What is Operational Resilience?

Operational resilience is your business’ ability to change or adapt during times of stress, disruption, or uncertainty. It’s also a key factor for success — and employee morale —  in these turbulent times. 

More than business continuity planning, operational resilience encompasses a holistic and strategic framework. According to Gartner, operational resilience is a set of techniques that allow people, processes and information systems to adapt to changing patterns. This inclusive definition recognizes that business, operations, finance, information security, and GRC are all interconnected and need to be viewed together. 

Operational resilience is a necessary framework to navigate an increasingly uncertain world—whether that means a global pandemic, sophisticated cyber attacks, climate uncertainty, potential IT disruptions, growing regulatory scrutiny, or fickle customer expectations. How do businesses not just prepare but succeed when faced with the unexpected?

Why Operational Resilience is Vital

Resilience cannot be cultivated without an understanding of the interconnected nature of risk throughout the organization. Building an operationally resilient organization requires cultivating a holistic perspective. Too often, risk management occurs in silos, with each department assessing its own exposure without an adequate analysis of knock-on effects on other functions or processes. This approach ultimately underestimates the impact throughout the organization. Managing risk this way leads to unintended consequences, missed opportunities, and, in the extreme, operational failures. Achieving operational resiliency requires an understanding of how risk interconnects and its potential impact on the organization’s people, processes or systems.

“An ad hoc approach to operational risk management results in poor visibility across the organization and its control environment because there is no framework or architecture for managing risk as an integrated part of business.” Michael Rasmussen

 

Beyond understanding risk, companies must also employ a robust framework, including structures and processes that strengthen their ability to quickly adapt to changing circumstances. This extends beyond having robust IT infrastructure and disaster recovery plans to include building flexibility around people and processes. This means having a plan when onsite work, as with COVID-19, is no longer feasible. Or having redundant or alternate systems in place when a vendor is no longer able to fulfill their responsibilities, leaving you at risk of being unable to service your clients. This also means having adaptable systems which enable workarounds or improvements when circumstances are changing. Flexible and adaptable structures and processes are an essential part of building a resilient organization as they enable the organization to manage risk in real-time. 

Communicating with stakeholders in a time of uncertainty or disruption is another important practice. As disruptive as events can be, an internal and external communication strategy is an important aspect of maintaining trust within the organization, as well as outside it. Internally, this starts with having a common language that allows for everyone in the organization to communicate in a like manner. If risk is measured or discussed differently within an organization, the potential for under or overestimation could be costly. Communicating with and assuring external stakeholders, whether the client, vendors, suppliers, distributors, or others, will cultivate loyalty and build a relationship around trust as you address disruption or uncertainty. 

Take These 3 Steps to Build Operational Resilience

Take a holistic view of organizational risk. Consider internal and external factors that impact your organization including business lines, assets, systems, processes, third parties, and people. Building a resilient operation means seeing the interconnection and interdependence of risk throughout the organization. Effective enterprise risk management systems must look across divisions and operations to holistically assess and account for potential threats. 

Design systems that take a comprehensive approach to risk assessment. This starts with translating risk into a language that everyone at the firm understands. Having a common vernacular permits a more comprehensive analysis and documentation of potential risks throughout the organization. It also allows for a more robust discussion around risk and return as organizations consider how to adapt to changing conditions. Moreover, a shared language permits greater collaboration and cooperation, both critical to building a deeper understanding of the interdependence of risk in the organization and building operational resilience. 

Assess for critical points of failure to inform robust processes, ensure systems capabilities, and cultivate adaptable practices. Although no market disruption or business interruption is the same, much can be learned from each. Knowing where the key risks lie across the organization and proactively implementing potential workarounds can help organizations better adapt to evolving conditions. The key is having robust systems and flexible processes, as well as cultivating a collaborative and resilient culture.  

How a GRC Platform Helps Build Operational Resilience

An integrated GRC platform can help identify risks to the organization as well as help manage the unexpected.

The right software enables a shared, enterprise-wide perspective of GRC, including external parties. This enables the business to more quickly identify risks, glean better insights, obtain critical data, and trigger action plans. An integrated platform also supports more consistent communication internally and with third parties, ensuring engagement and a concerted plan of action.

Today, navigating uncertainty is critical to success in any business. With ever greater threats of internal and external disruptions, cultivating operational resilience will ensure your business remains capable of managing and even thriving in unpredictable times.

We asked 190 risk professionals what they are focusing on to support operational resilience at their organizations and they answered. Find out what they said in LogicGate’s second annual Risk Management Survey by downloading the report here.