IDENTIFYING AND ENHANCING ORGANIZATIONAL RESILIENCE
Business Resiliency Index Tool©
Our world continues to be impacted by large-scale disaster events. These severe disaster events create impacts, which are shared across many different boundaries (i.e. local, city, regional, and beyond). As a result, organizations are increasingly confronted with various challenges, which have direct impact on their economic and operational stability. Additionally, in an effort to assist individuals and communities challenged with large-scale disaster events, organizations, that are resilient, are in a better position to provide the needed resources and services allowing individuals and communities the ability to plan for, respond to, and recover from disasters. If organizations are not resilient or prepared to respond to disasters, individuals and communities, in turn, will also not be prepared to respond and recover, as a consequence.
In today’s complex global environment, one major challenge is that organizations do not have a comprehensive understanding of their resiliency capabilities nor do they have a formulaic or quantitative understanding of measuring resilience. Without knowledge of their own resilience posture, organizations will continue to be unable to identify resilience strengths and weaknesses and therefore will not prioritize or allocate resources in those needed areas in an attempt to enhance their resilience. To help enable organizations to invest in their resilience, it is important for organizations to be able to identify, quantify, and understand their organizational resilience posture as an area of resilience strength and weakness.
This article highlights ThinkGRC’s Business Resiliency Index Tool©, which was developed to provide the ability for organizations to not only measure their organizational resilience posture, but to also identify resilience strengths and weaknesses as well as learn the required actions to enhance their overall organizational resilience.
Dr. Bernard A Jones, MBCI, CBCP, CORP, ITILv.3 is co-owner and lead researcher at ThinkGRC. Dr. Jones recently completed doctoral research on the subject of organizational resilience at New Jersey City University. His research benchmarked organizational resilience in the state of New Jersey and enhanced a tool, which provides organizations with the ability to determine an organizational resilience score.
Emergencies and large-scale disaster events are becoming more prevalent and more complex in nature with serious implications for individuals, communities, and organizations alike. Just in the last few years alone, the northeastern region of the United States, and specifically New Jersey, suffered through countless severe weather events, with Hurricane Irene and Super Storm Sandy to name a few. To this end, researchers have identified the need for more flexibility regarding both personal and individual resilience as well as organizational resilience. As a result of these recent disaster events, resilience has been required to recover from these disruptive situations, transforming our world into a ‘new normal’. We have learned that, elements like effective decision-making, which is an implicit part of the leadership, is now required more than ever, in ‘pre’ and ‘post’ disaster situations.
Many would agree that complex disruptive disaster events require sound leadership and an ability to effectively address uncertainty. Applying effective decision making to meet the challenges created by emergencies and disasters requires leaders to consider and balance their own thinking with that of others to engage in new approaches to emergency response. As will be presented in this article, sound leadership and decision making are foundational elements within organizational resilience and are two of the more prominent resilience indicators which have come out of research conducted by ThinkGRC in this area.
A few questions to consider:
- Why is business resilience important and why are businesses beginning to now focus more on resilience?
- Is organizational resilience something that can be measured, and therefore possibly improved?
- What is it that makes some organizations able to not only survive, but also thrive in the face of adversity?
The questions above are common questions, which businesses continue to ask, and struggle to answer. As we review major disaster events within recent years, businesses continue to be tested and are required to focus more on their ability to respond and recover. Not only do disaster events seem to occur with an increased frequency, these events seem to be much more impactful as organizations realize their own increasing reliance on resources (i.e. critical infrastructure, key resources, technology, etc.). As we have seen, we can now state with confidence that disaster events are much more complex, given the fact that both the private and public sectors must work together and partner in the response to large-scale disaster events.
Severe weather, while highly visible and publicized, is not the only type of disaster that organizations need to prepare for. Disaster events come in many different forms and are either man-made (i.e. security breaches, terrorism, etc.) or born from nature (i.e. severe weather events). Regardless of the type of disaster, organizations, which devote resources and staff toward resilience and overall disaster preparedness, understand its importance, and are much better equipped for future disaster events. By becoming more resilient, these organizations are demonstrating the need to not only survive but to thrive!
