Some time ago it was fashionable to see organisations as individuals, or at least to draw comparisons between how organisations and individuals behave. International relations theories, such as constructivism, saw institutions as social entities behaving in social contexts. In management theories, firms were seen as having human-like qualities. Today, this vision has proven more challenging, especially in the US where giving corporations similar rights to those traditionally conferred to individuals has been controversial.
But when it comes to operational resilience, drawing on comparisons between firms and individuals is, I think, helpful. And the analogy brings us back to the fundamental definition of what an organisation is – an entity comprising multiple people united in a common purpose.
Dealing with a firm’s operational resilience is very similar to how we all deal with our individual physical and mental resilience. It’s what we need to prioritise to ensure survival, as a necessary precondition to us being able to pursue our purpose. Whatever your company’s core purpose, it cannot pursue it unless it is operationally resilient.
Like managing your own physical and mental resilience, managing your firm’s operational resilience requires you to focus on several things, often being at the same time the patient and the attending physician.
First, you need to know the fundamental organs and their functions. Some will be common to all firms while others may be fundamental only to some firms, depending on many factors including business models and customer offerings. So, knowing your firm’s fundamental organs and functions means, on the one hand, studying the principles that are common to all firms like a physician reviewing the anatomy manuals and, on the other, analysing oneself as a patient looking to increase their self-awareness. As regulators highlight, knowing your firms’ critical business services and the units which deliver them is crucial.
Secondly, you need to know your firm’s ability to withstand the inevitable stresses and try to constantly increase that resilience, as part of your BAU operations. To achieve this, you need to be able to self-assess as well as periodically review the findings with external specialists (much like you would with your GP for your own resilience). In this context, regulators’ focus on setting impact tolerance levels is right. This will also help you to determine when your firm needs to act as a BAU health-conscious individual and when it needs to switch to operating like an attending physician in full fire-fighting mode for survival.
That is because, a third key step to resilience is to accept that some stresses which test the resilience will inevitably occur, no matter how well you have trained to prevent them. Here, the ability to diagnose and intervene to mitigate contagion quickly is paramount. You need to know which organs you need to protect in which order and which specialist consultants you need to rely on. This can only be achieved if you have in place a clear, pre-set yet flexible continuity plan that sets the parameters of how your firm should act in these circumstances, and a governance structure where it is known who will be responsible for the different tasks.
So, ensuring operational resilience is crucial; this may be a mammoth task, but it is an inescapable one. Schopenhauer once said that for individuals ‘Health is not everything, but everything without Health is nothing’. I’d argue that the equivalent for firms is: ‘Operational Resilience is not everything, but everything without Operational Resilience is nothing’.