Stress Testing for the Future
When Roman engineers completed an arch, the decisive moment came when the wooden scaffolding beneath it was removed and the structure was made to bear its own full weight for the first time. The engineers had to be sure that each arch could carry its own weight, and it was said that they would stand beneath it as the scaffolding came away, willing to stake not just their reputation but their lives on the success of the project. Whether they truly did this is doubtful, but the willingness it describes is exactly what we ask of organizations today.
A stress test removes the comfortable scaffolding that assumes systems will hold, staff will know their roles and suppliers will deliver. It forces an organization to carry the full weight of a severe disruption. Disruption is arriving more often, and more of it at once, and the organizations still standing in ten years will be the ones that chose to stress themselves honestly now, before the future did it for them.
A recent series of stress tests across a large group made one pattern clear, the more mature an organization’s risk management environment, the better it held up under pressure. Continuity did not stand on its own. It rested on the risk thinking beneath it. Two insights from the project stood out, and a third observation followed from both.
Leadership and Culture
Leadership and culture were the most important factor that drove a successful outcome. Where senior management were involved and the team were well versed in their roles and responsibilities, the process was soundly managed from the first emergency through to the resumption of normal business operations. In the strongest environments the teams could recover and resolve issues even when their leaders were absent or “muted” to direct them, because it was the culture, not the reporting line, carrying the work.
Confidence and Its Blind Spots
The participants overestimated their ability to deal with continuity issues, neglecting the key stakeholders, resources, priorities and processes that resumption actually depends on. People all carry built-in biases, and under pressure it is the ones that hinder us that surface first. This is why so many organizations plan for the last crisis rather than the one they have not seen.
The clearest example was recovery time. Many anchored their expectations to the figures vendors had quoted under normal conditions, then stayed optimistic that those figures would hold under stress, when the whole nature of stress is that normal conditions no longer apply. It is our job as risk and resilience professionals to challenge these assumptions and to drive better decision making.
Resilience as an Ecosystem
The challenge inevitably remains the unknown, and the hardest version of it is the compound one. What happens if a key person is unreachable, a supplier is down too, and the outage hits at the worst possible moment? Single failures are the ones we rehearse; the failures that threaten us arrive together. When the leadership team is deeply tuned into its people and its key processes, the operational staff are well trained in emergency procedures, and everyone knows what they need to do to resume operations and then to drive recovery, the intangible becomes tangible. Continuity stops being a plan on a shelf and starts proving its worth. Business interruption losses reduce for insurers, clients receive uninterrupted service, suppliers know how they can support you, and resilience is generated as part of an ecosystem.
A Note for Practitioners on Stress Testing
Do
- Take a recovery action and ask who does it, with what, and by when; a missing answer is a gap.
- Test the numbers, not just the logic. Treat every recovery time and dependency as a claim to prove, not a fact.
- Inject a complication once they settle. Pull a key person or drop a second supplier mid-exercise; surviving one clean failure is not surviving a real event.
- Debrief on what people would change, so they leave more confident and more challenged than they arrived.
- Every gap gets a name and a deadline before anyone leaves, and the retest is booked then.
Don’t
- A scenario that dodges the known weak points rehearses a win. Aim at them instead.
- Don’t let “who caused this” into the room. Once blame appears, honest disclosure stops; redirect “why did you” to “what would help.”
- Don’t reach for the apocalypse. A burst pipe in the primary site on a Monday morning teaches more than a meteor.
- Don’t stop at the debrief. Findings that are not assigned and dated die in the minutes.
To learn more about the Women in Resilience group please visit Women in Resilience | BCI
Claude Hamman is a Foresight and Risk Professional, and wrote this piece for the BCI Women in Resilience group.
More on
About the author
Claudius Hamman
Head: Specialized Risk Advisory