So do businesses understand just how important resilience is? Businesses often struggle to allocate resources to build resilience given the difficulty of demonstrating progress or success. As part of sound business practice, organizations cannot afford to spend money in areas where they are not able to justify the return on investment. So why would an organization spend money on enhancing resilience if there is no ability to benchmark what its current resilience posture is? Additionally, emergency management and business continuity programs continue to get a “raw deal” because both these essential programs have to compete for resources and compete against “profit-driven” activities for which, there are metrics for evaluating whether they have produced financial growth. Organizational resilience focuses on social and cultural factors within businesses, which unfortunately are much more difficult to measure and to link to financial outcomes. One example would be the difficulty of quantifying how the cost of running an emergency exercise affects an organization’s resilience and its bottom line. Organizations must be able to demonstrate progress towards becoming more resilient by quantifying improvements in their resilience, and tracking changes in that measurement over time.
The ThinkGRC Business Resiliency Index provides organizations with the ability to accurately measure resilience as well as determine which social and cultural factors require attention and enhancement, allowing organizations to increase resilience score and posture. In addition, organizations will also learn about areas of resilience strengths and weaknesses, so appropriate resources can then be directed in a more targeted fashion.
Before we discuss why organizational resilience is important, let’s take a moment to provide a definition. As defined in 2014 by the British Standards Institution (BSI), which is a multinational business services provider whose principal activity is the production of standards, Organizational Resilience is defined as “the ability of an organization to anticipate, prepare for, and respond and adapt to incremental change and sudden disruptions in order to survive and prosper.” In recent years, much more focus has emerged around resilience and specifically organizational resilience. But let’s also make clear that this new definition of organizational resilience differs from previous definitions because the focus is now not just on the ability to survive, but more importantly, the ability to prosper. Organizations should not just be content with surviving a disaster but should look to ways to prosper and become better after the disaster. This new model or mindset will help strengthen organizations and better position each before the next disaster event! Lastly it is important to note is that organizational resilience should not just be based on the context of disasters, but more importantly based on adaption in day-to-day business operations as well. ThinkGRC advocates that this should also be the “new normal” for organizations to adapt!
The Importance of Organizational Resilience
Life continues to move ahead and global turbulence is expected. Additionally, competition, instability, and uncertainty are constants in our changing world. We cannot escape this and organizations continue to face an unprecedented and growing number of potential disruptions to the status quo and their best laid strategic plans. As history repeats itself, organizations will continue to fail unless modern risk management and governance models incorporate resilience metrics. To survive and prosper in this new environment of heightened uncertainty and change, organizations must move past traditional risk and governance models and focus instead on organizational resilience. Companies must ensure their business operations and service delivery capacities remain able to perform their primary business functions. Individuals and communities rely on organizations as critical infrastructure and key resource members, therefore organizations play a large role assisting the public at-large in both normal day-to-day times as well as when disaster events unfortunately occur.
A Blueprint to Measure Organizational Resilience
Some industries are inherently more resilient than others, which lead to the discussion of lagging versus leading indicators of resilience. For example, review scales developed to measure the safety climate in high reliability industries note that in recent years, regulators have moved away from lagging indicators towards leading indicators of safety. Lagging indicators are based on retrospective data and, in the context of organizational resilience, would measure how resilient a business has been. One example of this would be looking at an organization’s experience of crises to describe its resilience over the last 5 years, and then using that as a predictor of its resilience for the next 5 years. On the other hand, leading indicators measure observable processes, actions and practices that are thought to contribute to the organization’s resilience. One example of this would be measuring an organization’s ability to communicate across organizational, social and cultural boundaries as a factor, which contributes towards their resilience. In the context of organizational resilience, this is very important because leading indicators can provide businesses with information on their resilience strengths and weaknesses before the next disaster occurs. In a competitive environment, a business that is aware of its resilience strengths and weaknesses is also much more equipped to find opportunities out of a disaster situation.
Born out of previous research, a comprehensive model of relative overall resilience was developed over a 10-year period. The model was then further enhanced through additional research, which updated the model to include two overarching resilience dimensions, three underlying sub-categories and lastly, 13 resilience indicators.
The two overarching resilience dimensions are Adaptive Capacity and Planning. In this context, Adaptive Capacity is defined as an organization’s ability to adapt and is at the heart of its ability to display resilient characteristics. The idea of resilience as adaptive behavior is increasingly being applied to the business environment to help explain how organizations manage the balance between stability and change. Conversely, Planning is defined as the continuous cycle of organizing, training, exercising, evaluating, and taking corrective or preventative action in an effort to ensure effective coordination ahead of a disaster event. Planning also encompasses the act of creating, updating, and validating a disaster ‘plan’.
Researchers at ThinkGRC have updated and enhanced the model and tool to transform the current version for use by organizations. Dr. Bernard A. Jones at ThinkGRC completed a research study to analyze organizational resilience in New Jersey. It is this research that produced ThinkGRC’s Business Resiliency Index Tool©, which provides organizations the ability to identify their organizational resilience score and posture, and can be used in organizations across the globe.
