Women in Resilience Spotlight: Hafsa Limalia
This week we are shining a spotlight on Hafsa Limalia from South Africa. Hafsa is an experienced senior manager with a demonstrated history working across multiple industries, including financial services, healthcare and retail industries. Skilled in business resilience, enterprise risk management, IT risk management, IT governance and internal audit.
What brought you into the industry?
During my early career days as an IT risk and governance professional, I would often review and assess business continuity and disaster recovery programmes. The concept of resilience was always intriguing to me because as much as it was a grudge purchase, it was the first thing companies looked for when things went wrong, only to realise that they had under-invested. As a consultant, there was only so much advice that I could offer; and this was often put on the back burner because of cost realisation in the short term.
Later on in my career when I got an opportunity to roll out a BCM programme end to end, I jumped at it, eager to roll up my sleeves and do things properly. Since then, I have never looked back! The resilience landscape is ever changing – threats that faced organisations change every year – every few months even! So every day the job issues new challenges and that is exciting.
How did you reach your current position? What challenges did you face?
Resilience is a niche market – and with it being so topical, for each of my job hops, I have been head-hunted. But I would like to believe that my tenacious nature, willingness to work with both IT and business and bridge the divide, and ability to embed resilience into strategy is what my reputation is built on. The industry is also very small, so when you get things right, people talk.
That does not mean that I have not faced challenges.
The biggest challenge that I have had to face was people-based; i.e. how do you change mind-sets especially as a new kid on the block. This continues to be something that I work on. Every day there are stakeholders that I need to influence and persuade, and often, just knowing that what I am doing is right, is not enough. Raising awareness, buy-in and more importantly taking people on the journey with me is important particularly as the programme evolves.
Another people-orientated challenge is how to keep people engaged when there are no disasters playing out. It’s hard to be the voice of negativity (which I think is pragmatism!) in a world where nothing is going wrong. We have all heard the “It has never happened before This will stand any individual in high stead in any future career path. – no way will it happen now…”. I think it’s important to keep asking the questions, no matter the push back I get; and assessing and presenting the risks, even when some stakeholders do not buy in.
A further challenge is bringing IT and business together and understanding that we represent Business’ interests when we negotiate system resilience with IT; and also, that we represent IT’s interests when we challenge the business. I am fortunate to have some IT experience, but where resilience professionals don’t, we need to skill up to remain relevant particularly in a world where cloud and robotic technology will potentially add big advantageous and or hindrances on the resilience playing field.
Which specific skills do you think are needed to become a leader in your field?
There are a couple of things I think are required:
Tenacity: Be tenacious. Keep asking the difficult questions, keep knocking on the door, keep assessing and playing back the risk. Eventually someone will listen.
Agility: as the business model changes, so too must the resilience programme. And to do this the resilience team needs to recognise the changes before they materialise and get senior leadership to endorse changes in the resilience programme.
Great networking and people skills: In my view, resilience is more about people than process and technology. If you have a good network in your organisation, people will invite you to the key meetings, and you will be proactive in your approach. The better your networking and people skills, the better you can negotiate, persuade and influence the business to embed resilience. Also, don’t forget that as a resilience professional you need to be change advocates for enhancements of your programme.
Communications: As resilience professionals, we are unique in that we need to communicate across various hierarchies within the organisation. It is imperative that we know our audience and communicate accordingly. The ability to articulate the risk in business terms, for example, can make or break buy-in for a resilience programme. Likewise, getting operational teams to execute on tasks could be an up-hill battle if communications is not managed properly.
Do you think that the BCI WiR initiative will influence our industry? If yes, how?
Absolutely! Great outcomes are achieved with the start of what seems small. I think the WiR initiative recognises that there is great talent amongst the female demographic of resilience professionals and aims at highlighting and showcasing these. While gender should not be a marker for greatness, we have to recognise that currently, there is a problem in that the ratio of male to female leaders in resilience is heavily skewed. By giving women a platform, I think this initiative will get more traction for showcasing talent and achievements of women; and hopefully will speak to other young women who want to join the profession. Furthermore, I think that this initiative makes the female resilience community closer, putting young professionals in touch with female role models and mentors globally. It’s great for sharing (ideas, war stories, etc), insights and can I think be used as an innovation platform too.
What changes would you like to see in the profession?
Personally I would like to see resilience as a permanent seat at the table when strategy is being discussed, instead of something we constantly have to retrofit. It’s easier to ensure that what the resilience team builds today, remains fit-for-purpose in a 2022 world.
Furthermore, I would like to see more insights on how we leverage on “disruptive” tech and processes (e.g. robotics) to enhance resilience capabilities.
Moreover, I would like to see a change in the language that resilience professionals use. I often hear the “us, we” as resilience and “them, they” as business or IT. In my view: WE ARE THE BUSINESS! And unless we have a change of attitude, the rest of the business will always view us as a fringe service that they are forced to adopt, or as another tick-box they need to comply with. We need to do things because it makes business better, and compliance with legislation should be a bonus – not a driver.
In your opinion, why should more people be joining the resilience community?
Resilience is topical right now. There is an increased focus on the need for resilience globally. The top-level buy in is at its highest in my opinion. It is an exciting time to join the profession and we are certainly not spoilt of choice in types of crises/disasters!
As a resilience professional, a person develops inter-personal skills, both internal to the organisation and also with the broader resilience community; in depth understanding of the business and how it operates; coordination skills when trying to bring together multiple parties; a working knowledge of IT and how it sustains the organisations and also risk management skills. The skills that being a resilience professional affords a person can be applied in any future career, and will stand any individual in high stead.