Leading Resilient Organizations: From New Normal to Never Normal

Resilience has become one of the most sought-after strategic advantages in recent times. The COVID-19 global pandemic created seismic shifts in how we think about work, how work gets done, and how organizations manage through uncertainty and new protocols for health and well-being. Strategy experts, senior leaders and frontline managers are looking for the resilience formulas to anticipate, cope and adapt.¹ To manage and lead in these times requires a steadfast approach to developing resilience as part of an organization’s strategic competitive advantage. 

But what is organizational resilience, really? By what means does it come about? And how can leaders and managers leverage resilience? What frameworks might we apply to develop resilience? And what are some principles and levers of resilience?

Organizational resilience refers to the capability of an organization to be prepared for disruption and to adapt and thrive in a changing environment. It also includes an organization’s ability to withstand pressures and stressors that impact business operations and to rebound from the potential setbacks. 

Resilience requires a set of capabilities including relational behaviors, activities, expertise, capital reserves, policies, redundant logistics and contingency plans. A resilient organization is one that has set in place before a setback a series of strategic resources. In this sense, organizational resilience resources are a kind of stock, stored and prepared. When faced with setbacks, stored resilience can be activated.² An emergency, unexpected event or sudden shift triggers a range of responses and engages leaders and employees in new ways of re-evaluating, working and interacting.

Organizational resilience resources are a kind of stock, stored and prepared. When faced with setbacks, stored resilience can be activated.

The Never Normal

We are in a critical era. We are responding to and recovering from a series of disruptive events that most believed were unimaginable. We are also comprehending the enormity and long-term ramifications of climate change, biodiversity loss, political uncertainty, social change, economic turbulence and rapid digitalization, which will transform all organizations and societies in the coming decades. Problems and changes in one part of the world propagate and cascade quickly. The current Ukraine crisis has highlighted how intertwined globally our energy, trade, financial, communications and security systems are, making these systems susceptible to ongoing disruption. As we move beyond the COVID-19 crisis, people talk about the “new normal” to describe the world that lies ahead, but this era would be better described as the “never normal,” a period of constant, unpredictable change and disruption. 

The most successful organizations in the “never normal” will be those that are able to anticipate, prepare for, respond and adapt to incremental change and sudden disruptions to survive and prosper.³ When faced with adversity we see certain businesses reinvent themselves in ways few would have thought possible. Resilience can be a “strategic enabler” that can help organizations seize the fresh opportunities and “bounce forward.” 

Organizational resilience has been pushed firmly toward the top of the agenda for boards and the senior management teams of organizations of all types. An important feature of organizational resilience is the ability of leadership to adapt and improvise in the moment. To do so, they lead with vision amid difficulty. Vision in this sense is not a future view of the organization’s realized strategy, but rather it is the vision just to see a few steps beyond the crisis. But, what precisely is organizational resilience and what practical steps can business leaders take to develop it? 

Four Capabilities that Build Organizational Resilience

Our research⁴ found that organizational resilience isn’t a single capability. Instead, organizational resilience varies in terms of both mindset and design. In organizations with defensive mindsets, people regard changes and challenges as threats and they use words like “stopping,” “maintaining,” “preventing” or “protecting” to describe resilience. In organizations with progressive mindsets, people see changes and challenges as opportunities and use the language of “making,” “increasing,” “growing” or “extending.” 

In terms of design, some organizations are organized for consistency in terms of structure, processes and behaviors, whereas others are designed for flexibility. Organizations designed for consistency support systems, structures, processes and relationships that maintain clearly defined routines and minimize the extent and effects of unpredictability.⁵ Organizations designed for flexibility support the ability to anticipate, prepare for and adapt their structures, systems, relationships and behaviors.⁶ 

When put together we identified four core capabilities for resilience (see graphic).

Robustness (defensive and consistent) is the capability to maintain functionality, viability and relationships when exposed to a variety of external or internal stressors and disruptors. This is often achieved by preventative control systems, safeguards, standardized procedures and compliance. However, too much robustness can lead to rigidity and an uncompetitive organization.

Responsiveness (defensive and flexible) is the capability to respond to match the requirements of a changing and unpredictable environment and recover quickly from disruption. This is typically created by the mindful action of people who use their expertise and teamwork to deal with unfamiliar or challenging situations. However, too much responsiveness can create fragmentation in the form of coordination and communication issues between groups.

