Playing with Fire: An article about Organisational Resilience
First published in the Daily Telegraph, 31st May 2007  In a world increasingly obsessed with eliminating risk to individuals, businesses and public organisations today face a widening range of threats; are they really prepared for them? Planning, training and exercising are the three parts of an organisation's resilience strategy that are now, from a risk management perspective, absolutely non-negotiable. The rising risk environment is well document and 'risk assessments' are now the prerequisite of every activity. But their very ubiquity obscures, and even exacerbates, the real problem for organisations. Assessing risk may absolve you from theoretical or legal responsibility when things go wrong: it doesn't do anything to ensure you can put them right. Consequently in recent years and largely driven by the flaky reliability of IT-driven systems, the concept of 'business continuity;' has developed into a detailed planning process, with a degree of committed corporate focus. However, as with risk assessment, business continuity planning is still often seen as a 'tick in the box' rather than a genuine guarantee of future corporate health. Integration is the first casualty. As soon as business continuity is hived off as a separate responsibility, rather than becoming part of every manager's role, it is already 'planning to fail'. The second challenge to an organisation's resilience is a lack of trained capability. Training is often either woefully inadequate or entirely absent from the risk-management environment. Plans are devised that require a lot of people responding precisely, with appropriate skills and knowledge, at the right time, to handle a crisis and guarantee the future of the organisation. Yet the attitude to training is often akin to sending a football team into an FA Cup Final after having just sat them in a room for an hour and drawn some set-piece moves on a blackboard. The development of staff capabilities in crisis needs serious attention. Training makes skills, only practice makes perfect. For every individual that's a truism; for a team, under pressure, it's fundamental. You have to exercise to complete the circle. Yet design and delivery of effective exercises is an art and rarely a core organisational management skill. There are now specialists, like Steelhenge, who are able to deliver the whole three part programme, or – if planning and training resources are in place – deliver the all important 'practical'. Effective testing of plans through well designed and executed exercises is essential. To really protect your business, systems, people, reputation and data you need to be rehearsed.
|
