Traditionally, to stave off disaster, institutions have put in place business-continuity plans to respond to a list of potential threats—hurricanes, server outages, cyber incursion, and so on. They have tended to include a dose of conservativism in a single-scenario planning approach. This approach is outdated.
Firms should strive as much as possible to embed resilience in the way they work, in a way that makes them better in normal times, not just in the face of unpredictable threat or change. We delineate three approaches firms can take to increase resilience:
- Add on. Boxes of supplies, emergency generators, backup servers, and redundant pathways all fall in this category. This is the domain of the traditional business-continuity plan and is certainly necessary in some cases. This approach to buffering against threat is isolated and easy to understand and does not get in the way of core operations or business models. On the other hand, in practice, this approach is almost never as reliable as one wants—for example, emergency supplies expire, generators do not work. Add-ons also tend to increase complexity and can lead to unpredictable knock-on effects. So relying entirely on add-ons is ill advised.
- Trade off. Capital buffers, stocks of goods, and overstaffed call centers all fall in this category. These are considered explicit trade-offs between resilience and other parts of the system, often returns or productivity. Leveraging trade-offs requires transparency, true understanding of the desired risk–return balance, and practical ability to retune the system fast. Financial resiliency is perhaps most easily suited to this approach. Systems with physical constraints (such as production facilities) and networks (such as shipping networks) present greater challenge for making quick shifts.
- Bake in. This is the happy convergence between what is best for resilience and what is best for other business aims. Organizational resilience is where the “baked-in” approach is most in its element and springs from diversity of skills and experience, fostering of innovation and creative problem solving, and the basic psychological safety that enables peak performance. These characteristics are helpful in good times and indispensable when quick, collaborative adaptation is needed for an institution to thrive.
Add-on resilience is necessary, but it is not the full answer. Backups can fail, they add complexity, and they typically do not help companies emerge from change stronger. Some trade-offs are also required. But companies should look to maximize the amount of baked-in resiliency they can create. This helps better target add-on redundancy, reduce the degree of needed trade-offs, and at the same time improve institutional ability to emerge stronger from change or threat.