Rationale for the research

In complex and changing business environments, one of the key questions

that boards should ask themselves is: “What can we do to ensure the future

success of our organisation against the growing array of risks?” To answer

this question, new research, conducted by Cran! eld School of Management

together with Airmic, looked at eight leading organisations that constantly

have to deal with complexity and uncertainty, but have created a culture

and systems to protect their business, brand and reputation, and thereby

achieve a greater level of organisational resilience.

The new research described in this report generated detailed insights by

conducting primary case study research3. The ways in which risk is managed in

order to achieve greater resilience was investigated at: AIG, Drax, InterContinental

Hotels Group (IHG), Jaguar Land Rover, Olympic Delivery Authority (ODA), The

Technology Partnership (TTP), Virgin Atlantic and Zurich Insurance. The research

found that these organisations go far beyond what would be regarded as traditional

risk management. They recognise that volatile business environments require an

original and dynamic approach to risk management. These organisations were

selected for study because they were willing to discuss the actions they had taken

to develop and enhance their approach to risk management.

Principles of resiliance

The ! ve principles of resilience are di" cult to achieve. Each one is essential

for achieving resilience, as no one of them is more important than the others,

nor can any of them be ignored.

1. Resilient organisations have exceptional risk radar. Risk radar helps an

organisation identify issues before they develop into major incidents, it gives

an early warning, and helps risks to be considered in aggregate and di! erent

types of risk information to be collated. This is achieved by ensuring that

everyone in the organisation is aware of the importance of risk and the need

for vigilance, in relation to strategy, tactics and operations. No one individual

and no single function (such as the risk management department) can be as

e! ective at detecting risks as an organisation with high involvement.

2. Resilient organisations have resources and assets that are # exible and

diversi! ed. They establish clear operational risk appetite positions and then

identify potential weaknesses through scenario analyses and stress-testing

of strategy, tactics and operations. They use the diversity of resources to

reduce risk and develop the necessary skills for risk management, throughout

the organisation and beyond. This could include avoiding single points of

failure, reducing dependence on single critical resources, including suppliers,

markets, brands, products, investors, knowledge and customers. Resilient

organisations are aware of intangible assets such as reputation and develop

proactive strategies to manage these assets.

3. Resilient organisations value and build strong relationships and networks.

Resilient organisations do not just manage risk within their own organisational

boundaries. They proactively manage risk throughout their networks of

customers, suppliers, contractors and business partners. A customer-centric

approach is crucial, as it shapes the way all types of relationships are formed.

Openness with all stakeholders engenders trust and loyalty, as well as a desire

to collaborate and share information. This means that when adversity hits an

organisation, all stakeholders communicate with each other.

4. Resilient organisations have the capability to ensure decisive and rapid

response. A key characteristic of rapid response is that an organisation not

only has de" ned processes for dealing with predictable risks, but (perhaps

more importantly) also the ability to respond to and cope with the unexpected.

To achieve this, employees have the skills, structures, motivation and

empowerment to respond appropriately. They are able to respond swiftly to

an incident to ensure that it does not escalate into a crisis or disaster and to

restore the organisation to a (perhaps new) normal as quickly as possible.

5. Resilient organisations review and adapt to changes and adverse events.

Risk management procedures and sta! training are always being tested,

re" ned and enhanced. This results in employees being self-critical and willing

to openly admit mistakes and report near-miss incidents in the knowledge that

this openness will strengthen the resilience of the organisation. Every potential

adverse event or circumstance is identi" ed, analysed and evaluated, so that

lessons are learned and improvements made to strategy, tactics, processes

and capabilities.

The four business enablers

These resilience principles do not just happen; they re# ect the fact that

companies have nurtured a resilient environment through: people and

culture; business structure; strategy, tactics and operations and leadership

and governance. This report refers to these organisational qualities as

‘business enablers’. Whilst all organisations have these enablers, in some

organisations, they are better developed than in others. As with every aspect

of resilience, the board must take responsibility and provide leadership by

setting the tone from the top, such that each business enabler supports the

resilience agenda.

The " ndings of the research are captured in Figure shown opposite. Achieving

increased resilience delivers bene" ts and these enhanced capabilities are shown

as proactive ‘prevent, protect and prepare’ and reactive ‘respond, recover and

review’ outcomes. The research found that resilient organisations are characterised

by having the " ve resilience principles in place in a way that enhances the four

business enablers.

Elmar Kutsch Dipl Kauf (FH) MBA PhD PgCAP APMP

Deputy Director: Executive two-year MSc Programme

and Project Management

Marek Szwejczewski BA (Hons) DipM MSc MSc PhD

Professor of Operations Strategy

Paul Hopkin BSc Cert Ed FIIRSM FIRM

Technical Director, Airmic

Keith Go# n BSc MSc PhD

Professor of Innovation and New

Product Development