The components of the model and initial survey tool are listed here:
- Overarching Dimensions:
- Adaptive Capacity
- Leadership & Culture
- Change Ready
- Resilience Indicators:
- Minimization of silo mentality
- Capability and capacity of internal resources
- Staff engagement and involvement
- Information and knowledge
- Leadership, management and governance structure
- Innovation and creativity
- Devolved and responsive decision making
- Internal and external situation monitoring and reporting
- Planning strategies
- Participation in exercises
- Proactive posture
- Capability and capacity of external resources
- Recovery priorities
Based on prior organizational resilience research, three sub-categories emerged:
- Leadership & Culture
- Change Ready
On the next few pages, each category is presented along with the underlying resilience leading indicators, which make up each category.
* Resilient Organisations is a trans-disciplinary public good science research organization based at the University of Canterbury.
Leadership & Culture Resilience Indicators defined*:
Leadership: Strong crisis leadership to provide good management and decision making during times of crisis, as well as continuous evaluation of strategies and work programs against organizational goals.
Staff Engagement: The engagement and involvement of staff that understand the link between their own work, the organization’s resilience, and its long-term success. The Staff is empowered and use their skills to solve problems.
Situation Awareness: Staff is encouraged to be vigilant about the organization, its performance and potential problems. The Staff is rewarded for sharing good and bad news about the organization including early warning signals and these are quickly reported to organizational leaders.
Decision Making: Staff has the appropriate authority to make decisions related to their work and authority is clearly delegated to enable a crisis response. Highly skilled Staff is involved, or is able to make, decisions where their specific knowledge adds significant value, or where their involvement will aid implementation.
Innovation and Creativity: Staff is encouraged and rewarded for using their knowledge in novel ways to solve new and existing problems, and for utilizing innovative and creative approaches to developing solutions.
Change Ready Resilience Indicators defined:
Unity of Purpose: An organization wide awareness of what the organization’s priorities would be following a crisis, clearly defined at the organization level, as well as an understanding of the organization’s minimum operating requirements.
Proactive Posture: A strategic and behavioral readiness to respond to early warning signals of change in the organization’s internal and external environment before they escalate into crisis.
Planning Strategies: The development and evaluation of plans and strategies to manage vulnerabilities in relation to the business environment and its stakeholders.
Stress Testing Plans: The participation of staff in simulations or scenarios designed to practice response arrangements and validate plans.
Network Resilience Indicators defined:
Effective Partnerships: An understanding of the relationships and resources the organization might need to access from other organizations during a crisis, and planning and management to ensure this access.
Leveraging Knowledge: Critical information is stored in a number of formats and locations and staffs have access to expert opinions when needed. Roles are shared and staff is trained so that someone will always be able to fill key roles.
Breaking Silos: Minimization of divisive social, cultural and behavioral barriers, which are most often manifested as communication barriers creating disjointed, disconnected and detrimental ways of working.
Internal Resources: The management and mobilization of the organization’s resources to ensure its ability to operate during business as usual, as well as being able to provide the extra capacity required during a crisis.
ThinkGRC Researchers Refine the Index Tool
“Why do organizations need the Business Resiliency Index Tool?”
Why is important to measure business resilience? There is a management maxim, attributed to Peter Drucker that “if you can’t measure it, you can’t manage it.” No matter how much is written on the principles of business resilience, or on the steps to be taken by managers to improve their understanding of risk, or the procedures to provide continuity, there is a need to measure current levels of business resilience and to establish measurable objectives and targets for improved business resilience. In summary, metrics for measuring and evaluating business resilience can contribute to key organizational needs:
- The need to demonstrate progress toward becoming a more resilient business.
- The need for your business to be leading, as opposed to lagging, with regard to the indicators of business resilience.
- The need to link improvements in business resilience with your business’s competitiveness in the marketplace.
- The need to demonstrate a business case for your business resilience investments.
How Can ThinkGRC’s Business Resiliency Index Tool© Help Organizations?
ThinkGRC’s Business Resiliency Index Tool© is a survey instrument which measures the resilience of an organization, allowing it to benchmark against other organizations in the same or related industries. The tool is a self-reporting survey that will identify an organization’s resilience index score. So how can ThinkGRC’s Business Resiliency Index Tool help organizations? Here is small sample on how the tool can help organizations:
ThinkGRC’s Business Resiliency Index Tool©:
- Provides a comprehensive, easy-to-use, self-analysis tool which quickly identifies resilience strengths and weaknesses for any organization.
