Resilience governance: why do board members have a duty to consider resilience?

What is resilience governance?

Resilience governance refers to the board’s responsibility for ensuring that an organisation can continue to achieve its purpose and strategic objectives through disruption – not only by preventing shocks, but by absorbing, adapting, and recovering when disruption occurs.

In Principle 6, Responsible Business, of its Code of Conduct for Directors (2024), the Institute of Directors makes clear that one of the duties of a director is to manage risks so as to maintain longer-term resilience and strategic objectives. It also identifies resilience as one of the seven positive outcomes delivered by adherence to its Principles of Director Conduct.

This understanding is reinforced by the UK Corporate Governance Code (2024), which frames resilience under the broader banner of sustainability and long-term success. Resilience enables organisations to withstand and recover from inevitable disruption and to remain competitive when market-wide shocks occur. Taken together, resilience governance is not merely a board duty. It is a fundamental requirement for sustaining long-term value, competitiveness, reputation, and stakeholder trust.

Resilience governance – key points for boards

• Resilience is a core board responsibility, not an operational function
• It underpins long-term value, competitiveness, reputation, and trust
• Boards govern resilience through strategy, risk, capital allocation, culture, and decision-making
• Resilience becomes critical when controls fail and adaptation is required
• Strong resilience governance also future-proofs boards against evolving regulatory expectations

What is the board responsible for in resilience governance?

As stated above, a company board is accountable for ensuring that the organisation can continue to achieve its purpose and strategic objectives through disruption. Resilience is therefore a core governance duty, not a technical or operational add-on.

Key board responsibilities:

Set direction, intent, and policies for resilience

The board should:

• Define what resilience means for the organisation, in the context of its purpose, strategy, and stakeholders
• Set resilience ambition and appetite, including:
  1. Priorities – what are the critical business services that operational resilience should focus on?
  2. What must not fail – what processes and infrastructure are absolutely essential for maintaining operational resilience priorities?
  3. What overall organisational resilience capabilities does the board wish to prioritise?
  4. What trade-offs is the board willing to accept between resilience, efficiency, cost, and growth
• Ensure resilience is treated as a strategic enabler, not just a risk control or a compliance requirement.
• Understand and agree the escalation points at which protection is no longer sufficient and adaptation strategies must be considered.

Ensure clear accountability and ownership

The board is responsible for:

• Assigning clear executive accountability for resilience.
• Determining whether it wishes to appoint a single executive owner for resilience (e.g. a Chief Resilience Officer) or deliberately distribute accountability across resilience disciplines (such as risk, operations, cyber, people, and business continuity).
• Ensuring that all resilience-related roles and responsibilities are integrated, not siloed.
• Confirming that escalation paths and decision authority in crises are unambiguous, understood, and exercised.

 Embedding resilience

Boards should ensure that resilience is:

• Embedded across:
  1. Business strategy
  2. Risk management
  3. Operational planning and management
  4. Investment decisions and competitive planning
• Properly governed through:
  1. Board and committee structures
  2. Policies, frameworks, and delegations
  3. Alignment with existing governance, assurance, and control frameworks
• Integrated, not fragmented
• Adequately resourced: ensuring that resilience is appropriately resourced and that budgets and resources are sufficient to meet requirements.
• Supported by the capital allocation strategy to ensure that capital is available to fund adaptation requirements. This involves protecting the balance sheet so that the company has the ability to pivot or acquire competitors during a market-wide shock.

Challenge assumptions and stress-test the organisation

The board should:

• Require credible scenario and stress testing, including:
  1. Severe but plausible disruption
  2. Compound and cascading risks
  3. Loss of critical suppliers, people, data, or infrastructure
  4. Wider supply and value chain dependencies
  5. Concentration threats
• Challenge:
  1. Optimism bias
  2. Groupthink
  3. Over-reliance on single points of failure
  4. The realism and assumptions underlying exercise results
  5. “Paper resilience” that has never been tested under pressure

Provide oversight of preparedness for disruption and crisis

Boards should assure themselves that:

• Crisis management arrangements are fit for purpose
• Leadership teams are trained to:
  1. Make decisions with imperfect information
  2. Communicate well under stress
  3. Balance speed with judgement
  4. Escalate to the board at appropriate points
• When appropriate, exercises and simulations include board-level involvement, not just management teams.
• The board understands its own role during a major disruption, including decision rights and communications expectations.
• Emergency governance protocols are in place to enable a board level crisis committee to act quickly and decisively outside of the usual quorum.
• The board has established its own succession plan and its own activities are protected by specific continuity and resilience plans.
• Creeping crises can be identified – slow-moving shifts like demographic changes, climate transition, or eroding brand trust that eventually reach a tipping point. Boards need to be assured that horizon scanning takes place and that it considers non-linear threats and signals.

 Monitor resilience performance and assurance

The board is responsible for:

• Receiving meaningful resilience reporting, not just activity updates
• Ensuring there are:
  1. Leading indicators (early warning)
  2. Lagging indicators (recovery performance)
  3. Independent assurance where appropriate
• Understanding the organisation’s resilience maturity relative to peers and stated ambition.
• Tracking whether resilience capability is improving over time.
• Ensuring that management information enables timely intervention, not just retrospective assurance.
• Independently informed – are information channels available that are independent of the executive? (e.g., Are whistleblowing facilities in place and encouraged? Can internal audit confidentially escalate to the Board?

Shape culture, behaviours, and learning

Boards play a crucial role in:

• Setting the tone from the top on openness, learning, and taking resilience seriously.
• Encouraging:
  1. Speaking up
  2. Honest reporting of weaknesses
  3. Learning from incidents and near-misses
• Ensuring resilience is not undermined by:
  1. Short-termism
  2. Excessive cost-cutting
  3. Perverse incentives

Fulfil external and stakeholder responsibilities

Finally, boards should ensure the organisation meets its:

• Legal, regulatory, and fiduciary duties relating to risk, continuity, and resilience
• Obligations to:
  1. Customers and service users
  2. Employees
  3. Communities
  4. Critical partners
  5. Regulators
  6. Systemic or sector-wide resilience
• Disclosure and assurance expectations where resilience is material

A final thought

Recent corporate governance reform proposals in the UK also included a statutory Resilience Statement requirement, which would have obliged large companies to disclose how they are building and maintaining resilience over the short, medium and long term. Although the Government subsequently withdrew the legislation following industry concerns about reporting burdens, many commentators and practitioners continue to see resilience disclosure as good governance practice, and it remains under active discussion in the context of ongoing Code and reporting reforms. Preparing and embedding robust resilience governance now therefore not only meets current expectations but also future-proofs the board against prospective regulatory developments in this area.

Summary

Resilience governance is a board-level responsibility concerned with ensuring that organisations can continue to deliver critical outcomes through disruption. In the UK, it aligns with directors’ duties, the UK Corporate Governance Code, and expectations around risk management, internal control, sustainability, and long-term value creation.

The author

David Honour is a UK-based organisational resilience specialist with experience serving on and supporting boards. He is editor of Resilience Forward.

Frequently asked questions about resilience governance