ADVOCATES OF the concept of resilience are gaining more converts as many grapple with the fact that present approaches to risk management seem to have failed to foresee or adequately deal with a mounting series of global shocks.
Following a workshop in December last year – co-sponsored by the Critical Infrastructure Protection Branch of the Attorney-General’s Department and Emergency Management Australia – to explore the concepts of creating resilient organisations, a National Resilience Community of Interest (NRCI) was formed, and advocates have been presenting to groups around the country on the concept.
The NRCI includes eight individuals from the public and private sector and is chaired by David Parsons, manager of business resilience at Sydney Water, who is also chair of the Federal Government’s Trusted Information Sharing Network, comprised of public and private groups.
Robert Oldfield, group risk officer at QBE, is another member. He said many different groups, including the security, risk and business continuity community, are beginning to accept the concept, not least because it has a more positive ring than risk, despite the fact that many initially saw it as a rebadging exercise.
“Quite a few groups are trying to rebadge BCM [Business Contunuity Management], risk or security,” he said. “However it is now becoming clearer to everyone that resilience isn’t about rebadging.
“It’s all about the interdependencies of these tactical elements, plus the necessary characteristics and behaviours to manage, and gain from, an ambiguous event or environment.”
Instead of being driven by practitioners in these fields, he said the ideas were being driven more by government and academia.
“Resilience is possibly the future of enterprise risk management,” Oldfield said. “Why are we doing this? We are facing a world full of turbulence, connectivity, complexity, continuous obsolescence and reinvention and, of course, climate change.”
“Most risk practitioners agree that ERM hasn’t really delivered on what was promised and that organisational resilience is the future,” Oldfield told Risk Management, but he wanted to make it clear it wasn’t a concept that necessarily had to replace ERM and that NRCI sought organisations that had successfully implemented such a structure to see whether they had achieved a truly resilient organisation.
“I think ERM has a place, but on speaking to some ERM managers, as opposed to risk managers, when you look at how they’ve done it, some actually have adopted what I would call organisational resilience,” he said.
“The important part is taking that extra step and looking at the ontological risks, the unknown unknowns, the communication lines, looking at the adaptive aspect of the organisation.
“Very few organisations, even ones with a good risk management program, actually have that capability.”
Unknown unknowns was coined by the former US Secretary of Defense, Donald Rumsfeld, in a now infamous speech. But theorists have seen the serious side of what he was saying, and the term is now commonly used to describe unusual events which nevertheless have far-ranging consequences.
Oldfield said that many governments and organisations were now realising that they had to spend a lot more time preparing for the low-frequency, high-impact events because those were clearly the ones that could threaten their existence.
Some of the principal research in this area is occurring at the Universityof Canterbury, NZ, where research fellow Erica Seville is nearing the end of a five-year study and the University of Ohio. Oldfield said his group had been tapping into the work being done, and they have now gathered a large number of practical case studies of organisations that have been subject to great upheaval but have been able to adapt.
He said that NRCI is still searching for an example of an organisation that had implemented ERM and had their framework tested and survived.
Importantly, he said, the theory of resilience does not adhere to the business continuity concept that the organisation has to return to its previous state – it may have to change significantly to reflect the new environment created by changed circumstances.
Oldfield is now working on setting up a Special Interest Group around the NRCI in conjunction with the Risk Management Institution of Australasia, the Business Continuity Institute and ASIS (Security).
At the end of October, they will be holding a workshop on resilience and out of that meeting a guidebook on how to work towards a resilient organisation will be released.