Leading Resilient Organizations

Resilience Insights Series: Part 3

Building resilience in a time of uncertainty does not happen magically. It requires the ability to gather and integrate many different types of information, and then use that information in a purposeful and consistent way to make decisions. This must then be translated into clear mandates from company leadership and straightforward directives around how to turn mandates into action. This article presents several indications of companies taking proactive steps to understand and manage risk. 

Early leaders in the Resilience Module all report board-level oversight on resilience issues. This is an important place to start. Physical, transition, and social risk issues should become standing agenda items for quarterly board meetings to keep board members informed and engaged about issues as they emerge and change. Substantial discussions should educate the board sufficiently so that they can make decisions and give directives about how to handle disruptive change before it occurs, in real time during events, and in times of response and recovery. This should include the results of risk analysis conducted at different scales to address a range of critical questions, from portfolio to asset level.

Beyond a board providing top-down leadership, companies need an accountable individual or team tasked with carrying out a comprehensive risk and resilience strategy throughout the organization. In some companies, this person might be the same as the person who leads sustainability and other ESG issues. In others, this function could lie within a risk management, emergency management, or other related department. The exact department and background matters less than that the person in charge is empowered to access information and provide direction across all parts of the company.

The most effective approach is often to have a designated leader who reports directly to the board or CEO. This person (perhaps a chief resilience officer) should have an appropriate team to support their full set of responsibilities. In addition, each department should have a designated person responsible for managing risk and resilience in that department (including new acquisitions, property management, investment strategy, risk management, IT, and HR). These representatives can form a team that meets regularly to facilitate information sharing and collaboration. 

Leaders can be highly effective if they have the ear of the board and other key decision-makers. However, it is too often the case that leadership positions around resilience are relegated to advisory roles, with no direct operational control. Ideally, senior leadership positions should have aligned responsibility and authority. Additionally, job performance and compensation should be tied to meeting resilience-related metrics and targets, not just for the resilience leader but for all staff with related responsibilities. 

Leadership on resilience often does not start at the highest levels. For many companies, the work springs from bottom-up or middle-out initiatives by staff that begin with collecting information and developing practices around climate and other issues. Such initiatives can be transformative and should be met with support and encouragement from the board and company leadership. Eventually, for companies to successfully build resilience, strong commitment and continued leadership from the top is needed.

For companies that have direct operational control of their assets and to whom long-term operational performance is a key priority, the need for active leadership around risk management and resilience strategies is clear. Investors should look for companies that have strong leadership in place, including evidence that substantial conversations around risk and resilience are not only occurring, but also resulting in subsequent action. But even companies with little operational control at the asset level require leadership to direct investment strategy in ways that minimize risk and add value in normal times as well as times of disruption. 

Company leaders should be translating their priorities around risk and resilience into clear vision and policy statements that provide direction for the entire organization. A company-wide strategy can then be integrated into all departments to ensure alignment. For companies with high levels of operational control, this can translate into action around how individual assets are operated, how investments in mitigation measures can be prioritized and phased, how incidents should be managed, how local partnerships might be established, etc. For companies with little operational control, clearly articulated vision and policy are still important, and should guide overall investment strategy. 

Many organizations have invested in resilience plans. These plans can be highly effective in gathering foundational information into one place, establishing baselines, and articulating priorities. But resilience is not a threshold or state to achieve. Rather, resilience is an ongoing exercise that requires active implementation over time. Policies need to go beyond high-level guidance to inform decision-making in all departments. 

There are international frameworks for incorporating resilience into organizational policy. The BSI Organizational Resilience Framework and ISO 55000 for Asset Management can provide solid foundations for developing and implementing comprehensive policy approaches to climate risk and resilience. 

The way information flows through an organization is another critical element of good resilience practice. Risk analysis should not be relegated to a single department, with reports never reaching decision-makers. Access to the right information required to make specific decisions is a crucial part of systemic resilience, and often one of the weakest links. Silos between departments and barriers between management levels can result in inefficiencies day-to-day and breakdowns during times of disruption. This data should be incorporated directly into enterprise risk management systems. 

Companies should examine the types of information they need across the full value chain of their operations and determine where that information might come from, what format will be most useful, and who needs to receive it. Ensuring effective and timely information sharing and communication across an organization can allow for greater efficiency and the ability to spot emerging risks or opportunities as they emerge. 

While a relatively high percentage of 2020 Resilience Module Participants reported that their organization has a systematic process for communication and review of resilience-related information by the most senior governance body with responsibility for the entity (92% Real Estate, 74% Infrastructure Asset, 79% Infrastructure Fund), the resilience issues that were communicated varied. Of those aggregated participants reporting the existence of such processes, 91% reported periodically about transition risks, 97% about physical risks, and 73% about social risks, illustrating that physical risks are a top priority with regards to communication and review by top management.

Information infrastructure can serve as a central focal point in building organizational resilience. Digital dashboards — such as the one below, built for New York City Transit — with relevant information to support ongoing operations and short- and long-term decision-making can be valuable tools. Information to consider might include attributes and performance of physical assets, variables around risk, or information related to particular initiatives or markets. Such information infrastructure can also support situational awareness during disruptions. 

Real assets, whether commercial buildings or infrastructure, do not exist in isolation. Their viability and performance are intimately tied to their local contexts and communities. They rely on surrounding infrastructure and provide value to local stakeholders. By partnering with local governments, emergency organizations, nonprofits, and other local stakeholders, organizations can plug into local and regional emergency response and resilience measures. Through strategic partnerships and investment in local communities, real estate organizations can become a stabilizing force in local communities, thus increasing underlying asset value. Partnerships need not focus only on emergency management; building relationships, facilitating social cohesion and social equity, and supporting local communities are all part of building resilience. 

Strong relationships and partnerships with local organizations that focus on business continuity and community resilience are an important indicator of organizational resilience. 

The pandemic has exposed many fault lines within our existing systems, including organizations. The organizations that have struggled to adapt to the impact and uncertainty presented by COVID are those with the most traditional, rigid, and hierarchical organizational structures. Siloed leaders have struggled to find a strategic, dynamic approach to responding to COVID. With clear board direction guided by vision and policy, accountable senior leaders, collaboration and clear information flows, and strategic community partnerships, organizations can build agility and continuity before, during, and after disruption.

Arup is currently working with organizations to build adaptive capacity in alignment with ISO and BSI standards. For more information about our hazard analysis, business impact analysis, comprehensive asset management, adaptive capacity and recovery planning services contact Heather Rosenberg or Caroline Field.