This article by Bobbie Ramsden-Knowles, Crisis and Resilience Partner, PwC UK, explores different facets of how resilience can unlock value, and sets out the business case for why leaders need to take a more strategic approach to resilience and the practical ways to achieve this, including the right investments in people, technology and data.
From the pandemic to war and a cost of living crisis, the amount of disruption of recent years – which at times has felt like dodging rocks in an avalanche – isn’t in itself a new phenomenon. We only have to look back to the 1970s to see an all too familiar backdrop of strikes, spiralling inflation, political instability, geopolitical tension and an oil crisis. What is different now is the speed and interconnected nature of these risks, amplified by our dependence on technology in today’s digital economy, and the wider threat this poses to the resilience of organisations and wider society.
For the World Economic Forum, which has coined the term ‘polycrisis’, it’s the collective impact of individual disruptive events that has the potential to far exceed the individual parts. Complex dependencies and interdependencies across people, organisations and geographies can create a cascading effect, causing sudden and catastrophic impacts on the operation of businesses, public services, financial markets and then ultimately, the public.
Take the blockage of the Suez Canal by the Ever Given container ship in 2021, where temporary closure of this key trading route impacted around 400 vessels and global trade worth $9.6bn, disrupting global supply chains for months afterwards. Or the ransomware attack on the Health Service Executive of Ireland in 2021, which resulted in total loss of IT, leading to healthcare services being severely disrupted and theft of the personal data of staff and patients. Taking several months, the publicly stated cost of recovery to date is €80m.
Looking forward, you can add uncertainty and risk into this mix around emerging technologies such as artificial intelligence (AI), ageing demographics, increasing regulatory change as well as the existential threat from climate change. It is clear that a new approach to resilience is needed. According to PwC’s 26th annual CEO survey, just under a quarter (22%) of UK CEOs believe their business will not be economically viable within a decade on its current course.
Mindset and culture needs to change. This isn’t about a defensive, batten down the hatches approach to risk. Instead, led by human insight and understanding, resilient organisations are able to harness the power of technology and data to create panoramic vision beyond traditional siloed risk management approaches. They are able to flex and adapt whatever the disruption, protecting what matters most while also embracing change and confidently taking the risks necessary to unlock new opportunities and create growth.
Looking at resilience differently – value, reputation, trust
Strategic resilience is as key to value creation as it is to value protection. According to research by Oxford Metrica and PwC examining the impact on shareholder value of 45 major corporate crises since the global financial crisis of 2008; a more resilient response to disruption can not only minimise damage to reputation and shareholder value in the short term, but actually increase it in the long term.
The research found that organisations which demonstrated greater resilience lost less than 5% of shareholder value in the immediate aftermath of a crisis, compared to a loss of more than 11% for organisations that didn’t display resilient characteristics and capabilities. Crucially, after 30 days the more resilient organisations started to show sustained recovery in value; and by 250 days, those organisations even add a further 10% in shareholder value, compared to the less resilient organisations, which suffered on average a 15% reduction in shareholder value over that time period.
Plugging the resilience gap
Many organisations overestimate their ability to deal with disruption due to risks being deemed low probability, leading to lack of investment in resilience and misplaced confidence in their ability to handle a disruptive event. But low probability doesn’t mean no probability, as seen by the spate of damaging and disruptive ‘1 in 100 years’ flooding events from Storms Desmond, Ciara, Dennis and Jorge in the last 16 years.
There can also be overconfidence in preparedness for dealing with disruption. Organisations can feel bolstered – either because they haven’t experienced many crises or because they survived those they confronted. But the PwC Global Crisis and Resilience Survey 2023 reveals a clear confidence gap – despite indicating confidence in their ability to navigate disruption, only a third of the 2,000 organisations surveyed worldwide have the proper foundational elements in place to support resilience, leaving themselves exposed to a number of threats.
The dependency of businesses and government on ageing systems and technology and a lack of awareness of the potential impact of software failures, is also an elephant in the room. A report by the National Preparedness Commission warns that the software element of digital systems failure is a cost to the economy and society, which will only increase as software has become a utility, is in wider usage, and more vulnerable to failure.
A post-pandemic report by the National Audit Office (NAO) highlighted the UK’s vulnerability to emergencies that affect the whole of government, society and the economy, and the need to strengthen national resilience to prepare for future risks of this scale.
Against this resilience capability and mindset gap, expectations of resilience have also changed. PwC’s deliberative research workshops with a cross-section of the UK public, run by Jigsaw Research, show how the experience of Covid-19 and the cost of living crisis have raised people’s expectations – as citizens, consumers and employees – of business and government – to maintain core services, provide support and protect national infrastructure, whatever the disruption. Investors and regulators are also putting resilience – both financial and operational – under greater scrutiny, particularly around the growing high impact threats from cyber-attacks and climate change to the survivability and viability of organisations.
How to evolve for disruption
PwC recently brought together wide-ranging insights from those with the greatest stake in the resilience of organisations across the UK, holding over 100 conversations with business executives, investors, government and regulators and, crucially, citizens within the UK. The resulting Rethink resilience research sets out the business case for why leaders need to take a more strategic approach to resilience and – by making the right investments in people, technology and data – four clear and practical ways to get there. These are:
1. Upgrade your radar
Change the way you see risk and look for trouble before it finds you. Organisations most able to mitigate, withstand and recover stronger from a crisis all have exceptional radars for risk, understanding the breadth and depth of threats and what they mean for wider resilience. Identifying and addressing root causes early, rather than treating symptoms, gives you the chance to move fast, adapt and turn disruption into opportunity.
2. Build strength where you need it
Choose where you want to thrive and win and where you can’t afford to lose. Understand why you want to be resilient and prioritise investment based on what’s critical to your organisation and stakeholders. What are the things that would destroy your business fastest? Start by identifying your most important and critical services – rather than systems – and understanding what level of vulnerability is acceptable, assuming disruption will happen. When would interruption to a core business service go from being inconvenient to intolerable – from a customer, financial, reputational and operational perspective?
3. Prime your immune system
Embracing disruptive events with confidence requires building layers of resilience – from your employees and customers, to your leadership and the Board – so that you’re ready for any scenario. The foundation of this immunity is investing in the wellbeing and skills of your people and empowering them with the right technology. It’s important to be confident that employees are clear about how the organisation works, what it cares most about and the role they will play. This allows you to flex resources quickly so that people’s focus, roles and responsibilities can be adjusted to get behind the shared purpose.
4. Detoxify failure
Change culture and mindset to expect and accept bad things will happen. Risk management frameworks, risk appetites and business continuity plans can’t always prevent bad things happening, so plan for the worst. The tone from the top is a critical success factor in achieving this change. Detoxifying failure requires a culture of openness and transparency around your vulnerabilities. Give all voices a place in the room, and listen to both the foretellers of doom and the eternal optimists to encourage a mindset that expects and accepts bad things will happen, even when you hope for the best. Being inclusive also means knowing who your experts are during a disruptive event and listening to them, without making this hierarchical. Always be curious and ask, ‘what if’.
By changing mindset and making the right strategic investments – boosting data capabilities and tech-enabling their people – resilient organisations are equipped to protect value in the face of short-term economic and geopolitical challenges, while also adapting to create value and long-term growth amid existential threats such as climate change and cyber-attacks. In turn, this creates important wider societal outcomes through economic stability, sustainability and services people can rely on, as well as building trust – boosting the resilience of the wider population as an outcome.
PwC’s full Rethink resilience research is available for view on their website.