Sudden, disruptive change can carry a high price tag for business and the threats are perhaps more acute now than at any time since the second world war. Most companies acknowledge this through business continuity and disaster recovery planning.
But the range of possibilities is so great that it is practically impossible to anticipate each of them.
In addition, many businesses only look at dealing with the unexpected in terms of its costs and fail to understand, exploit and measure the benefits it can deliver.
The ability of a business to react positively to sudden change is its "resilience".
It is a broader concept than business continuity. If business continuity is about how to keep going when a foreseeable incident occurs, resilience is about coping with the unexpected and bouncing back.
Many aspects of a business contribute to resilience. It is an expression of a business's character, and in that way relies on "personal" characteristics, including forethought and dynamism.
It has implications for an organisation's people, design, processes, information, systems, and facilities, and is affected by the market and other external influences.
Businesses are placing an increasing emphasis on resilience. Analysts estimate that US corporations spent a combined total of $10bn on developing resilience during 2006, a figure that is predicted to rise to $50bn by 2009. Getting it right can bring substantial benefits.
The Swiss chemical company Sandoz, for instance, was the source of a serious pollution incident in 1986 when its warehouse near Basel caught fire and run-off water from firefighting washed pesticides into the Rhine, turning it red and killing tonnes of fish. Sandoz had a good awareness of its water containment arrangements on site, so it was able to understand the implications of the run-off accident.
Catastrophic contamination of Basel's public water supply was averted. Sandoz took a big hit to its share price, but recovered within four months and went on to form the pharmaceutical giant Novartis.
Research at Oxford University into the impact of sudden change on shareholder value analysed 15 corporate catastrophes and classified affected companies as "recoverers" or "non-recoverers". The average impact on the recoverers' share price after 50 days was a loss of 5 per cent. For non-recoverers, that loss was 11 per cent.
Approaching one year after the event, all the recoverers had increased their share price back to at least pre-event levels. The non-recoverers had, on average, deteriorated further to a loss of 15 per cent. The single most important factor that distinguished the two groups was the pre-event attitude of senior management towards sudden disruption. Resilience starts at the top.
Building resilience into an organisation is a complex challenge. Work is frequently needed in all of the key areas of people, process, technology, infrastructure and information. In many businesses, integration across the different dimensions of resilience generates the most immediate benefit.
To create resilience, a business must establish its corporate baseline, define the blueprint for resilience, diagnose the gaps, and build the missing capabilities.
Even establishing a properly rounded baseline of current resilience can be difficult. The dimensions of resilience to be assessed will start with obvious areas such as business continuity management, disaster recovery, IT security and process control security.
However, the assessment could also involve many broader domains such as organisational culture, market intelligence, identity management, supply chain management, business mission security, risk simulation and management and regulatory compliance.
Baseline assessments of business resilience are revealing in the extent to which they demonstrate corporate bias.
It is far from unusual to find companies with world-class capability in one area of resilience but almost no capability in another.
The different responses of Nokia and a competitor when lightning struck a factory in New Mexico illustrate the point. Both companies relied on the affected plant for supply of microchips for mobile phones. They were told a fire had damaged equipment and disruption would last a week or so.
While the competitor accepted the situation and delayed its response, Nokia sent engineers to investigate the incident. The company assessed the implications differently, secured alternative supplies, quickly redesigned its products to accept other chips and maintained production. The competitor found no alternative source of supply.
Too many organisations view corporate resilience in narrow terms, as merely an IT problem, or as sitting on the list of worries for the security department. In fact, resilience is an issue for the leadership team.
Ultimately, it delivers shareholder value by minimising the negative financial and reputational impacts of unexpected change.
It allows a company to pick itself up and dust itself off in the face of adversity and to get ahead of the competition even when the punches are not raining in.
- Nick Chaffey is head of security consulting at PA Consulting Group
