Looking up into the tree canopy circle formation

How boards can support resiliency in the face of constant crisis

Related topics

EY Center for Board Matters

From ad hoc response to truly “ready for anything,” boards and their organizations are setting aside the traditional crisis playbooks to focus on resilience.

In brief
  • Today’s crises are more rapid and interconnected, causing boards to rethink traditional approaches that can hinder a dynamic and agile crisis response.
  • Leading boards view crisis management through a longer-term lens focusing on organizational resilience rather than waiting for the next crisis.
  • To enable resiliency, crisis responsiveness must be embedded and reinforced in the company culture, processes and resourcing.

Aleader’s statement or a customer incident goes viral globally on social media. A ransomware attack halts operations. A CEO is suddenly incapacitated. An investigation implicates senior management. An activist demands board seats. A product defect leads to massive recalls. A new technology threatens to make the company obsolete. A virus triggers a pandemic shutdown. A war breaks out and reroutes the global supply chain paths.

These examples of crises that reverberate in the boardroom were cited by directors during recent discussions about the challenges of overseeing crisis management in today’s environment. While they may take many different forms, crises all create an urgent call to action that goes outside the normal course of business and processes. At least, that’s how crises have traditionally been characterized and addressed. The problem facing leaders today, however, is that we now live in a world where a crisis never seems to end, with integrated geographies and systems driving spillover – all as the impact is accelerated by social media. No wonder the term ”permacrisis” is quickly finding its place in the corporate lexicon.

Directors characterize a crisis as: urgent, adverse, consequential, people-related and of uncertain duration.

In this environment, boards and management teams can no longer afford to think in terms of traditional one-off crisis management, because doing so leaves the organization in a constant scramble to put out fires with outdated plans. Instead, we increasingly see leaders shifting to a resiliency approach that enables more effective capabilities with less stress on the organization.

Outdated approaches to crisis management hinder resilience

When a catastrophe arises, management teams typically reach for the shelf to pick up whichever crisis playbook applies and then – because there’s no such thing as a textbook crisis or opportune conditions – improvise as the crisis unfolds. And if the crisis involves the management team itself, the board turns to its own playbook.

Instead of making organizations ready for anything, this limited approach has resulted in increasingly siloed and specific actions that require resources and re-learning – every time. In addition, flawed decision-making about how to handle the crisis du jour can further impede the organization. Below are the common approaches and thought patterns that may hinder a dynamic and agile response to a crisis:

Conventional approaches to crisis

Mindset

Potential downsides

This crisis is like the last one.

Boards and management teams have a tough time preparing for and predicting the next crisis, and they often end up reacting to the last crisis, ultimately overinvesting in the wrong areas.

We have the playbook.

In these dynamic times, having a set playbook for a crisis can lead to missteps, including outdated contacts, resources, and tools. While playbooks communicate the baseline response, they inadvertently encourage a limited approach rather than the agility organizations need to respond to changing conditions.

We have plenty of time to prepare.

Humans have a well-documented bias known as “hyperbolic time discounting,” which means that they excessively discount the future, focusing instead on short-term rewards. Because people don’t take long-term risks as seriously as they should, organizations put off corrective actions that could avert future disasters.

It won’t be that bad.

Management teams are accustomed to scenarios with typical assumptions and ranges. The challenge in a crisis is that the “down” case for the assumptions may not be sufficient. For example, directors noted that throughout the pandemic, less-seasoned executives had no concept of how bad things could get and seriously underestimated the worst-case scenario.

Someone has it covered.

There is not always clarity on who owns what during a crisis, and more importantly what the risk appetite guidelines are. Not to mention who has decision-making authority for timely decisions. Relying on the usual organization chain of command can be a huge hindrance.

Take it one crisis at a time.

Perhaps the most outdated mindset is that a crisis is a stand-alone problem that is then addressed in siloed fashion as an ad hoc agenda item. This guarantees that organizations are not only underprepared when simultaneous crises hit, but that interdependencies will be overlooked, resulting in greater impact.

Looking across these standard approaches, the picture that emerges is of static limited responses to crises (expected and unexpected), which feels out of step in the increasingly dynamic and volatile business environment of today and tomorrow.

Rethinking crisis management with an eye toward resilience

In the face of static approaches to dynamic and interrelated crises, perhaps it is not surprising that boards are now asking, “How are we preparing differently for the next crisis?” And the answer they are hearing from leading organizations is, “By building resilience.”

What does resilience really mean? At its core, resilience is about being able to handle disruption and keep going – or, as one director put it, to “have the muscles to take the hit and remain standing so you can get back in the game.” Less poetically, resilience means having a systematized approach to crisis management that is aligned to risk management. So, rather than careening from crisis to crisis, a sustainable approach is embedded into the corporate DNA, integrated into the culture and processes, including communications protocols. This also means focusing on the threats and early interventions to get ahead of a crisis.

