The UK’s national resilience framework has now been published. In this article, Richard Smith-Bingham, Executive Director, Marsh McLennan Advantage, explores key strengths of the framework as well as some important areas for further development, which are detailed further in a report for the National Preparedness Commission.
In his foreword to the UK Government Resilience Framework, quietly released in the week before Christmas 2022, the Chancellor of the Duchy of Lancaster notes the “unsettled and troubling times” that we face now and acknowledges that the UK must prepare for “crises in the next decade that will have far-reaching consequences and are likely to be greater in frequency and scale than we have been used to”.
The publication includes promises to strengthen the “frameworks, systems and capabilities which underpin the UK’s resilience to all civil contingencies risks”. But to what extent do the proposals represent a sound foundation for the way ahead? And what questions does the document raise about the extent of the government’s commitment, and its expectations of businesses, other organisations, and households?
Considered on its own merits, the framework has four key components to commend it, which are outlined below.
First, it signals a determination to shift from the default mode of dealing with the effects of emergencies, towards a stronger focus on prevention and preparation for acute and chronic risks through “targeted and evidenced prioritisation of investment”. Mindful of the unprecedented costs of responding to the Covid-19 pandemic and the energy crises over the past fifteen months, this intention is a vital starting point, although challenging to deliver on given the pressure on public finances.
There is also a strong emphasis on the local level and “protecting communities from the impacts of emergencies and crises,” with a particular focus on vulnerable and at-risk groups. Being better attuned to where and how crises affect households and economic activity should serve to sharpen responsive strategies and strengthen the business case for pre-emptive investment. A question remains as to what this protection comprises.
Second, to elevate the quality and consistency of organisational preparedness the framework shows strong interest in expanding the scope and use of resilience ‘standards’. Sensibly, these will be articulated separately for public sector entities, Local Resilience Forums, responder organisations, and the private sector – and reviewed periodically.
Building on this, the government undertakes to review existing regulatory regimes that focus on resilience to ensure they are “fit for purpose, particularly where these are used to assure [critical national infrastructure] sectors”. These might target existing gaps where regulatory emphasis has been on customer pricing and where the industrial landscape has changed immeasurably over the years. There is also the prospect that “in the highest priority sectors that are not already regulated, and for the highest priority risks, the UK Government will consider enforcing standards through regulation.” But the framework seems less sure of its commitment to this.
Third, the government is looking to enhance public sector mitigation and responsive capabilities. Part of this focuses on improving the quality and use of data in both pre-emptive and in-crisis decision-making – within the National Situation Centre and by Local Resilience Forums. Additionally, a new skills agenda will consider whether resilience can be “reflected more explicitly in the frameworks of government professions” and be complemented by a more extensive programme of exercising.
In terms of leadership, Chief Resilience Officers for each Local Resilience Forum area, backed with the “resources, support, mandate and levers to bring together the full range of partners”, will consolidate efforts locally. At a national level, a new Head of Resilience (a counterpart to the National Security Advisor) will “guide best practice, support adherence to resilience standards, and test planning in a meaningful and proportionate way” across Whitehall. Hopefully this postholder will have an authority that goes beyond advice.
Fourth, the framework sets out an important push towards greater transparency, engagement, and communication. At the highest level, this means greater accountability through an annual statement to Parliament that will include the government’s “understanding of the current risk picture, performance on resilience and current state of preparedness”. Government departments will also begin to measure and track investment in resilience, with a view to avoiding duplication and ensuring that resources are focused on strategic priorities and “emerging technologies and capabilities that could be critical to the UK’s resilience”.
The government will also refresh the National Security Risk Assessment process in a way that broadens the data and insights it draws on, fully embraces scenario thinking, and further clarifies roles and responsibilities. Inviting “external challenge from experts, academia, industry and the international risk community”, it will be shared with “partners throughout the resilience system (including those outside of government) as our default position”. This provides a basis for a more fulsome risk communications programme, where messages and mechanisms will be tailored for different groups – e.g., critical infrastructure operators, businesses, households, and vulnerable groups.
In terms of what is missing or underdeveloped, two distinct reservations are set out below, which are detailed further in our report for the National Preparedness Commission.
First, the determination to remain focussed on “civil contingency risks” feels somewhat dated and constrained. In a world characterised by connected risks with cascading impacts, national resilience and national security challenges frequently overlap. For example, the line between criminal-driven and state-affiliated cyber-attacks is profoundly blurred, and governments across the world are mindful not only about disruption and theft but also about the corrosive effects of co-ordinated hybrid threats, including persistent misinformation and disinformation campaigns that undermine democracy.
The forthcoming refresh of the Integrated Review of Security, Defence, Development and Foreign Policy will no doubt reference the growing geopolitical pressure on supply chains, noting decisions by UK and other governments that are already affecting strategic sourcing, investment, and technology transfer. Regarding environmental concerns, in the expectation of greater rainfall, where does flood risk management end and climate change adaptation begin?
