Organizational Resilience: what, why, how and how much? Dr Robert MacFarlane Civil Contingencies Secretariat

Transcription

1 Organizational : what, why, how and how much? Dr Robert MacFarlane Civil Contingencies Secretariat EPC, 8 th April 2015

2 National Security and 2

3 3

4 What does look like? 4

5 What is being written about? 5

6 What do we mean when we talk about? Persistence through disruption, damage or change FROM Rooted in an physical sciences view of the world Business continuity Bouncebackability 6

7 Traditional Perspectives on The Rubber Onion Model (Elliott & Johnson, 2010) 7

8 Responding to Mode Shifts? 8

9 The Adaptation Challenge? 9

10 What do we mean when we talk about? Persistence through disruption, damage or change FROM Rooted in an physical sciences view of the world Business continuity Bouncebackability Successful entities deal with and adapt to change TO as continuity and adaptability Bounceforward 10

11 What does good look like? Goldman Sachs, Lower Manhattan, Hurricane Sandy, October

12 What does good look like? It appears to be easier to identify organizations that dramatically fail to demonstrate resilience than quietly do demonstrate resilience 12

13 What does good look like? It appears to be easier to identify organizations that dramatically fail to demonstrate resilience than quietly do demonstrate resilience Why does resilience matter? To organizations: human and physical loss, sullied reputations, crash in value, failure to live up to the things that customers, stakeholders and competitors take for granted about you, takeover or close-down To all of us: risk to life and property, loss of assets, cascading supply-chain and infrastructure failure, loss of credibility and confidence in national institutions, psycho-social impacts To government: resilience as an intrinsic element of national security 13

14 But resilient against what? 14

15 UK National Risk Register Business Planning Assumptions 15

16 Most of these are outside-in risks So, what s missing? 16

17 Most of these are outside-in risks So, what s missing? Board knowledge and skills Risk blindness at most senior levels Defective communication / glass ceilings Risks arising from excessive complexity Risks arising from inappropriate incentives Poor leadership on ethos and culture A wandering moral compass Good, old fashioned over-confidence 17 Source: adapted from AIRMIC (2011) Roads to Ruin

18 : thinking as well as building Hurricane Sandy, 2012 New Jersey Transit NYC Transit 18

19 (Why) Do you want more? 19 Oxford Metrica (2012). The impact of reputation crises on shareholder value

20 horizon scanning quality management change management information security fraud control risk management supply chain Really? But we do all these already financial control health and safety reputation management asset management human resource planning business continuity ICT continuity environmental management facilities management emergency management physical security stakeholder and collaboration management crisis management 20

21 Lots of ideas, disciplines and activities 21

22 : a set of ideas, and activities, that are nested within one another ORGANIZATIONAL RESILIENCE: ability of an organization to anticipate, prepare for, and respond and adapt to incremental change and sudden disruptions in order to survive and prosper 22

23 We ve got absolutely nothing to do with the risk management department, we never speak to them The incident management arrangements are not linked in any way to the crisis management arrangements It ll never happen to me (NIMPOO) We don t do crises everything is swept up by BCM What was the question again? We ve eliminated the risk 23

24 What are the fundamentals of OR? It is a pervasive quality/attribute/ability of an organization It is rooted in a series of capabilities It is not a fixed activity or state More than getting through the bad times Elements of continuity (survive) and adaptability (thrive) Effective leadership is a must, but OR is everyone s business Structure and process required, but soft factors are essential Organizations are embedded within networks, and so is OR 24

25 Is an End in itself? Values (london.gov.uk) Strategy Reputation Value (N Rock, 2007) 25

26 Models and Metaphors for : soft inner, hard shell Wolin & Wolin AIRMIC PwC 26

27 27

28 28

29 29

30 Models and Metaphors for : rolling wheel EPC BS

31 Models and Metaphors for : overarching 31

32 Models and Metaphors for : integration strength Courtesy of Aaron Gracey, Squared Apple 32

33 Models and Metaphors for : DNA 33

34 Models and Metaphors for : process / creativity 34

35 Damian Ortega, Cosmic Thing,

36 Response Recovery Preparation Protection Resistance Reliability Redundancy 36

37 Culture, Attitude, Behaviour and If you have a bunch of people in a room all agreeing with each other then at least one of them isn t thinking (attributed to Eisenhower) 37

38 Culture, Attitude, Behaviour and Winston Churchill s knowledge audit, developed following the fall of Singapore in 1942: Why didn t I know? Why didn t my advisers know? Why wasn t I told? Why didn t I ask? From Boardroom to Storeroom 38

39 Culture, Attitude, Behaviour and R A G B R A G 39 The normalisation of deviance

40 How are we doing? Source: BS

41 How are we doing? People do what you inspect, not what you expect (IBM CEO Lou Gerstner) If you can t measure it, you can t manage it (W. Edwards Deming) Or did he? Deming is often quoted as saying, "You can't manage what you can't measure. Whether this is true or not, he also stated that one of the seven deadly diseases of management is running a company on visible figures alone. 41

42 Operational risk Strategic risk 42

43 How are we doing? Metrics and measures? Maturity models? Benchmarking? Certification? Audit? ROI? Reliability? Validation? Gut feel and intuition? Risk appetite? 43

44 Are these tough, or easy questions to answer? As leaders, do we have a clear vision of where we as an organization should go, and what we should avoid? Does resilience form a part of our Board agenda for regular consideration? Have we established which strategic and operational responsibilities support us to become more resilient? Are we confident that our approach to resilience will stand up to external scrutiny? Are we satisfied that our approach to resilience is truly coherent? Are those responsible for delivering greater organizational resilience empowered to work across boundaries and able to speak to top management easily? 44

45 Recap ORGANIZATIONAL RESILIENCE: ability of an organization to anticipate, prepare for, and respond and adapt to incremental change and sudden disruptions in order to survive and prosper Key issues: Understanding the value that resilience has for your organisation Coherence: resilience as a coming together of ideas, practices, strategic-operational levels, frameworks and ways of working Culture: people make it / break it Persistence: you never get there Validation: a good hard look Challenges: Narrow compliance mindset Overconfidence: we re sorted Flawed assumptions Org Res EQ sum of parts Complete delegation Failure to learn 45

46 Thank you