Building resilience in a polycrisis world

Start with what matters most

Seeing and responding to risk differently first requires leaders to clearly pinpoint where plausible risks could materialize and do the most damage to key operations and services. This can be tricky if companies have traditionally approached risk in a siloed way. Company leaders should spend time with one another to work through what if? scenarios, with an eye toward highlighting where exactly in the business a problem or failure would be most catastrophic to customers.

For example, at a workshop for a bank’s C-suite leaders, the initial count of “most important” services surfaced more than 350. Further conversations winnowed the list to 34. But the real breakthrough came when the bank’s leaders flipped the question around from what would hurt the company most to what would hurt customers most. This helped the leaders see that the biggest customer pain point was the ability to get cash on demand, and that this mattered more to the business than other considerations.

Now that the executives had their focus—the outcome of getting cash—they could begin looking at all the ways customers do so, including ATMs and the workers who service them, brick-and-mortar banks, and the tech and third parties that help with electronic transfer payments and build resilience across all functions, rather than focusing on individual mechanisms.

Prioritization exercises also help leaders tease out false assumptions. Leaders at a UK housing management company had believed that collecting rents via the company’s app was the key to business continuity. A deeper discussion of priorities showed that paying its suppliers promptly was far more important. The company could withstand late rental payments resulting from an app outage much longer than it could live with disrupted key third-party services like heating and repairs, which tenants would find immediately harmful and which could have legal repercussions for the organization.

For a global hotel chain, several rounds of C-suite debate surfaced eight operations the business relied on most. One in particular—payroll—was worrying, because a disruption here seemed likely to cripple all operations and have an immediate, damaging effect on customer service. Why? In part because the combination of the pandemic and the “great resignation” had empowered workers and raised their expectations. Now, cleaners or other frontline employees whose work (or absence) could seriously affect customers were less likely to tolerate any pay delays and thus much more likely to walk off the job with little or no notice.

More eye-opening still for the hotel executives was fully understanding the complexity of all the processes, systems, people, and vendors that underpinned what was needed to keep payroll running across the globe.

Connect dots, reveal blind spots

Determining which operations and other areas of the business are the most vital—and most vital to customers—requires considerable focus and commitment. The next step, mapping out the relevant processes, handoffs, and dependencies, can be equally challenging. Businesses struggle to do this well because it’s complex and can involve multiple departments and players. It’s not the usual approach in which business continuity is looked at solely within the siloed functions. The way the whole service is delivered, not individual mechanisms, needs to be identified. At that point, the strengthening of the processes involved can be more forensic, because weak areas are identified, and deliver greater resilience. And this sort of planning is time well spent, because it inevitably highlights blind spots and actionable improvement areas.

Though blind spots may lurk anywhere, they often build up where new tech systems have replaced old ones or were patched together on the fly after a merger or acquisition. Poor institutional memory can create unnoticed vulnerabilities, too. For example, an exercise to understand how a manufacturer’s key products are made found that an unassuming, overlooked part of a legacy computer system was at the heart of the production process. The executives recognized that their focus on financial performance had blinded them to the need for more mundane tech upgrades that directly supported operations. Only by getting the team to focus on the entire manufacturing process did the oversight come to light. If the server had failed, 80% of production would have gone down for days.

Blind spots aren’t just tech-related. The international payments system at a large bank remained offline for three days because the one employee who had the password necessary to access the back-end system was on a backcountry hiking trip with no internet coverage. The bank’s IT department had been unaware of the vulnerability and, in any event, had always assumed it could manage workarounds on the fly. The cost for the bank was a dented reputation and regulatory fines. The episode proved a wake-up call: even though international payments were used by nearly all the bank’s customers, no one at the bank had known that the service could fail exactly in this way.

Mistaken assumptions were also an issue at a large financial-services company that discovered flaws in its payments processes—the service that mattered most to customers across all divisions. Company leaders had been confident that manual workarounds would save the day. Each of the company’s six divisions had already codified the contingency processes that would be needed should any part of the system fail. Indeed, the company was legally obligated to stress test this function—and had.

But executives were chagrined to learn later (thankfully during a mapping exercise and not a crisis) that the planned workarounds the divisions had prepared didn’t account for the need to scale them companywide. And that was the blind spot: had the plans been invoked during an emergency, they only would have been able to handle 12 payments a day across all six divisions. And even that might have been optimistic, given that the plans were created in incompatible formats and used wildly different assumptions of how long it would take to recover operations, ranging from 48 hours to a week.

These realizations led to a larger conversation about what it would take to put in place a system that could absorb the impact of a payments failure—whether it was because of an IT problem or a cyberattack, or simply because the people with authority to sign off on payments were missing in action. Which customers could survive without cash, and for how long? Would it be better to help small businesses, which represented less of the company’s revenues but were more vulnerable to payment delays? Or was it better to help larger businesses?

Traditional business continuity planning would focus on recovering business as usual for the whole system, whereas creating resilience flips that assumption to instead ask: how do we recover some degree of operational capacity immediately—and survive a potential catastrophe?

Put it all together

The financial-services company executives were asking the right questions about the right areas of the business. They could have gotten more useful answers by amplifying the team’s human judgment with a tech-enabled boost. Indeed, the best resilience strategies will be underpinned by technology that helps anticipate, simulate, respond to—and learn from—the web of risks and disruptions companies now face.

Nevertheless, there is heavy lifting involved in gathering the data and introducing new tech—and no less so in educating leaders on how to respond. These are often investment decisions that require board and C-suite support, as they involve both time commitments and money.

Tech-powered dashboards can help executives track in real time the different key dependent operations—and prioritize action (see “Making the best of a bad day”). Dashboards also help flag danger signals that require attention, such as missing staff or low cash balances heading into a payment period, and estimate the impact of system failures based on the tolerances set by management. The initial phase of collecting data and building a similar dashboard at the financial-services firm took six months—a significant commitment of resources. Now, if there is a system failure in one part of the payments function, the dashboard will show how many customers are affected and list the actions necessary to recover operations.