Realization (progressive and consistent) is the capability to improve current systems and extend existing capacity. This is often accomplished by performance optimization and exploiting current technologies to serve present customers and markets more efficiently and effectively. However, too much optimization can produce brittleness with the removal of slack (dubbed waste) reducing the ability of the organization to absorb disruptions. Further, organizations that “stick to the knitting” can become obsolete when customer trends change.

Regeneration (progressive and flexible) is the capability to reimagine, reinvent and radically transform the business. This is generated through adaptive innovation and creating new products, services or markets. However, too much innovation can be overwhelming and costly and in a “fail fast” environment people can take excessive risks and contravene rules and regulations. 

These four core capabilities need to be combined and balanced to achieve a fit-for-purpose approach. The particular combination of all four core capabilities will vary according to the nature of the organization and its business services and the environment and circumstances it faces. The approach will also need to alter over time, as internal and external factors dictate. 

Five Steps to Build Organizational Resilience

Thinking about the demands of the “never normal” and building the capability for resilience across an entire organization can feel overwhelming. Most of the organizations we have worked with have found that it is better to start with a small number of pilot initiatives focused on important business services. The following five-step approach has proven useful in implementing and embedding resilience in a range of organizations across different industries:

1. List your important business services. What needs to be resilient? The latest thinking suggests that organizations should focus attention on building resilience into the important business services that they provide to external end-users. This is different from the traditional focus on building resilience into assets or facilities, internal functions, processes, projects or goals. A business service needs to have a distinct outcome and be non-channel specific. For example, “withdrawing cash” would constitute a business service for a bank, “withdrawing cash through an ATM” would be too specific. Examples of business services include customers’ ability to obtain drinkable water (water company); customers’ ability to complete journeys (transport provider); customers’ ability to access learning resources (university); customers’ ability to make a payment (bank). Most organizations have a finite number of businesses services and even the largest banks rarely have more than 20. Not all service outcomes are equal in importance, some will be considered by stakeholders to be “essential,” so start with these.

2. Define your impact thresholds. How resilient does the business service need to be? Defining impact thresholds involves discussing and setting measurable levels (e.g., time, volume, value) of impact that would (i) signal urgent attention and (ii) be considered unacceptable or intolerable. Agreeing on a shortlist of appropriate metrics is vital. We tend to use a five capitals approach for developing leading and lagging indicators of resilience. Some of the questions we ask to create impact thresholds include:

• Human: At what level (e.g., time, volume, value, etc.) would disruption to the business service create harm or detriment to an external end-user or another critical stakeholder? How many clients which use the service would be impacted (e.g., due to holding major market share of the service; lack of viable alternatives)? To what extent would vulnerable customers be adversely impacted?

• Social: At what level (e.g., time, volume, value, etc.) would disruption to the business service damage your brand or reputation? Would it be a breach of any legal or contractual requirements? Would it cause a severe loss of confidence and trust in the organization?

• Built: At what level (e.g., time, volume, value, etc.) would disruption to the business service have an adverse operational impact (e.g., reduction in capacity)? To what extent would it adversely impact the delivery of your other business services? How quickly and easily could your operations be recovered post disruption?

• Financial: At what level (e.g., time, volume, value, etc.) would disruption to the business service result in financial cost (e.g., loss of revenue, cost of repair, fines) for the organization? At what level would there be an adverse impact on investment decisions? At what level would it put at risk the very existence or financial viability of the organization? At what level would it threaten the stability of the market, sector and broader system?

• Natural: At what level (e.g., time, volume, value, etc.) would disruption to the business service create an adverse or irreversible impact on the natural environment?

3. Create a resilience blueprint of your business services. What resilience does the business service have? A resilience blueprint provides a broad overview of how the business service is delivered, end to end, front to back and across the whole enterprise. The blueprint is important because it gives teams a zoomed-out view of all things needed to come together to deliver the business service. The resilience blueprint can highlight any single point of failure, vulnerability, vital interface, critical step (point of no return) and important decision point. When working on business services people often get lost in the details, making it very easy for the respective teams working on parts of the service to lose track of the end-to-end offering they are providing to users. With a zoomed-out view that a service blueprint provides, teams who are examining the resilience of their service can use it to step back and think about the bigger picture. It can function as a useful reminder to teams of the wider problem they are helping solve and inspire them to come up with a wider range of new solutions if resilience is compromised. 