Moreover, the focus on civil contingencies downplays other related aspects of resilience that are vital for future national prosperity. These include the successful delivery of major transformation agenda such as decarbonising the national energy system and delivering smart city programmes. A failure to incorporate better resilience at all levels in these endeavours risks fraught implementation, wasteful investment, and undesirable consequences that might be very hard to redress.
Second, although the framework presents a suite of “measures to broaden and strengthen the resilience system”, it reflects limited systems thinking itself about how the different measures fit together. Nor does it express any theory of change that would make the case for different forms of intervention. Although the document contains many references to frameworks, standards, and capabilities, there is much less on the levers of mobilisation needed to spur cultural change and ensure that as a nation we emerge from crises stronger rather than weaker.
Nor does the framework acknowledge the realities of policy conflicts, market failures, and societal inertia; it glosses over the issue of moral hazard and the frequent situations where there is a mismatch between those who stand to be impacted by a risk and those who have the power to address that risk. Appropriate risk-sharing arrangements need to be established to have systemic impacts on systemic risks.
References to “voluntary” standards, and regulation “only in the highest priority cases”, suggest a rather hopeful view of galvanising action – especially when there is also no suggestion of incentivising action and investment, as called for by the CBI recently to counter US and EU subsidy programs. Ultimately, strategic resilience and sustainable growth are two sides of the same coin.
It is surprising to see almost nothing on the role that government might play with regard to critical supply chains or the establishment of stockpiles where needed; curious to find no references to incentivising private investment into major projects or research and development that will enhance the nation’s resilience; and puzzling to see references to insurance solutions without acknowledging the need for greater public-private collaboration as the risk landscape becomes more complex, a development that will inevitably affect availability, coverage, and affordability.
Advanced economies across the world are rethinking their national resilience arrangements, evaluating the gap between what they have and what they need for the future, and recognising that resilience is critical for growth rather than a constraint. In doing so, they are identifying bold ideas and solutions that they would never have considered five years ago and are seeking to anticipate crises that are barely on the radar.
The framework shows the UK is also on this journey. While it is a welcome start, it does not as yet take the “much broader approach to resilience” that it claims and needs detailed strategising in the next stage to truly energise a ‘whole-of-society’ endeavour.
The UK’s national resilience framework has now been published. In this article, Richard Smith-Bingham, Executive Director, Marsh McLennan Advantage, explores key strengths of the framework as well as some important areas for further development, which are detailed further in a report for the National Preparedness Commission.
In his foreword to the UK Government Resilience Framework, quietly released in the week before Christmas 2022, the Chancellor of the Duchy of Lancaster notes the “unsettled and troubling times” that we face now and acknowledges that the UK must prepare for “crises in the next decade that will have far-reaching consequences and are likely to be greater in frequency and scale than we have been used to”.
The publication includes promises to strengthen the “frameworks, systems and capabilities which underpin the UK’s resilience to all civil contingencies risks”. But to what extent do the proposals represent a sound foundation for the way ahead? And what questions does the document raise about the extent of the government’s commitment, and its expectations of businesses, other organisations, and households?
Considered on its own merits, the framework has four key components to commend it, which are outlined below.
First, it signals a determination to shift from the default mode of dealing with the effects of emergencies, towards a stronger focus on prevention and preparation for acute and chronic risks through “targeted and evidenced prioritisation of investment”. Mindful of the unprecedented costs of responding to the Covid-19 pandemic and the energy crises over the past fifteen months, this intention is a vital starting point, although challenging to deliver on given the pressure on public finances.
There is also a strong emphasis on the local level and “protecting communities from the impacts of emergencies and crises,” with a particular focus on vulnerable and at-risk groups. Being better attuned to where and how crises affect households and economic activity should serve to sharpen responsive strategies and strengthen the business case for pre-emptive investment. A question remains as to what this protection comprises.
Second, to elevate the quality and consistency of organisational preparedness the framework shows strong interest in expanding the scope and use of resilience ‘standards’. Sensibly, these will be articulated separately for public sector entities, Local Resilience Forums, responder organisations, and the private sector – and reviewed periodically.
Building on this, the government undertakes to review existing regulatory regimes that focus on resilience to ensure they are “fit for purpose, particularly where these are used to assure [critical national infrastructure] sectors”. These might target existing gaps where regulatory emphasis has been on customer pricing and where the industrial landscape has changed immeasurably over the years. There is also the prospect that “in the highest priority sectors that are not already regulated, and for the highest priority risks, the UK Government will consider enforcing standards through regulation.” But the framework seems less sure of its commitment to this.
