external organisations such as the fire brigade. This demonstrates that a rapid response capability also depends on another principle of resilience, relationships and networks . There was also evidence that the business structure enabler within several case study organisations recognises the importance of rapid response specifically designed to protect the reputation of the organisation. The Olympic Delivery Agency (ODA) produced a strategic risk register for central government, comprising around 200 headline risks, from problems with abnormal weather to major terrorist attacks. The sheer range and level of these risks presented a major challenge and not everything could be predicted: “Could the Olympic Park be 100 per cent resilient to all these 200 risks? No, it couldn’t possibly be. But could you plan for some of them? Yes, you could” (Chief Risk Officer, ODA). Critically, the ODA worked with government to develop planned responses to identified risks, knowing that this would also make the whole Olympic programme more able to respond to any unexpected issues that might arise.

It is important to note that no organisation can predict every possible problem. It is important to have the flexibility to respond as effectively to an unexpected situation as one that has been foreseen. This means having enough resource and management capacity to respond whilst still managing the day-to-day business. Under comparatively stable conditions, risks can be identified and predicted, and so an effective response can be planned in advance. As business conditions become more volatile, a more flexible response capability becomes essential. Many organisations do not fully appreciate the risks that are associated with corporate strategies and major programmes. This can lead to a focus on operational risks, so that the risks associated with business strategy are overlooked. Operational incidents can have significant strategic implications, especially if that incident or set of circumstances has wider brand or reputational implications. This has become more obvious as the impact of social media has increased. Resilient organisations recognise that responding to adverse circumstances is not just about operational recovery or continuity – protection of reputation should be paramount. At Virgin Atlantic, all the people involved in both operational and strategic decision-making go through a common risk management training programme, so that everyone works with one concept of risk: “We have made the commitment to use risk management in the decisions we make. So, rather than waiting for bad events to happen and learning from them, we try to think what could happen in a particular context, for example, when we consider flying to new destinations and what it is that we can do to ensure a safe and secure operation for our crew and passengers in that context. We want it to be uneventful and almost boring, because that means everything is working for us” (General Manager Corporate Safety and Security, Virgin Atlantic). To ensure that hotels, guests, people and assets are safe and the reputation of its brands is protected, IHG provides hotel owners, staff, contractors and business partners with a systematic framework to follow, with related processes and checklists for many situations. “When you’re managing a risk, go through a process. Although this framework is shown in the context of managing safety risks, the risk management activities apply to all risk types and these steps form the basis of many risk-based programmes at IHG” (SVP Head of Global Risk Management, IHG). The range and scale of risks is broad; from ‘Guest Safety’ to ‘Crisis and Incident’ . For example, when “Tahir Square [the Arab Spring in Egypt] broke out, we were in the centre of the storm, so we immediately went into our crisis

53

Roads to Resilience: Building dynamic approaches to risk to achieve future success