With many sectors still recovering from the impact of the covid-19 pandemic, implementing a strong resilience framework is a high priority for most organisations. However, while companies strive towards being more resilient, what metrics and mechanisms are they using to check their efforts are paying off?
Our members – forward-thinking risk leaders – are enthusiastically discussing their approaches to building and improving an organisational resilience framework.
However, before being able to test and measure resilience, companies need to decide what the terminology means to them.
Risk managers deviate slightly on this matter. While some consider resilience as their business’s ability to absorb impacts if their most significant risks materialise, others feel it is about a company’s faculty to recover from a serious event, such as a global pandemic.
Our members are also debating whether to favour qualitative or quantitative measures when it comes to resilience.
Although a host of assessments can be made to determine the resilience of an organisation, members admit it is not easy to aggregate all of these measures into a reliable figure or score that they can take to the board.
Despite these challenges, there are members who are using quantitative metrics and innovative techniques to measure resilience too. They’ve been sharing their approaches with other risk leaders during our series of member meetings on building organisational resilience as well as during bespoke network assistance opportunities that we facilitate for members.
All this collaboration feeds into the body of peer-contributed knowledge we’re building for members to enhance their resilience frameworks, covering issues like how to leverage strong leadership and boost organisational resilience plus our Emerging Risk Tool that’s saving members time, money and effort as they carry out horizon scanning.
Members have access to all this better practice guidance currently available on our Intelligence platform, including our latest discussion paper which details the different approaches to testing and measuring resilience. Here we outline an overview of just some of these techniques.
Using simulation exercises to test resilience
Exercising your resilience or business continuity plan through simulation is the only safe way to test it. While this process may take time and require investment, you cannot be sure the plan will work without it.
One risk manager has explained to members how they have undertaken simulation exercises with the executive team to understand how resilient they would be if certain principal risks within their risk universe should materialise.
Further to this, the resilience team looked closely at what the impact of certain scenarios would be on competitors, the market as a whole, and the company’s supply chain.
Implementing a business maturity model
A risk manager from another company outlined how his organisation has brought a team of people together under the banner of security and resilience to launch a programme of work aimed at developing maturity across all business units.
To achieve their goal, the team of subject matter experts has visited key sites across the business to assess their level of resilience through a mix of qualitative and quantitative criteria, which members can read about in detail in our discussion paper.
While the process has been useful in ensuring different parts of the company are moving in the right direction, the next step is to develop a maturity matrix that will allow them to score sites and compare resilience levels between them.
Measuring participation in resilience training
Many companies have introduced e-learning opportunities and resilience forums to develop awareness of resilience and business continuity plans within their organisation.
The extent to which employees participate in e-learning and training opportunities, and the overall understanding of people in the company, is one aspect that can be measured quantitatively.
By paying attention to the level of participation in these training modules and testing if people understand how to enact business continuity processes, should a crisis emerge, risk managers can gauge the preparedness of the company for risk events.
In terms of other quantitative measures, another risk manager highlighted that their company has 25 targets set out for the development of its business continuity plans; they determine how many of those targets have been met and use the percentage to measure their resilience.
You can also measure how many BCPs are in place and being used within the company.
To read the full discussion paper outlining how members are testing and measuring their organisational resilience, as well as gain access to our better practice guidance on organisational resilience, enquire today about membership.