Third, the government is looking to enhance public sector mitigation and responsive capabilities. Part of this focuses on improving the quality and use of data in both pre-emptive and in-crisis decision-making – within the National Situation Centre and by Local Resilience Forums. Additionally, a new skills agenda will consider whether resilience can be “reflected more explicitly in the frameworks of government professions” and be complemented by a more extensive programme of exercising.
In terms of leadership, Chief Resilience Officers for each Local Resilience Forum area, backed with the “resources, support, mandate and levers to bring together the full range of partners”, will consolidate efforts locally. At a national level, a new Head of Resilience (a counterpart to the National Security Advisor) will “guide best practice, support adherence to resilience standards, and test planning in a meaningful and proportionate way” across Whitehall. Hopefully this postholder will have an authority that goes beyond advice.
Fourth, the framework sets out an important push towards greater transparency, engagement, and communication. At the highest level, this means greater accountability through an annual statement to Parliament that will include the government’s “understanding of the current risk picture, performance on resilience and current state of preparedness”. Government departments will also begin to measure and track investment in resilience, with a view to avoiding duplication and ensuring that resources are focused on strategic priorities and “emerging technologies and capabilities that could be critical to the UK’s resilience”.
The government will also refresh the National Security Risk Assessment process in a way that broadens the data and insights it draws on, fully embraces scenario thinking, and further clarifies roles and responsibilities. Inviting “external challenge from experts, academia, industry and the international risk community”, it will be shared with “partners throughout the resilience system (including those outside of government) as our default position”. This provides a basis for a more fulsome risk communications programme, where messages and mechanisms will be tailored for different groups – e.g., critical infrastructure operators, businesses, households, and vulnerable groups.
In terms of what is missing or underdeveloped, two distinct reservations are set out below, which are detailed further in our report for the National Preparedness Commission.
First, the determination to remain focussed on “civil contingency risks” feels somewhat dated and constrained. In a world characterised by connected risks with cascading impacts, national resilience and national security challenges frequently overlap. For example, the line between criminal-driven and state-affiliated cyber-attacks is profoundly blurred, and governments across the world are mindful not only about disruption and theft but also about the corrosive effects of co-ordinated hybrid threats, including persistent misinformation and disinformation campaigns that undermine democracy.
The forthcoming refresh of the Integrated Review of Security, Defence, Development and Foreign Policy will no doubt reference the growing geopolitical pressure on supply chains, noting decisions by UK and other governments that are already affecting strategic sourcing, investment, and technology transfer. Regarding environmental concerns, in the expectation of greater rainfall, where does flood risk management end and climate change adaptation begin?
Moreover, the focus on civil contingencies downplays other related aspects of resilience that are vital for future national prosperity. These include the successful delivery of major transformation agenda such as decarbonising the national energy system and delivering smart city programmes. A failure to incorporate better resilience at all levels in these endeavours risks fraught implementation, wasteful investment, and undesirable consequences that might be very hard to redress.
Second, although the framework presents a suite of “measures to broaden and strengthen the resilience system”, it reflects limited systems thinking itself about how the different measures fit together. Nor does it express any theory of change that would make the case for different forms of intervention. Although the document contains many references to frameworks, standards, and capabilities, there is much less on the levers of mobilisation needed to spur cultural change and ensure that as a nation we emerge from crises stronger rather than weaker.
Nor does the framework acknowledge the realities of policy conflicts, market failures, and societal inertia; it glosses over the issue of moral hazard and the frequent situations where there is a mismatch between those who stand to be impacted by a risk and those who have the power to address that risk. Appropriate risk-sharing arrangements need to be established to have systemic impacts on systemic risks.
References to “voluntary” standards, and regulation “only in the highest priority cases”, suggest a rather hopeful view of galvanising action – especially when there is also no suggestion of incentivising action and investment, as called for by the CBI recently to counter US and EU subsidy programs. Ultimately, strategic resilience and sustainable growth are two sides of the same coin.
It is surprising to see almost nothing on the role that government might play with regard to critical supply chains or the establishment of stockpiles where needed; curious to find no references to incentivising private investment into major projects or research and development that will enhance the nation’s resilience; and puzzling to see references to insurance solutions without acknowledging the need for greater public-private collaboration as the risk landscape becomes more complex, a development that will inevitably affect availability, coverage, and affordability.
Advanced economies across the world are rethinking their national resilience arrangements, evaluating the gap between what they have and what they need for the future, and recognising that resilience is critical for growth rather than a constraint. In doing so, they are identifying bold ideas and solutions that they would never have considered five years ago and are seeking to anticipate crises that are barely on the radar.
The framework shows the UK is also on this journey. While it is a welcome start, it does not as yet take the “much broader approach to resilience” that it claims and needs detailed strategising in the next stage to truly energise a ‘whole-of-society’ endeavour.
Share this story
Related posts