Please note that this is a page from a previous version of Continuity Central and is no longer being updated.

To see the latest business continuity news, jobs and information click here.

Business continuity information

Organizational resilience: yet another buzz word?

By Claire Phipps, MBCI.

Businesses are usually in operation to make money and deliver a service or provide a product. To be successful there are many traits required and by ensuring your business is dynamic, adaptive, efficient and cost effective are all good starting points. Who would want a business that is passive, rigid, ineffective and expensive?

The same is true when talking about good management disciplines and recognised international standards and best practice.

So why don’t we evolve these disciplines and channel our way of thinking to change the way in which we deploy them. Adapt the methods in which we operate to one of ‘organizational resiliency’ - an all-encompassing comprehensive management discipline that ‘ticks all the right boxes’, provides success, growth, strength, security and a return on our investment.

Within my industry, there has long been an ongoing discussion and debate with regards to the future of business continuity and whether or not organizational resilience is the way forward. The fact that we are still not getting a concrete answer could be the answer itself. Yet again I’m hearing the phase being more commonly discussed and thought I would consider my own opinions on the topic and open this up for further discussion.

Is organizational resilience just another buzz word being bandied around, a way to help ensure professionals in the field are seen as a valuable commodity and retained in employment or is this the direction we should be focusing on to ensure we can continually drive our business forward and improve the way in which we operate?

Reviewing many online discussions and papers on the subject I’ve not been able to obtain a conclusive shared understanding. The topic seems to divide the population of industry experts into two clear camps. Those that believe in change and think that organizational resilience is the future of similarly aligned management systems and those that firmly disagree thinking each is unique in their own right and should continue to remain so.

Each management discipline has an important part to play and requires a range of skills, expertise and experience to implement and manage successfully. Simply reading a book or taking an exam doesn’t mean you’re qualified. When looking at many of my well respected peers in the industry, they’ve earned my respect and of others because they’ve taken the time to learn about the subject and continually improve their level of understanding. They’ve applied their knowledge in the field and most importantly have practical experience of helping to ensure an organization has continuity measures in place; can respond to and handle an incident successfully; can assess and take mitigating action against risks; can help to ensure information is secure and can continually adapt their approach to the changing needs of the business.

However, on the other hand, if we could learn the skills and experience for each management discipline, could we not mould ourselves into something of ‘superman’ status that would allow us to look after the organizations we work for and within, in a new, interesting and more dynamic way? Or, could this become too much of a risk where we could become more like a ‘cowboy builder’, reverting to ‘jack of all trades and a master of none’!

So what are my thoughts on the subject? I think a review and assessment of the strengths and weaknesses of organizational resilience and whether or not we should be looking to change the way in which we operate, to allow change within these management disciplines should be considered. After all, mainframe computers used to be the size of a house and now you can fit more processing power and storage within a system the size of a postage stamp! Well not quite, but I’m sure you can picture the comparison. Disaster recovery used to be about the large backup tapes, old-fashioned media cartridges which were used to back up critical data and would take an age to restore - now we have instant failover capabilities and extremely efficient recovery times. Therefore, why not consider change for our management disciplines? After all change can be positive but only when it’s done correctly, in the right circumstances and with the right skill sets and knowledge.

I attended a presentation recently talking about business continuity and change; a term I heard and liked was that of ‘adaptive resiliency’. I’m not one that likes to use lots of acronyms and confusing terminology, after all the old adage about ‘KISS’ is so true. Focus should be about keeping it simple without losing the importance, quality and value that it brings to business activities. Organizational resiliency is a strategic approach, a way of thinking, an objective to aim for which in turn would result in the combination of the ‘doing’ activities of management streams which are already easily standardised and move business continuity from being seen as an overhead or cost to the business and something that can facilitate revenue streams and continue to protect our business.

Organizational resilience can exist and should be encouraged but as with all the management disciplines mentioned earlier, we need to have a standardised approach for implementing something that is strategically focused. I would like to be able to deliver something that can be truly seen as a value-add activity, not something that’s seen like insurance; something we don’t like paying for until we actually need it, then we’re grateful. I would like to see improved collaboration of skills, utilising the expertise of others around you who have real practical experience of the disciplines, working together towards a single goal, not competing against each other, but thinking and understanding about each other’s area of expertise and combining efforts to allow us to build upon something truly special. Moving to being more proactive than reactive will help us ensure monies are efficiently spent and our organisations become more resilient. So, is organizational resilience just another buzzword: I don’t think so, do you?

Make a comment

The author
Claire Phipps, MBCI, is Senior Information Security Specialist at CQR, an independent specialist in information security. Based in Adelaide, CQR has a national and global reach, with offices in Sydney, Melbourne, Darwin and in Oxford, UK. CQR specialist services include, vulnerability assessment, business continuity, penetration testing, on-site business information security, compliance, risk analysis, access control and payment card industry data security. http://www.cqr.com


I agree with Claire: organizational resilience is not just a buzzword but the product of a successful business continuity process within an organization. Whilst ultimately BC provides a response and recovery to a particular disruption, mitigation of the risks uncovered along the way also adds to overall resilience.

The BC process exposes both the strengths and weaknesses of an organization as well as how it works in detail, but it is the collective expertise of all disciplines that provide workable cost effective solutions. In addition BC can also be seen as a capability, in providing a way of boosting production, or providing additional services by plan activation. This approach is not sustainable for long periods, but definitely a management option that adds value.

John Ball, MBCI, PCBCM.

I think Claire has written a very readable article, but I do not find the noun ‘crisis’ (better still crisis management) within the text, which is perhaps a little surprising given that the UK has a standard on this topic – BS 11200. I think ‘crisis’ comes under the resilience umbrella:

- crisis - an abnormal and unstable situation that threatens the organization’s strategic objectives, reputation or viability.
- incident - an adverse event that might cause disruption, loss or emergency, but which does not meet the organization’s criteria for, or definition of, a crisis (an incident can become a crisis).

A capability to manage crises is one aspect of a more resilient organization, where resilience is the ability of the organization to endure and continue through all manner of disruptive challenges.

Incidents are generally foreseeable and amenable to pre-planned response measures, although their specific timing, nature and spread of implications is variable and therefore unpredictable in detail. On the other hand, crises are unique, rare, unforeseen or poorly managed events, or combinations of such events, that can create exceptional challenges for an organization and are not well served by prescriptive, pre-planned responses (e.g. BC plans).

Peter Power

•Date: 19th August 2014 • World •Type: Article • Topic: BC general

Business Continuity Newsletter Sign up for Continuity Briefing, our weekly roundup of business continuity news. For news as it happens, subscribe to Continuity Central on Twitter.

How to advertise How to advertise on Continuity Central.

To submit news stories to Continuity Central, e-mail the editor.

Want an RSS newsfeed for your website? Click here