By Rachael Elliott
The previous article in this series on Resilience Forward focused on the new UK Government Resilience Action Plan. One of the most compelling parts of the Plan for resilience practitioners is the focus on medium- to long-term chronic risks such as climate change, rapid technological change, and an uncertain geopolitical environment.
This article will explore chronic risks from the perspective of business continuity and resilience professionals, providing some insights on how to develop strategies in this area.
Historically, climate change has often been ignored by business continuity and resilience teams due to a lack of interest from management in investing in issues perceived as ‘not likely to happen for a good few years yet’. However, changing weather patterns are causing major incidents to happen more frequently than many are used to. In Europe flood frequency is increasing, heatwaves are putting pressure on people and systems, and wildfires are encroaching on regions that are normally far from zones typically affected. The Australian Institute explains that antipodean seasons are becoming less defined and Australian summers now last for a month longer than they did 50 years ago. Similar phenomena are happening in other regions around the world.
For practitioners, long-term risk is a standard part of business continuity planning, with the DRI Professional Practices considering both short- and long-term risks in Professional Practice 2 (Risk Assessment). However, for the C-suite, long-term risks are often pushed aside to give precedence to shorter-term financial gains.
How should long-term risks be considered by business continuity and resilience professionals?
Short-term thinking in boardrooms has long been endemic in large, publicly listed organizations. The desire to please outspoken shareholders, coupled with pressure to ensure analysts’ quarterly financial expectations are met, means that many senior executives’ thinking is dominated by delivering short-term investor value and strong profitability for the organization. Furthermore, the situation is getting worse: a survey by McKinsey & Company showed that 63 percent of senior executives felt that the pressure to produce short-term results has increased over the past five years.
Unfortunately, business continuity and resilience-orientated areas are frequently seen as cost centres by executives and, coupled with the short-term bias of executive teams, potential funds are instead driven into initiatives that can deliver short-term profitability. With many professionals battling to get the required level of investment into business continuity programmes, how can they go a stage further and gain additional corporate support for longer-term, proactive resilience initiatives? The following strategies may help with this predicament:
1. Show executives that investing in resilience leads to better company performance over the long term
Nothing drives the C-suite more than seeing strong numbers in quarterly financials. Therefore, proving that companies with long-term views do better over time is vital to getting buy-in to move beyond short-termism.
A 2017 report by the McKinsey Global Institute demonstrates this quantifiably: the report used a sample of 615 large- and mid-cap US publicly listed companies and looked at patterns of investment, growth, earnings, quality, and earnings management between 2001 and 2015 to create the five-factor Corporate Horizon Index. The companies defined as having long-term outlooks grew on average 47 percent more than short-term orientated firms, earnings grew by 36 percent more, and economic profitability grew by 81 percent more. While long-term focused companies typically take more of a hit to their market capitalisation than short-term firms during times of crisis (e.g. the 2008 global financial crisis), their share prices recover more quickly post-crisis. Long-term firms also created 12,000 more jobs on average over the study period than other firms.
2. Incorporate long-term risks into strategic planning
Adopting business continuity and resilience planning into strategic planning cycles – rather than solely operational reviews – can help to ensure that business continuity is considered at the highest level when strategic plans are made. Tying long-term risks to enterprise risk management (ERM), board reports, or investment decisions is also wise for executive consideration.
However, to be effective, the risks need to be fully considered at each meeting and not just become an item in a strategic planning review that is rolled over to the next one. Having a supportive advocate on the board is critical in meeting these goals and business continuity and resilience professionals who have a direct reporting line to the Chief Risk Officer (as well as a good relationship with them) note significant success in this area.
Another recent report by McKinsey showed that 84 percent of leaders feel underprepared for the next interruption to their business, while 60 percent think that their company is underprepared for the next event. As resilience professionals, we can tap into this concern and encourage leaders to consider long-term risk.
3. Use case studies
One of the most frequently asked questions by business continuity and resilience professionals is, “Do you have any case studies on this?” Professionals are keen to hear others’ tales on how their organizations have got through crises, or – and this is the more difficult one – examples of failures when a company has not adopted good business continuity practices.
