A practical guide to resilience

Authors: Nathan Spitse and Rick Cudworth

“Resilience” was well on its way to becoming a business buzzword before the COVID-19 pandemic began. As with most buzzwords, it was overused to the point that nobody was really quite sure what it meant; they just knew it was a big deal.

As we stand here today—seeing all of the disruption the pandemic caused—most organizations have learned what resilience truly means. And it means something different to each organization; for example, retailers have different resilience challenges than financial services firms do, and so on.

For organizations doing resilience right, even a once-in-a-century pandemic did not come as a complete surprise; there have been warnings about potential pandemics for years. But such organizations were far and few between. Most had to reinvent themselves on-the-fly in an attempt to maintain some semblance of normal operations. Even some of the organizations with resilience plans already in place found themselves in a predicament, because their planning often focused on the wrong things.

Resilience is about outcomes
Resilience has typically been a siloed discipline in which different departments develop their own plans. Once all departments “check the resilience box,” executives can tell the board that resilience plans are in place, and then it’s up to each department to keep itself functioning when some sort of disruption hits.

This approach is emblematic of the “inside-out” thinking that has defined resilience to date. With inside-out thinking, organizations focus on maintaining existing internal processes rather than taking an “outside-in” approach and focusing on higher-level business outcomes: meeting the needs of customers and other stakeholders. Inside-out thinking strives to restore processes to their normal state; outside-in strives to enable adaptability so that organizations can continue delivering products and services even in times when it is impossible to return to the normal state.

The COVID-19 lockdowns provided a vivid example of this contrast: Inside-out thinking strived to get people back into the office as soon as possible, because that’s how things are supposed to work. But outside-in thinking recognized the requirement to adapt to a work-from-home world so the organization could continue to meet stakeholder needs and expectations.

To define what state-of-the-art resilience looks like, Deloitte jointly commissioned a report with the National Preparedness Commission, in collaboration with Cranfield University, focused on the practices of organizations recognized to have world-leading resilience programs. The Resilience reimagined: A practical guide for organisations report is based on 25 in-depth interviews and four focus groups with leaders of these organizations, and includes additional insights contributed by more than 50 practitioners and academics.

The theme consistently rising to the top in these interviews is that resilience cannot be an inside-out, department-by-department endeavor. Rather, it needs to be outside-in, where planning begins with the fundamental question: What are the possible disruptions to meeting the needs of our stakeholders, and how do we make ourselves resilient to them? In other words, resilience planning focuses on outcomes, not individual inputs.

Truly resilient companies aren’t fixated on having a resilience plan in place; rather, they are resilient by design. They have built their operating models to be inherently adaptable, so resilience is no longer just about recovery—it’s about thriving even when significant disruptions occur.

In the report, we identify seven practices for strengthening resilience:

• Discuss future failure: Many organizations would prefer not to talk about the different roads to failure. However, doing so actually enables forward thinking that can improve decision-making today, so the company is more adaptable and resilient in the future.
• Consider connected impacts: We define “five capitals” in the report (natural, human, social, built, and financial). Understanding how they are interconnected can provide valuable insight into the potential impact of disruption.
• Understand essential outcomes: This gets to the crux of outside-in thinking: Know what is important to your stakeholders and society, and define the essential outcomes that require a high degree of resilience.
• Define impact thresholds for essential outcomes: In addition to defining them, determine how these thresholds apply for each outcome. When a severe event occurs, some impact is inevitable, but how much impact is tolerable to society and stakeholders?
• Balance strategic choices: Research shows that resilience programs face the challenge of balancing defensive and progressive mindsets. It also shows that resilience designs favour either consistency or flexibility. None of these is "right or wrong," but understanding these choices and balancing them appropriately when formulating strategy is a key competency for resilient organizations.
• Stress-test thresholds: In addition to defining impact thresholds for essential outcomes, it is important to stress-test the organization’s resilience against those thresholds across the five capitals.
• Enable adaptive leadership: Resilient organizations have a culture of adaptation and empowerment.

The key outcome from this report is to clear up the confusion around resilience, and to provide a practical guide for becoming a truly resilient organization. We look forward to exploring the seven practices in more detail in our upcoming blog posts.

Note: This is the first of a series of blog posts on this topic.