Here’s a new idea for operational resilience and business continuity professionals: go talk with your chief strategy officer. They know the biggest strategic threat facing your organization. There is a good chance many people in your organization have no idea what that threat is.
This is my goal: to help your organization become more resilient in the face of strategic threats. I call this concept strategic resilience. You and your team are in the right place to drive meaningful results, just like you help your organization prepare for major disasters and respond to any kind of crisis. This article will outline how to increase strategic resilience. In step one, I will describe and define strategic resilience, and then in step two, I will outline the components of a strategic resilience program.
First, some background. Before starting my own consulting firm, I spent 20 years working for Verizon Wireless. They were one of my clients when I worked for a global professional services firm. Funny how that works. My entire career has been focused on increasing the technical, operational, and strategic resilience of organizations.
Step One: Defining and Understanding the Concept of Strategic Resilience
There are risks to your organization that transcend the normal operational risks we have helped our organizations manage since the early days after 9/11 made “BCP” an acronym of interest to every board of directors.
For example, you don’t want to be director of business continuity or VP of operational resilience at Blockbuster as Netflix is going online, at Sears prior to Walmart, or at Borders before Amazon. You get the picture. These old companies are gone. Disrupted. So much for business continuity.
Let’s pause here for a moment. How seriously do you take your role, as a resilience professional? Is this your responsibility?
In my first 16 years as an operations-focused resilience professional at Verizon, never once did I speak with our chief strategy officer. It made sense at the time. I was only focused on the things that could disrupt our operations. Things like power outages, fiber cuts, natural disasters, active assailants, human error, etc. The strategy team wasn’t responsible for any of those things, and I had plenty of work already.
Then I decided to advance my career and step into Verizon’s strategy department. It opened an entirely new view of the world. Look at those biggest strategic risks! My units for measuring risk changed from thousands and millions of dollars to billions. I had been missing the big picture, threats that could sink the entire company. Ouch! I had work to do.
If one definition of resilience is positive adaptation despite adversity, then strategic resilience is positive adaptation despite strategic adversity. We can consider strategic adversity to be anything that can disrupt your organization’s ability to achieve its strategic goals.
Welcome to the world of strategy. If you have succeeded in the world of business continuity, where the profession is often interpreted in 10 different ways by 10 people, you are perfectly suited for the job of strategic resilience. Even better, you can bring operational rigor to a team that may benefit from making decisions when the clock is ticking loudly, like during a crisis, not just for the annual budget cycle or five-year planning window. Some strategic issues are urgent and time sensitive.
It won’t be comfortable. People will ask, “Who you do think you are, and why are you poking around in these quiet hallways?” Tell them you are a resilience professional, and you are here to learn more about the strategic risks to your organization. Even if someone else is working on strategic risks and opportunities, it will be a good connection. They could probably use some help.
It's a fair question to ask: “Who is responsible for managing the strategic risks to your organization?” Perhaps this responsibility belongs to the chief strategy officer. Perhaps the CEO or board of directors, maybe the VP of enterprise risk or internal audit. I am less concerned with where the responsibility falls in an organization, and more concerned the work is done well, with the right executive visibility.
Here is a diagram that positions strategic resilience in relation to the ongoing evolution of business continuity and operational risk programs.
This is what we do as resilience professionals. We help our organizations with the risks that are most significant. And like me, you probably take your role seriously. We don’t ask for money unless we really need it, unless the risk is real. When we call, the execs know something urgent needs their attention. This credibility we have built is pure gold, built over the course of many years of operational planning and crisis response. Let’s help with the big strategic risks too.
Step Two: Outlining Components of a Strategic Resilience Program
The components of a strategic resilience program include the: strategic response team, strategic impact analysis, strategic continuity plans, and validation. Sounds familiar, right? That’s because it is, and it works. We are adapting proven tools for a different challenge, for different risks.
