Goffin K, Hopkin P, Szwejczewski M, Kutsch E (2014) Roads to resilience: Building dynamic approaches to risk to achieve future success.

1. Rationale for the research
In complex and changing business environments, one of the key questions
that boards should ask themselves is:“What can we do to ensure the future
success of our organisation against the growing array of risks?” To answer
this question, new research, conducted by Cranfield School of Management
together with Airmic, looked at eight leading organisations that constantly
have to deal with complexity and uncertainty, but have created a culture
and systems to protect their business, brand and reputation, and thereby
achieve a greater level of organisational resilience.
The new research described in this report generated detailed insights by
conducting primary case study research3. The ways in which risk is managed in
ordertoachievegreaterresiliencewasinvestigatedat:AIG,Drax,InterContinental
Hotels Group (IHG), Jaguar Land Rover, Olympic Delivery Authority (ODA), The
Technology Partnership (TTP), Virgin Atlantic and Zurich Insurance. The research
foundthattheseorganisationsgofarbeyondwhatwouldberegardedastraditional
risk management.They recognise that volatile business environments require an
original and dynamic approach to risk management. These organisations were
selected for study because they were willing to discuss the actions they had taken
to develop and enhance their approach to risk management.
Principles of resiliance
The five principles of resilience are difficult to achieve. Each one is essential
forachievingresilience,asnooneofthemismoreimportantthantheothers,
nor can any of them be ignored.
1. Resilient organisations have exceptional risk radar. Risk radar helps an
organisation identify issues before they develop into major incidents, it gives
an early warning, and helps risks to be considered in aggregate and different
types of risk information to be collated. This is achieved by ensuring that
everyone in the organisation is aware of the importance of risk and the need
for vigilance, in relation to strategy, tactics and operations. No one individual
and no single function (such as the risk management department) can be as
effective at detecting risks as an organisation with high involvement.
2. Resilient organisations have resources and assets that are flexible and
diversified. They establish clear operational risk appetite positions and then
identify potential weaknesses through scenario analyses and stress-testing
of strategy, tactics and operations. They use the diversity of resources to
reduce risk and develop the necessary skills for risk management, throughout
the organisation and beyond. This could include avoiding single points of
failure, reducing dependence on single critical resources, including suppliers,
markets, brands, products, investors, knowledge and customers. Resilient
organisations are aware of intangible assets such as reputation and develop
proactive strategies to manage these assets.
3. Resilientorganisationsvalueandbuildstrongrelationshipsandnetworks.
Resilientorganisationsdonotjustmanageriskwithintheirownorganisational
boundaries. They proactively manage risk throughout their networks of
customers, suppliers, contractors and business partners. A customer-centric
approach is crucial, as it shapes the way all types of relationships are formed.
Openness with all stakeholders engenders trust and loyalty, as well as a desire
to collaborate and share information. This means that when adversity hits an
organisation, all stakeholders communicate with each other.
4. Resilient organisations have the capability to ensure decisive and rapid
response. A key characteristic of rapid response is that an organisation not
only has defined processes for dealing with predictable risks, but (perhaps
moreimportantly)alsotheabilitytorespondtoandcopewiththeunexpected.
To achieve this, employees have the skills, structures, motivation and
empowerment to respond appropriately. They are able to respond swiftly to
an incident to ensure that it does not escalate into a crisis or disaster and to
restore the organisation to a (perhaps new) normal as quickly as possible.
5. Resilient organisations review and adapt to changes and adverse events.
Risk management procedures and staff training are always being tested,
refined and enhanced. This results in employees being self-critical and willing
toopenlyadmitmistakesandreportnear-missincidentsintheknowledgethat
thisopennesswillstrengthentheresilienceoftheorganisation.Everypotential
adverse event or circumstance is identified, analysed and evaluated, so that
lessons are learned and improvements made to strategy, tactics, processes
and capabilities.
The four business enablers
These resilience principles do not just happen; they reflect the fact that
companies have nurtured a resilient environment through: people and
culture; business structure; strategy, tactics and operations and leadership
and governance. This report refers to these organisational qualities as
‘business enablers’. Whilst all organisations have these enablers, in some
organisations,theyarebetterdevelopedthaninothers.Aswitheveryaspect
of resilience, the board must take responsibility and provide leadership by
setting the tone from the top, such that each business enabler supports the
resilience agenda.
The findings of the research are captured in Figure shown opposite. Achieving
increased resilience delivers benefits and these enhanced capabilities are shown
as proactive ‘prevent, protect and prepare’ and reactive ‘respond, recover and
review’outcomes.Theresearchfoundthatresilientorganisationsarecharacterised
by having the five resilience principles in place in a way that enhances the four
business enablers.
Elmar Kutsch Dipl Kauf (FH) MBA PhD PgCAP APMP
Deputy Director: Executive two-year MSc Programme
and Project Management
Marek Szwejczewski BA (Hons) DipM MSc MSc PhD
Professor of Operations Strategy
Paul Hopkin BSc Cert Ed FIIRSM FIRM
Technical Director, Airmic
Keith Goffin BSc MSc PhD
Professor of Innovation and New
Product Development