- Helps support the business case for internal business resilience initiatives with results gathered from the tool along with consultative services provided by ThinkGRC.
- Helps justify any business’s resiliency program to management.
- Allows businesses for the 1st time, the ability to learn about its capacity for business resilience across different resilience indicators.
- Helps identify business resilience strengths and how they can be enhanced and maintained over time.
- Helps identify business resilience weaknesses and areas of improvement.
- Allows businesses the ability to compare with other businesses within its industry and across other industries with regard to resilience.
- Provides businesses the ability to measure and enhance business resilience across a number of different areas within the organization like leadership, situational awareness, decision-making, and internal resources.
What Are ThinkGRC’s Services?
ThinkGRC provides comprehensive turnkey solutions for not only business resiliency but overall governance, risk and compliance processes and systems. Below is a sample of our Business Resiliency service offering. Please visit our Services section or Contact Us for a complete listing of our services and to discuss how we can help.
- Business Resiliency and Root Cause Analysis Program implementation and management.
- Development of structured frameworks to support program objectives.
- Reviews, assessments, research and data gathering to thoroughly understand the current state of your programs.
- Risk Assessments to identify risks, threats and vulnerabilities and prepare recommendations for controls.
- Business Impact Analysis to identify the likely and potential impacts from events on your organization and the criteria that will be used to quantify and qualify such impacts.
- Development of Business Continuity, Response & Communications and Recovery Strategies for your organization’s operations and technology.
- Plan implementation and documentation including the ThinkGRC Business Resiliency or Root Causes Analysis framework and index tools.
- Implementation of Business Resiliency or Root Causes Analysis awareness, training, testing, maintenance and audit program functions.
Putting the Business Resiliency Tool to the Test
With ThinkGRC’s Business Resiliency Index Tool©, a series of questions are included for each resilience indicator. Respondents are asked to indicate how much they agree, or disagree, with the statement on a Likert scale (a five point graduated scale ranging from strongly disagree to strongly agree). An important feature of the Business Resiliency Index Tool© is that it is designed to be both answered by senior managers and staff across an organization, so that an organization-wide view of resilience can be obtained. Lastly, organizations will not only obtain an overall resilience index score, but can also obtain an index score at each resilience indicator level. Organizations can learn their resilience strengths and weaknesses across different areas.
The entire process should only take 5-10 minutes and at the end you will be presented with your Business Resiliency Index score. This score will rank the maturity of your business resiliency program. Learn more and then consult with ThinkGRC for strategies on how to improve your resilience score.
To access the tool, click here:
How ThinkGRC assists with Analysis of the Results
Based on your organization’s Business Resiliency Index score ThinkGRC will provided a comprehensive report which details a number of metrics including overall resilience score, resilience score by overarching dimension, overall score by sub-category, and resilience score by resilience indicator.
A few additional questions to consider:
- Does your company excel at planning but fall short regarding adaptive capacity?
- Does your organization show strong leadership but is also riddled with a prevailing silo mentality?
- Does your organization rank near the top resilience score as compared to others in your industry?
These are just a few of the questions, which can be answered after deploying ThinkGRC’s Business Resiliency Index Tool©.
Based on the analysis of your organization’s resilience scoring, ThinkGRC can provide various approaches to resilience and the associated strategies that we recommend to correct weaknesses and enhance overall resilience. The exact approach and strategy to deploy will of course be contingent on the organization’s resilience score and areas of strengths and weaknesses.
The ability for organizations to continue to operate and provide goods, services, and employment is critical for providing individuals and communities the needed resources both day-to-day and in times of disaster. Organizations are complex webs of people, places, and resources, and they must invest in their resilience. However, given the recurring financial crises and rapidly changing political and business environments, this presents a number of challenges. Challenges include the difficulty of understanding an organization’s resilience before they are tested through crisis and gaps in understanding of the links between organizational resilience and business as usual profitability and competitiveness.
This article highlighted ThinkGRC’s Business Resiliency Index Tool©, which has been developed so organizations can measure their resilience. This provides organizations with information on their resilience strengths and weaknesses so that they can answer questions including how resilient they are and does our level of resilience meet our expectations and those of our stakeholders, and lastly what can we do to improve? The new model of organizational resilience developed through this research operationalized resilience as a function of two factors: adaptive capacity and planning. Given this two-pronged approach, organizations can identify which approach they inherently favor and leverage those strengths while also addressing potential weaknesses.