That new lawn edger that’s hanging in the garage… How long did your excitement about it last? Is it part of your regular routine for yard maintenance and care, or is it an expensive dust collector? The last health fad or fitness routine you may have adopted - did you stick with it permanently, or just endure the torture long enough to say you tried it? Without commitment to a larger strategic mindset and behavior change, tools come and go without meaningful positive effect. Conversely, if you’ve decided to change your lifestyle, then these things are interchangeable on your journey, with the goal remaining the same. This is also true with managing organizational risk.
Culture vs. Tools
When crisis strikes, team energy is high and focus sharp. When the crisis subsides, zeal for ongoing risk management wanes rapidly. In this sense, becoming 'resilient' requires a culture that sponsors resiliency. Methodology provides the framework through which your organizational resiliency culture can be formalized. Effective risk management tools will reflect both your organizational culture and methodology. This ensures that the responsibility is shared, not siloed. The metrics, visualizations, and action plans will therefore be specific to your organization, and thus will be highly actionable. More importantly, by wrapping your culture around and embedding your methodology into your tools, you will ensure persistence, repeatability, and continuous improvement in your risk management function.
What is the value of a resilient culture?
Coming out of the COVID-19 pandemic, Harvard Business Review professed the strong belief that achieving intelligent and lasting resilience is a tremendous competitive advantage. They also believe that most organizations are held back by one or more fundamental misconceptions about the nature of risk resilience:
Resilience is mainly a supply chain issue.
Resilience is synonymous with risk mitigation.
Resilience is mainly an operational consideration.
Resilience is a cost to the business.
Crises are too infrequent and unique to warrant investment in resilience.
In reaction to these myths, HBR emphasizes that resilience must become institutionalized. At about the same time, a Boston Consulting Group study found that those organizations that were truly and persistently resilient gained 30% in long-term Total Shareholder Return (TSR) during crisis periods because of their readiness.
I frequently share an anecdote from a Fortune 100 chemical company that illustrates this kind of culture perfectly. This organization promoted out-of-the-box thinking sessions to come up with risk scenarios, ranging from the commonplace to the crazy. The objective of the sessions was to identify the possible situation, qualify which parts of the organization would be effected, quantify the potential impact, rank the threats, and develop mitigation plans that could be executed and/or rehearsed up front to ensure peak readiness. One of their scenarios was a global health crisis that would shut down supply chains and societies, a perfect analog to what happened in beginning in March 2020. When it happened, they were ready - and they began fulfilling orders that their market competitors could not.
Culture loves to eat
When considering the pillars of achieving resilience, if “culture eats strategy for lunch”, then it snacks on isolated tools along the way. Indeed, if your organizational culture keeps risk at front of mind persistently, and it is not limited by narrow or non-specific tools, then crisis events represent opportunity to gain meaningful competitive advantage in the form of increased market share. For those of you who don't have such a culture in place, I'm sure you're wondering "how do I create a persistent risk resiliency culture?"
An organization is as uniquely individual as a person is and thus its culture forms in its own unique way. As such, you may find one method works better than another. Common approaches to building a culture for optimal risk resilience include:
Give everyone a voice
Engage people from across functions, divisions, and geographies to share their insights into the diverse definition of 'risk', including the sources, nature, severity, and solutions to those risks.
Offer everyone a role
Invite their involvement in risk identification and assessment, hypothetical risk scenario ideation, and risk management planning and execution (strategic, tactical, and operational).
Simplify and optimize the user experience
Select tools and technologies that are easy to use and that seem so familiar that there's no learning curve (systems customized to use leverage organization-specific terminology and processes). Reduce reasons for users to abandon the system and thereby disengage from the resiliency-building process. Automate processes and supplement - but don't replace - the user with AI and other analytical tools and recommendation algorithm features.
Get creative
Establish a cadence for bringing people together in a creative 'risk scenario' ideation process - preferably in person - to think up all of the possible risk situations that could arise from cyclical events to catastrophic black swan moments. In this kind of a session, there are no bad ideas - just poor planning.
Incentivize action
Include involvement in resiliency-related activities and outcomes in employee compensation: risk avoidance bonuses, shared bonus pool for TSR gains during major crises, internal recognition, accolades, and possible promotions linked to resiliency achievements.