4. Stress test your business services. What resilience does the business service need? The service blueprint should be subjected to testing using severe but plausible, risk agnostic scenarios. What we mean by risk-agnostic is that from a resilience perspective, we are less interested in what might cause disruption (e.g., a hurricane, a flood, a technical fault), instead, we assume that disruption (e.g., to your power supply) has materialized. Once the scenario has been identified, you can stress test your ability to remain within defined impact tolerances. Stress testing is different to running a crisis response simulation. The former tests your organizational resilience no matter what the disruptor and the latter evaluates your ability to respond to a specific risk. The goal of stress testing is to stretch the business service until it breaks. In this example, we could “dial” up the power supply disruption from say 10 minutes, to an hour, then a day, then a week. Disruptors can also be combined in a stress test. For example, to the power supply disruption, we could add equipment failure and then add the absence of key staff etc. Some organizations use modelling and digital twin techniques to simulate the performance of a business service, enabling “what if” scenario planning. Modelling allows a company to explore choices and possible changes, including all the impacts, dependencies and trade-offs. For example, this approach has been used to analyze supply chain resilience. It is gaining more attention due to technical and computational capabilities and advanced analytics. However, modelling doesn’t have to be too complex to achieve real benefits.

5. Ideate and prototype your interventions to enhance resilience. How to improve the resilience of the business service? This step involves examining each business service and considering changes to enhance resilience based on the four resilience capabilities outlined earlier. The choices include increasing the robustness (e.g., adding controls, safeguards, redundancy, compliance, oversight/audit); building responsiveness (e.g., increasing diversity and flexibility by design, developing psychological safety, fostering teamwork and communication); enhancing realization (e.g., improving processes, seeking efficiency gains, enhancing knowledge and skills); fostering regeneration (e.g., encouraging experimentation and creativity, hiring people with different perspectives, giving employees time and space to innovate, encouraging collaboration). Prototyping these interventions aimed at enhancing the resilience of the business service gives people the opportunity to bring their ideas to life and test their practicability. Prototyping can identify whether the implemented changes would have been successful in the event of an actual disruption.

End Note

As we emerge from the global pandemic, we have witnessed many ways resilience was activated. We saw how leaders engaged both defensive and progressive mindsets while at the same time enacting both consistent and flexible systemic responses. We saw organizations mobilize and deploy a range of material and relational resources. All the above adds up to an actionable agenda for business leaders. 

We are entering a new period of uncertainty and change, with an ever-increasing possibility of disruption. As our world becomes ever more complex, the potential for disruptive events in the future will only increase. While we know that crisis leadership is about who a leader is and how a leader responds, we also know that building resilience now can future proof our organizations and societies against increasing disruption. Organizational resilience must remain at the top of the to-do list for business leaders in every sector. 

David Denyer, Ph.D., is a Professor of Leadership and Organizational Change and Strategic Business Director at Cranfield School of Management. He leads the Cranfield University multi-disciplinary Resilience Grand Challenge. He can be reached at david.denyer@cranfield.ac.uk.

Edward H. Powley, Ph.D., is an Associate Professor of Management at the Naval Postgraduate School in ­Monterey, Calif., where he teaches organizational behavior and ­positive social connections, particularly in times of trauma and harm. He can be reached at ehpowley@nps.edu.

Brad Winn, Ph.D., is a Professor of Practice at the Covey Leadership Center and ­Executive MBA Director in the Huntsman School of ­Business at Utah State University. He serves as a Senior Editor for People + Strategy and is the Principal of Winn ­Consulting Solutions. He can be reached at brad.winn@usu.edu.

References

¹ Ducheck, S. (2020). ­Organizational ­resilience: A capability-based ­conceptualization. Business Research 13 (1).

² Powley, E. H. (2009). Reclaiming ­resilience and safety: Resilience ­activation in the critical period of crisis. Human Relations, 62 (9): 1289-1326.

³ Denyer, D. (2017). Organizational resilience: A summary of academic evidence, business insights and new ­thinking. BSI and Cranfield School of Management.  

⁴ Denyer, D. and Sutliff, M. (2021). ­Resilience reimagined: A practical guide for organizations. National Preparedness Commission, Cranfield University and Deloitte. 

⁵ Powley, E. H., & Taylor, S. N, (2014). Critical incident approach to crisis management education: ­Facilitating and fostering resilience and ­healing through ­leaders. Journal of ­Management ­Education, 38(4).

⁶ Denyer, D. (2017). Organizational resilience: A summary of academic evidence, business insights and new thinking. BSI and Cranfield School of Management.