Strategic Response Team
Think about the strategic response team. Who must be involved when a strategic crisis occurs? Now think about your existing executive crisis management team. Do you see a Venn diagram forming? Not all roles are required on both teams, and it is possible you have never spoken with some of the people who will need to be on the strategic response team.
Here’s a diagram describing which roles may belong on each team.
There is flexibility here, just like with your crisis management teams, with teams designed to suit your unique organization and structure. And this is also where your knowledge of the people, the organization and your credibility as a non-partisan participant helps build the team. This is also a great team to bring together, for a new type of crisis exercise: using a strategic threat scenario instead of a traditional operations-focused threat. More on that later.
Strategic Impact Analysis
The strategic impact analysis component is also familiar, but different. The goal of this component is to identify the mission critical initiatives that must be accomplished this quarter or this year. If these are not accomplished, your organization’s big goals will be in jeopardy and at risk of failure.
Perhaps there is a big product launch planned, or large acquisition, or joint venture to announce, or even retiring a key supplier. Your leaders know the many, perhaps hundreds of initiatives to accomplish. They are likely prioritized, with owners assigned, and status reports filed regularly. This is normal work, right?
Here’s a challenge that impacts almost all organizations: how to focus resources on the right activities. Many organizations excel at this, announcing the Top-5 priorities at kick-off meetings each year. That’s fine. We’re not here to critique … yet. However, we have seen how many of these initiatives are disparate and conflicting. That is a separate problem, beyond the scope here. For now, our goal is to simply identify the most important initiatives.
To accomplish this, we engage leaders from across the business to identify their priority initiatives, using a standardized approach for all departments and teams. This sounds like our traditional operations-focused business impact analysis. Indeed, but with different questions, and different measures to prioritize and filter. In some cases, organizations have done this work already, so we use what they have in place. No need to reinvent.
Strategic Continuity Plans
Strategic continuity plans provide teams with a mechanism to identify the risks to their mission critical initiatives. Like with the operations side of the house, we approach the owners of these initiatives, who are clearly busy, and who know the entire organization is counting on them to succeed. Yes, we are here to help. Smile. The strategic continuity plan identifies what must happen, by when, and what resources are needed. It identifies and prioritizes the risks, along with the steps and resources needed to mitigate these risks. The most sophisticated teams can pinpoint which leading indicators must be monitored, and have pre-cleared with management, the latitude to execute the plan when needed.
All of this saves time. It increases the likelihood of success when strategic initiatives are threatened. If it weren’t important, we wouldn’t be concerned. However, these activities are mission critical, so we do something about it. Just like on the operations side, resilience professionals help organizations plan for the uncertain future.
So far, so good, but there’s a catch when it comes to strategic continuity plans. Unlike operations-focused BC/DR plans, these strategic continuity plans don’t require investments in backup generators, cyber defenses, or system work-around procedures. These plans may require reallocating significant resources from one project to another in mid-stream. Or they may require engaging a new partner at significant cost, to pull the team over the finish line. Or they may require doubling down on a controversial and unproven innovation, when it becomes clear the industry is shifting in that direction. These are decisions at the top executive level, not to be taken lightly.
The good news is that some of your leaders are keenly aware of these strategic risks. This strategic resilience program provides them the opportunity to explore and prepare for these risks in a healthy way, without diminishing their vigor and commitment to the chosen path. Sometimes unexpected things happen. Our role is to help leaders plan ahead, to build capability and confidence, regardless of the weather, disaster, or strategic threat.
Validation
As we know, a plan needs to be tested to confirm it will work when needed. Otherwise, it is destined towards the now figurative pile of three-ring binders on the shelf, collecting dust and scorn. With validation comes more challenges, but it can be done with confidence. There are two approaches for validation: the first is based on results, and the second is exercises.
