man running up stairs towards bridge

How organisations can be resilient in the face of constant crises

Dealing with one crisis at a time is no longer an effective approach when previously unprecedented events have become increasingly frequent.


In brief

  • The complexity and frequency of crisis events is increasing at pace, and organisations need to respond accordingly.
  • There is no set template or playbook for dealing with a crisis, each event is unique and must be addressed on its own terms.
  • Organisations need to focus on resilience and build the organisational capability to anticipate and respond to unforeseen events and risks.

From ad hoc response to truly “ready for anything,” boards and their organisations are setting aside the traditional business continuity plans to focus on enterprise resilience.

 

A fire in a sub-station causing a catastrophic power outage. A cyberattack paralyses operations of an organisation. A major storm deprives a business of power, water and telecommunications. A pollution incident leads to the closure of a key manufacturing facility. A product defect leads to massive recalls. A public health emergency causes a shutdown of key operations. Imposition of tariffs by a major trading partners requires supply chain reshaping.

 

These are all examples of real-world crises that have affected major corporations in the recent past. While they may take many different forms, they all create an urgent call to action that goes beyond the normal course of business.

 

In the age of permacrisis

 

It is probably fair to say that organisations today have moved from a phase of multiple interconnected crises to one where a crisis never seems to end. We have now entered the era of the permacrisis, an extended period of instability and insecurity, often resulting from a series of catastrophic events. Simply put, it is the experience of lurching from one unprecedented event to another.

 

In this environment, boards and management teams can no longer afford to think in terms of traditional one-off business continuity as doing so leaves the organisation in a constant scramble to put out fires with outdated plans. Instead, we increasingly see leaders shifting to a resiliency approach that enables more effective capabilities with less stress on the organisation.

 

When a crisis hits, the typical approach has been to attempt to apply a playbook based on how previous business disruptions were handled. But there is no such thing as a standard or textbook crisis. Each event and its consequences tend to be unique in their own way. Instead of making organisations ready for anything, this limited approach forces organisations to improvise for each new crisis, expending scarce resources in the process. Worse still, it can lead to flawed decision making and missteps as the people involved are operating in unknown territory.

 

Increase in frequency of unexpected events

 

A different approach is required in the face of ever more frequent crisis events. That approach is to build resilience, the ability to continue operations in the face of severe disruption.

 

This is particularly important in light of events like the recent Heathrow Airport closure. In that case, a highly improbable fire at a key substation cut off power to the airport and caused massive disruption to passengers and trade with reverberations continuing for days after the 16-hour closure.

 

This was an example of what is commonly referred to as a Black Swan event. Something with extremely low probability of occurring but with various serious impacts when it does. But such events may become more frequent and less improbable. Climate change is leading to more extreme weather events that could interrupt power supplies through floods or lightning strikes, for example.

 

We are also seeing other catastrophic and once rare events occur with greater frequency. Cyber breaches, IT outages such as CrowdStrike, and weather events like Storms Éowyn and Darragh. Each brings with them the potential to compromise an organisation’s ability to do business.


The question for organisations is not just how to prepare for the increased frequency of such events, but also for situations never encountered before. The first rule is to expect the unexpected. Businesses need to be able to deal with what may happen without actually knowing what the event might be. That’s true resilience.


The nature of the response to those unanticipated events is crucially important. What organisations have found in recent years is that just thinking about business continuity is probably too narrow an approach.

What’s much more important is thinking about what is critical and core to the organisation. If it is a services business, what are the most critical services provided whether that’s to a patient, a citizen, or a consumer? If it is a products business, what are the products that are core to the business, and what are the key operational processes underlying them?

It is about prioritising the aspects of the crisis that need to be responded to and what needs to be recovered in what order so that the business can get back up and running as quickly as possible. This is the core of an effective resilience programme which encompasses the process and plan of action which will allow the organisation to deal with any crisis that arises however improbable or unexpected.

Five-step approach to crisis and risk management

In preparing for and responding to crises and building resilience, organisations should take the following five step approach:

Summary

The increasing frequency of hitherto highly improbable and unprecedented events requires a new approach to crisis response. What worked in the past will not necessary be effective today or in the future. Organisations must instead focus on resiliency and putting in place the processes and action plans that will cater for the unexpected and enable the business to maintain core operations.

About this article

You are visiting EY ie (en)
ie en