Resilience is a journey, not a destination. No organization can truly state that it has achieved 100% resilience. This is partly because the external environment is always changing, and partly because there is always the potential for a Black Swan event to disrupt assumptions and overwhelm even the most mature resilience programs.
If an organization cannot expect to be perfectly resilient, it follows that leadership must decide how resilient they want to be, and what level of residual vulnerability they are willing to tolerate. This is where the concept of appetite could come into play. Appetite is a well-established concept when it comes to risk but is not often discussed when it comes to resilience.
Risk and resilience appetite
Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives. It reflects the organization’s strategic goals, values, and capacity to manage risk. A clearly defined risk appetite helps guide decision-making by setting boundaries for acceptable risk-taking. It ensures that risks are taken within limits that align with the organization’s ability to absorb potential losses without threatening its stability or success. Risk appetite varies across sectors and may differ for specific activities or projects, allowing organizations to balance opportunities with potential threats while maintaining control.
If you substitute the word risk for resilience, clear synergies emerge:
- Resilience appetite is the amount and type of resilience an organization desires to achieve.
- Resilience appetite reflects the organization’s strategic goals, values, and capacity to develop resilience.
- A clearly defined resilience appetite provides strategic clarity on the importance of resilience, guiding decisions about budgets, resources, and expected outcomes from resilience programs.
- Resilience appetite keeps resilience programs within organizational limits. While underspending on resilience is more common, it is also possible to overspend, throwing more and more money at trying to prevent things happening rather than accepting that they will, and adapting accordingly. Resilience appetite helps set clearer limits and boundaries to what is necessary and appropriate.
- Resilience appetite will vary by sector, organization size, regulatory environment, and market expectations.
Defining your resilience appetite
Developing a resilience appetite would need to be a strategic process requiring alignment with the organization’s objectives, values, and existing risk appetite. It would be led by executive leadership and approved by the board but would also require input from various levels and functions within the organization. Developing a realistic and comprehensive resilience appetite statement would need to be a cross-functional and collaborative engagement process to ensure that it not only reflects the organizational reality but helps gain organizational buy-in. Otherwise, it would probably be viewed as yet another consultancy-driven policy imposed from the top.
Key steps in defining resilience appetite could include:
- Assessing impact tolerances: understanding the maximum level of disruption the organization can withstand before intolerable harm is caused to customers, stakeholders, or the organization itself. These tolerances would set the upper boundary of resilience appetite.
- Aligning with strategic priorities: ensuring that the desired level of resilience supports the organization’s mission, customer commitments, and regulatory obligations.
- Embedding into decision-making: resilience appetite would help guide investment decisions, program design, and prioritization.
- Transposing into operations: resilience appetite would typically be expressed in general statements such as high, moderate, and low. While this is acceptable from a strategic perspective, it is important to recognise that this is only the start of the resilience process. The organization’s operational leadership and teams would need to determine what it means in practice, and this understanding would then need to be approved by strategic leadership.
Could defining a resilience appetite help organizations make more balanced, transparent, and sustainable resilience decisions, avoiding the traps of both complacency and overprotection? It seems to make sense as a natural counterpart to risk appetite: where risk appetite sets direction for risk management, resilience appetite can provide a compass for the resilience journey. It may well be that many organizations wouldn’t want to go as far as developing a formal resilience appetite statement – but just having the conversation about what resilience appetite might look like for various aspects of the organization could bring benefits.
The author
David Honour is editor of Resilience Forward.
