What prompted you to create the Resilience Health Check and who is it designed for?

Over the past few years, we’ve seen organisations of every size face increasing disruption, whether that’s cyber-attacks, supplier failures, regulatory changes or unexpected operational issues. What became clear is that many organisations believe they’re resilient, but very few have challenged that assumption.

The Resilience Health Check was created to help Boards and executive teams step back and ask the right questions. It’s meant as a conversation starter that helps leadership teams understand where they’re prepared and where there may be gaps that have been overlooked.

One of the strongest messages throughout the guide is that resilience isn’t demonstrated by documentation, but by behaviour. Why is that distinction so important?

Policies, plans and procedures all have an important place, but they don’t make decisions during a crisis, people do.

When an organisation is under pressure leaders have to make decisions quickly, often with incomplete information to adapt to a situation in flux. So organisations need to improve how people communicate, collaborate, and how they provide accurate and timely feedback to management, so decisions can be taken on the best information available.

Good documentation supports resilience, but behaviour is what ultimately determines the outcome.

The phrase “Test, don’t trust” really stands out. Why do organisations often place too much confidence in plans that haven’t been properly exercised?

It’s natural to feel reassured once a plan has been written and approved, but until it’s been tested under realistic conditions, it’s still based on assumptions.

Testing allows organisations to identify areas where plans don’t quite work, where responsibilities are unclear or where recovery expectations aren’t realistic. Testing and rehearsing also helps develop the thinking needed to successfully adapt to a changing situation in a crisis.

You really don’t want to discover or have to learn these things in a crisis.

Cyber incidents are increasingly becoming business crises rather than IT issues. How should Boards and executive teams prepare differently?

A significant cyber event can affect operations, customers, suppliers, regulatory obligations and organisational reputation all at the same time.

So resilience isn’t an ‘IT thing’ – executive teams, communications, legal, HR and operational leaders all have an important role to play. We often see crisis response struggling because IT does it’s best to solve the technical problems, but they’re not being given the direction they need to ensure the technical recovery aligns with the business priorities. Likewise, far too often have I seen management promise recovery timelines in communication that IT simply can’t deliver. This is why having an established crisis management structure that ensures clear and timely decision making and a good flow of information in all directions is so important.

If you could leave every organisation with one question from the Health Check to discuss at their next Board meeting, which would it be and why?

I’d probably leave them with the final question in the Health Check:

“If a major disruption began in the next six months, would we already have a clear crisis management structure and plans or would we be improvising them in real time?”

If that question prompts honest discussions around preparedness, decision-making and organisational culture, then it’s already achieving its purpose.

—————————————————————————————

You can find the full Resilience Health Check here: https://www.axians.co.uk/business-resilience-services/