When using results for validation, think about the familiar hurricane maps. These use sophisticated sensors and data models to forecast the path of the storm, three days, five days, two weeks out. These depict a cone of uncertainty to indicate the range of likely outcomes for the storm’s path. After the storm makes landfall, we know with 100% certainty whether the model and projected path were accurate. Results, after the fact, will also indicate whether our strategic continuity plan was valid.
As uncomfortable as it sounds, we can simply wait and watch the results. Perhaps our plan will be right, perhaps wrong. Perhaps our plan wins in the short-term but loses in the long-term. Using results as validation, the clock wins with 100% certainty. Just like with the hurricane map, eventually we know where it lands, and can assess which city evacuated promptly and which city was delayed. If one of our mission-critical strategic initiatives needs to be accomplished by a certain date, we will know on that date, with 100% clarity whether we achieved it or not, regardless of risks and threats. Some organizations use an objectives and key results (OKR) approach to bring clarity to this process.
Using metrics and results to validate our strategic continuity plan is mandatory. Using the proper metrics in the proper timeframes is vital, because what we measure drives behavior. And this process may raise productive questions about employee incentives, executive contract terms, stock options, and activist investors who may have different objectives than other stakeholders. The key here: identify and measure the right results that align with your organization’s mission. Even better, measure leading indicators of strategic risk to help your organization adapt faster than the competition, and long before landfall.
The other way to validate strategic continuity plans and strategic response teams is through exercises. Exercises are informative and efficient. They are familiar and within your team’s current cone of responsibility. Go for it. I’d even propose your team starts here, as previously mentioned. We used to do this as consultants to large Fortune 500 clients. Start with a brief executive exercise. It provides visibility at the top. If the team performs well and things look good, then we have confidence and can proceed elsewhere. However, if the leaders become uncomfortable with the organization’s level of preparedness during a strategy-focused crisis exercise, this drives healthy action. This begins the journey to increase your organization’s strategic resilience.
To conduct a strategy-focused crisis exercise, start by making friends in the strategy department. Here we will talk with your chief strategy officer, a list of questions ready, after prudent research and interaction with the right people beforehand. The goal is to identify the biggest strategic risks facing your organization. You could probably type this into your favorite generative AI tool, but we can do better than that, by building good working relationships.
Take this list of strategic threats and turn them into a tabletop scenario. Run it like every other crisis scenario your team has conducted for the past hundred years. And since we have an all-hazards plan, let’s try on these strategic threats for size! OK, we’re adding some humor here, despite the stress and gravity of the decisions this team would be facing.
Like with any exercise, it is being conducted on a blue-sky day, where we have the luxury of planning ahead, before the threat is real. We should feel good about that and be able to lighten the mood. You are a trusted professional, helping guide and lead busy executives through an exercise that could poke at the heart of the organization. We need to trust one another’s intent and focus on the big mission to get stronger and not sink into silliness.
We are doing this work because it is mission critical. We are doing this because we do not intend to fail on our watch. We intend to win. This requires emotional intelligence, the ability to be humble when facing the future, and the ability to chart a path forward with the strength of a team. The better and faster we can do this, the more resilient we become.
Exercises are an important way to test your strategic continuity plans. These also present themselves in a similar way to traditional operations-focused tests of BC/DR plans. Use creativity and common sense to decide what will most benefit the team, whether a table-top scenario or functional exercise.
Next Steps
Implementing a full strategic resilience program should only be considered by organizations that have capable and mature operational resilience and BC/DR programs in place. However, building a strategic resilience program does not need to become a new mountain to climb.
Just like BC/DR programs, strategic resilience provides capabilities that can start small and evolve organically within your organization. Every organization is unique. Like BC/DR, the concepts can be incorporated into daily work activities, making an organization stronger just by adopting the concepts, one component at a time, one team at a time. Each component adds new value.
As resilience professionals, we want to be aware of all threats to our organizations. Since strategic threats are likely to significantly impact all organizations, let’s expand the frontier of our profession to include strategic resilience capabilities as part of our value and purpose.
