How to build Operational Resilience: a simple 3 steps guide on how to make the most out of a bad thing

“Only when the tide goes out do you discover who’s been swimming naked”

Warren Buffett’s words were originally a reminder that it’s easy to invest successfully when everything is going up. But they remind us of a broader truth: when things are easy, the quality of an individual or organization is not tested. It is only when things are difficult, when the ‘slings and arrows of outrageous fortune’ come calling, that we discover what that organization is really made of.

How well we deal with external shocks is both a source of competitive advantage and a guarantor of long-term reputation. Organizations that cannot cope with such shocks will not last long, and can cause a lot of harm during their short lifespan. On the other hand, those that are prepared for these shocks, that identify incoming risk early, and that are set up to act effectively and learn from the experience, will succeed.

Collectively, we call these attributes “operational resilience”. The rest of this piece will discuss just how important operational resilience is, and suggest some ways of delivering it within your own organization.

What is operational resilience?

Simply put, a basic operational resilience definition would be: a measure of an organization’s ability to deal with significant disruption successfully. 

The word ‘significant’ in that sentence is, well, significant. All organizations deal with setbacks every day. But it is major events (even if only major to the specific organization) that really put us to the test. In recent times we have been delivered repeated reminders of the regularity with which these events can strike, of course. As I write this piece, war in Ukraine is causing grave supply chain shocks and inflation across the globe. And we have just emerged (if indeed we have) from a global pandemic.

In this context, the operational resilience meaning is the ability to identify, mitigate and learn from risk events: without significant interruption to services, and in particular critical services. 

That last point is worth expanding on. Whilst businesses ultimately exist as for-profit organizations, many of the things they do are critical to a functioning society. If food disappeared from the supermarket shelves, or cash from the ATM, the effects would be catastrophic. 

For this reason operational resilience is of particular concern in financial services, and of course much regulation is designed with the intention of improving performance in this area. But self-interest alone should be reason enough to consider and invest in operational resilience. Now more than ever, being able to survive (and thrive) in choppy waters is all-important. Let’s discuss how to make that happen.

Operational resilience: a very simple ‘how to’ guide

A blog post cannot hope to form the basis of a comprehensive operational resilience program. But it can point you in the right direction. That starts with understanding the constituent parts of the challenge, which essentially break down into three:

• Prepare the organization
• Identify and mitigate threats
• Resolve and learn for the future

The first, the need to prepare the organization, cannot be over-stressed. It is important to understand that operational resilience is more about what is done before any risks or threats emerge, rather than what is done after. These sound practices to strengthen operational resilience might include (but are certainly not limited to) the following:

• Take ownership of the challenge at the highest level of the organization. Operational resilience as a practice succeeds or fails according to buy-in at the top. By indicating that the need to prepare for the unexpected is of critical importance, an organization ensures that responsibility is taken seriously across the board.
• Map the chain of activities that together deliver business outcomes. Being prepared means understanding the complex dependencies and relationships that collectively put product on the shelves. It is necessary to understand precisely what is involved, particularly in delivering critical services, and be clear about the people, teams and third party organizations that together are relied upon to operate effectively.
• Evaluate resilience with scenario planning. A resilient organization is constantly asking itself the question: “what if?” Examine every link in the chain mapped out above and consider what happens when or if it fails. Develop scenarios based on potential external shocks and play them out. This way an organization learns about the consequences of failure and thus learns where to strengthen, or build out alternatives that can be brought online if required.

Taken as a whole, these activities are the single most important thing any organization can do. In the words of Baden-Powell: be prepared.

Identifying and mitigating threats

Being prepared, of course, doesn’t stop bad things happening. When they do, the quality of an organization's response is everything. And here, again, ‘proactive’ is the key word. Operational resilience means scanning the horizon for potential threats, rather than waiting until they are so close that they can neither be avoided nor managed effectively. 

The best analogy is the ultimate act of operational resilience: scanning the solar system and beyond for asteroids and meteors likely to impact earth. We don’t wait until an unmistakable and unpleasant-looking ball of rock appears in the sky. At that point both impact and catastrophe are inevitable. Instead, we systematically scan the heavens for potential threats, identifying them in time to take action if required.

The principle is simple: the sooner we know what is coming, the more effectively we can react and thus the more resilient our organization will be. 

This is the logic behind the development of AYLIEN Radar. As a product, it uses artificial intelligence to scan the world’s media and surface events and risks that may threaten operational performance. As noted above, in this context we are speaking of major events. Whilst we might take awareness of these events to be a given, the key variables are speed and insight. 

Speed is guaranteed by accurately classifying and categorizing a huge volume of media, establishing the real-world entities coverage relates to, and distributing it to analysts tracking those topics within minutes. If a mapping of the organization has indicated a particular dependence on a specific third-party supplier, for example, any relevant news relating to that organization can be surfaced almost instantly. Perhaps even more powerful is the ability to simply detect increased media activity relating to that organization and provide an alert that further investigation may be required.

Meanwhile, the sheer breadth of coverage delivered provides the ability to dive deep, understand competing interpretations and viewpoints, and thus enjoy real insight. Radar aggregates over 90,000 titles, from general to specialist, published all over the world, in multiple languages. Coverage of events is automatically grouped for easy reference, giving an organization everything it needs to make fast decisions.

What those decisions are, and how precisely threats are mitigated most effectively, cannot be covered in any detail here. Every situation is different. In most cases, good scenario planning and mapping, accompanied by early detection, will provide you with the direction you need.

Learning for the future

Any good operational resilience program is built not just to respond to threats and disruptions, but also to learn from them. By doing so, the organization is better prepared again to deal with similar challenges in future.

It is thus important to put in place meaningful processes that enable this learning to take place, and for any actions that emerge from those learnings to be put into practice. Because whilst scenario planning is valuable, there is no substitute to the real world when it comes to learning valuable lessons.

After any event that requires an operational resilience response, conduct a post mortem to understand what happened, why, and where the response succeeded and failed. Ensure that this process does not focus on blame, but on learning lessons and putting the structures in place to prevent it happening again.

In addition, be sure to apply a certain amount of ‘scenario planning’ in this situation as well. What else could have happened in this particular situation, and how would that have influenced further events? Be open and consider as many angles as possible. Last of all, and perhaps most obviously of all, ensure your organizational culture is one that embraces change in the name of operational resilience. Recommendations that are never put into practice are worthless, after all.

To learn more about how AYLIEN's analyst research platform, RADAR, helps analysts discover, investigate, and act on operational risks, get in touch with us here.