What is Organizational Resilience?

• 29 Aug 2018

• Blog
• 0

  Comment

Organizational resilience, we all know the term but what do we mean by it?

Introduction to Organizational Resilience

Find out how this collaborative approach can help your organization anticipate risks and respond effectively to threats and opportunities.

The theme for the BCI’s Education Month this year is “Discover Organizational Resilience” and the aim of this post is to look at what we understand by the term. A quick delve into history shows that the term resilience has been around since the 1620’s and comes from the Latin term ‘resilire’ meaning ‘to recoil or rebound’, by the 19^th century it had evolved to include a sense of elasticity[i]. When looking within academic literature, the term resilience has been around in academic use since 1973 when Holling[ii], an ecology scholar, classified two aspects of resilience; the first is Engineering Resilience defined as the time it takes to return to a state of equilibrium. The second is Ecological Resilience defined as the amount of shock a system can absorb before it breaks down. So what does this tell us? Well that the term resilience originally had three major components:

• A movement aspect; in the sense of a forced move away from its steady state, or business as usual processes
• A temporal aspect; in the sense that there is time needed to rebound after an incident
• An elasticity aspect; in the sense that there is a need to stretch and flex in order to absorb the shock

These three elements we see in effective Business Continuity programmes. We see assessments of the risk of a forced move; we see timeframes identified around recovery processes; and we see plans to help the organization adapt during the incident. So if this is the case, then how does ‘continuity’ differ from ‘resilience’? As Bhamra[iii] succinctly puts it:

“Continuity management is essentially returning a business to ‘business as usual’, and nothing more. Resilience… not only enables organizations to continue with business as usual, but also to learn, progress and flourish… which will likely involve transformation.”

In short, business continuity returns us to where we were before an incident but a resilient organization will evolve and grow from the incident.

Now I hear many business continuity professionals shouting that this is what they have been aiming at for years, well now is our chance to take our organizations on this journey with us. By amending our use of terminology, just as it evolved from Disaster Recovery to Business Continuity we need to evolve into talking about a Resilient Organization.

To be a truly resilient organization we need to be able to learn from incidents, exercises and near misses, to create a stronger and more adaptable organization. It is incumbent upon continuity professionals to engage with the organization’s strategy and facilitate these learning processes, not just post-incident (or indeed post-exercise) but throughout the entire business continuity lifecycle. Furthermore, it is incumbent on us to ask the hard questions, such as should a poorly performing product even be recovered?[iv]

As the world evolves around us and the rate of change increases, particularly with the increased adoption of digital based solutions, time waits for no-one. As incidents are equally likely to be long, slow, evolving issues (such as Brexit) as they are the short, sharp, incidents that historically we planned for, it is more important than ever to learn as we go than to wait for the post-incident report.

Returning to business as usual is no longer enough, the ability to learn, adapt and evolve as we go is the core of organizational resilience.

Dr Ruth Massie is a Senior Lecturer in Cyber Governance at Cranfield University. Ruth’s research area is organizational resilience with a primary research focuses on understanding how Board level Directors engage with information, contextualise it, and incorporate it into their decision making. This is particularly in the context of cyber and how Board’s view the complexity, and risk, in relation to their organizations. Her secondary research focus is on tertiary education as a profession.

More on

• Business Continuity
• Resilience/ Organizational Resilience