It is no coincidence that case studies are used in educational material for resilience professionals, such as in the DRI’s business continuity course (BCLE 2000), which introduces professionals at the start of their careers to recent and relevant examples of failures when a company lacks a sound business continuity programme. Case studies, when presented to senior management, can showcase what can go wrong without proper investment into long-term risk.
4. Use realistic scenarios to highlight the cascading effects of long-term risks
Crisis simulations that extend to the medium or long term can help to demonstrate the cascading consequences of long-term risks. Many executives experienced significant disruption to their organizations during the COVID-19 pandemic, for example, which opened their eyes to the vulnerability of an organization when faced with a high-impact event they always knew could happen but ignored for whatever reason.
As a result of management’s increased desire for training post-COVID, some organizations have incorporated realistic micro-simulations into their training programmes. This method ensures that time-poor senior executives can take part in exercises that last for only a few minutes but provide them with powerful messaging about the importance of examining long-term risks and how they cascade into acute events.
For example, an organization that may have experienced a flood once every 100 years on average might now find they are having to deal with it every five years, two years, or even multiple times a year. While business continuity plans (and insurance) might be sufficient to get operations up and running within agreed timescales, the cost of multiple recoveries could outweigh the long-term cost of relocating to a new site, or building flood defences around existing buildings. By having this explained through short simulations, executives will not only be better informed on how to react in an incident, but they will also get a relatable demonstration of the cost-saving benefits of long-term investment in resilience.
5. Use relatable language
Senior management are not going to be able to relate readily to technical terminology and abbreviations such as RPOs, RTOs, critical activities, or TTX. However, using terminology and phrases they can relate to will help create more compelling content. Rather than speaking about “How investing in a business continuity programme will make sure we can recover from an impact to the organization”, speak about “Risks to growth”, “Strategic opportunity”, or “Creating shareholder value”.
Executives will have organizational risks that keep them awake at night and drilling into these can help to build a practitioner’s case for additional funding. Using words that align better with executive thinking can help a practitioner’s case for funding.
For example, while the word ‘resilience’ may be seen as overused by some, the term does inspire the move away from reactive to more proactive planning against risks.
6. Use regulation, standards, laws, and acts
While excess regulation might prove a headache for some, for business continuity and resilience professionals, regulations can help to provide a springboard for investment in resilience-orientated activities.
A recent example is new operational resilience regulations that have become mandatory for companies in certain nations (e.g. the Digital Operational Resilience Act (DORA) in Europe, the FCA/PRA/Bank of England regulation in the UK, the CPS230 standard in Australia). Organizations must prove that they have the capabilities to withstand significant shocks to their organization, their customers, and the whole financial market.
Organizations – or individual CEOs – face significant fines for non-compliance, or for falling foul of the regulations. One of the most reported examples of this was when the UK FCA and PRA fined TSB Bank £48.7m for operational risk and governance failings, as well as outsourcing failures relating to the bank’s IT upgrade programme. Customers were ultimately unable to access banking services; and the fine reflected this.
As a result, financial services organizations and their critical suppliers must ensure that their operations meet regulatory standards – demonstrably. To comply, management are having to invest in resilience – both in terms of tools and technology – and additional staff.
For practitioners who do not have the luxury of their organization having to comply with mandatory regulation or meeting the demands of standards, other recognised frameworks (such as ISO 22301, NFPA 1600, or the DRI Professional Practices) can help to justify spending on long-term preparedness – particularly if peers are also following or certifying against certain standards.
Conclusion
Ensuring a steady pipeline of investment in long-term resilience is not going to be easy for practitioners unless they have a management team that understands the importance of proactive investment in risk. However, by keeping the topic on boardroom agendas, highlighting the consequences of failures in other organizations, and consistently showcasing the potential financial harm to organizations without a proactive business continuity programme, practitioners will be able to provide themselves with a fertile ground for investment.
The author
Rachael Elliott is Director of Global Strategy and Innovation for DRI International. Rachael has particular expertise in the technology side of resilience, and has a keen interest in how artificial intelligence can help to transform the resilience of organizations. Her research has been used in the UK Parliament to help develop government industrial strategy as well as in the BDO High Street Sales Tracker, which Elliott was instrumental in developing and is still the UK’s primary barometer for tracking high street sales performance. She maintains a keen interest in competitive intelligence and investigative research techniques.