An enhanced crisis management framework to ensure resiliency

How EY can help

In speaking with directors and crisis management practitioners, the concept of having the right resources in place permanently, given the expectations for continued volatility and crises, came up repeatedly. For some this means a formal crisis management center capable of scanning for and responding to a variety of situations. For others it will mean allocating individuals and having advisors at the ready as part of risk management or operations. Regardless of the resourcing, directors are clear that in our time of permacrisis, even with tighter budgets, their organizations are well-served making crisis management part of ongoing business.

 

How boards are evolving approaches to resilience

 

It is noteworthy that, over the past year, leading boards and directors have been shifting their language and the lens through which they view crisis management to a broader and longer-term perspective. As one director who sits on multiple boards notes, “[At this point,] investing in resilience makes more sense than trying to anticipate the next crisis.”

 

This director is not alone. More boards are discussing and re-examining crisis oversight efforts to bring a greater resiliency mindset. There are implications here not just for management teams but boards as well and how they are including these discussions on a crowded board agenda. Given the board’s focus on long-term value and the threat posed by crises, approaches that can be considered include:

 

  • Define risk appetite and trade-offs. The board can support management in its decision-making by clearly defining the guardrails for risk and crises to create clarity. While many boards talk about the need for having clear guardrails around risk appetite, few do it with a level of specificity that enables management to make more considered trade-offs.
  • Reconsider risk oversight assignment. Risk committees can be valuable, and in 2022, 11% of S&P 500 companies disclosed that they have separate risk committees, with the majority of those in the financial services sector, where it’s required. Nonfinancial services boards typically delegate overall risk oversight to the audit committee, but oversight for specific risks is sometimes assigned to other committees. For example, talent-related risks may be addressed by the compensation committee, and environmental and social matters by the nominating and governance committee.
  • Pursue diversity of thought. This was an area that directors emphasized as they considered how cross-industry and business cycle experience can prove helpful in identifying risks as they emerge. While boards are recruiting more directors with hot skills, such as cybersecurity, directors need not have a specialized background in these fields to raise valuable insights. Boards can strengthen their own resilience by creating a culture that allows directors to ask questions and challenge points, while maintaining collegiality. Some boards shuffle committee membership every few years to allow for new ideas.
  • Support permanent resources. What’s becoming clear is the need for a combination of abilities to identify risks, then process and escalate them, and finally, communicate well with stakeholders. Where these skills reside and how resources are aligned – whether centralized into a crisis management center or embedded throughout the business – are questions the board can ask to confirm whether capital is allocated accordingly.

 

In today’s environment, boards play an important role in overseeing crisis management planning and are guiding management teams to look at the entire lifecycle of crisis response, not only to be ready to react to single or multiple crises but also to avoid the crisis in the first place. This highlights the mindset shift underway from crisis management to resilience, which is critical to long-term growth in a short-term volatile environment.

Questions for the board to consider

  • What does our current crisis management entail? How are processes/playbooks built and triggered today?
  • To what extent does the current crisis management approach take into account how different risks may be interrelated and impact each other?
  • What are the board’s crisis and risk comfort levels and thresholds for the organization?
  • How is the board setting clear expectations with the management team about crisis management communications?
  • How is the board ensuring that both it and the management team incorporate the lessons from crisis management efforts of the past few years?
  • Have the board and management considered what types of skills/experience might be needed on an ongoing basis as disruptive events continue?
  • Is the intelligence team appropriately resourced and trained to address critical organizational risks?
  • Has the organization exercised its crisis management plan beyond tabletop exercises, under potentially real-life conditions? Should the board be involved in these crisis management fire drills?
  • Who coordinates the layers of crisis management and how is the plan communicated throughout the organization to ensure people are implementing the right approach? What is the board’s role in the crisis recovery process?

Summary

As crises become increasingly interconnected and persistent, traditional one-off crisis management approaches are no longer effective. Boards and management teams are shifting towards building resilience to handle dynamic and interrelated crises. This involves adopting a systematized crisis management approach aligned with risk management, recognizing a broad spectrum of potential crises, readying the organization with trained resources, responding appropriately, and learning from past experiences. Boards are evolving their approaches to resilience by defining risk appetite, reconsidering risk oversight assignment, pursuing diversity of thought, and supporting permanent crisis management resources.

Related articles

Four lessons for boards in overseeing emerging technology

Learn about the important role boards play in identifying strategic opportunities and overseeing risks related to innovation and emerging technologies.

31 Jul 2023 Kris Pederson

How audit committees can prepare for 2023 Q2 reporting

Find out what audit committees need to know as they prepare for Q2 reporting.

29 Jun 2023 Jennifer Lee + 1

    EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.