How can societies prepare for extreme risks? That has been the question that Peter Power, vice chairman of the Resilience Association, has spent his career tackling. He spoke about his work to Jon Baston-Pitt, for an episode of the Planet Beyond podcast.
Power has helped the UK, Canadian, and Australian governments develop strategies for resilience, and was a member of the Institute for Public Policy Research’s National Security Commission, which produced the report Shared Responsibilities: A national security strategy for the UK. He also produced the UK government’s first guide to business continuity, Preventing Chaos in a Crisis.
To be able to bounce back from catastrophe, Power says that organisations must develop a ‘resilience mindset’. Many of the characteristics of this mindset, such as agility and adaptability, are easier to find in smaller organisations. In this episode, we’ll learn more about this mindset, and how larger private businesses, and the public sector, might adopt it. We’ll also find out what would be needed to develop a truly ‘whole of society’ response, as called for in a recent UK House of Lords report, Preparing for extreme risks: Building a resilient society.
We live in a world, says Power, where once rare risks have become commonplace. “So many risks have, quite frankly, ceased to become extreme. We are living in such a risk-rich environment. And it’s no wonder that the Collins dictionary ‘word of the year’ last year was ‘permacrisis’. In other words, we are in a constant state of crisis. We are no longer in that mythical age where something happened once in 100 years or once in 1000 years. It’s continuous. And that’s why we need to have a different approach.”
Hindsight, foresight, insight, oversight
That different approach is the adoption of a resilience mindset. The ideas Power explains are considered in more detail in the code of practice, BS 65000: Organisational resilience.
While Power has worked on business continuity, he says this is not the same as resilience. It’s not just about bouncing back after an incident. “Resilience is not resistance. Resilience is about anticipating, agility, and adaptability. It is conceptual as well as definable. And quite frankly, in the 21st century, it’s vital.
“Resilience spans entire organisations, it is very much where the whole is greater than the sum of its parts. Crises simply don’t fit into neat boxes these days, they quickly spill over to matters of perception, reputation and image.”
So how do we shape a resilience mindset? Power suggests four types of thinking and organisational practice that contribute to the mindset: hindsight, foresight, insight, and oversight. Hindsight is perhaps the easiest to describe: it’s learning from experience. But, it is not about blame, says Power: “We’re not looking at the blame game at all. But we do want people to be honest, to learn, to adapt, thrive, carry on, because the next crisis is probably coming down the line, but we haven’t seen it yet.
“Foresight, is searching for the possible opportunities, as well as the threats. And again, this demonstrates the difference between business continuity and resilience. Because the standard stresses thriving in uncertainty, it stresses looking for opportunities.
“Insight is generating that situational awareness, and situational awareness is being aware of what’s happening. Situational awareness is very broad. It is like looking at a radar screen: as it goes round and round, lots of little blips appear on it for various risks and threats and so on. It lets us see where what would otherwise be an inconsequential risk, has lined up with a dozen others, and then becomes a big risk.”
The final concept we should think about is oversight. “It’s about building a framework of governance and accountability,” says Power. “Aa lot of this does fall under ESG — and certainly the ‘G’ of Governance in that. It is very much a board responsibility. That again distinguishes it from business continuity, which is often seen as an operational matter. This isn’t, this is much broader.”
Risk, in the public and the private sectors
To adopt a resilience mindset, we need to accept risk, and to be quick to respond. That’s ideal for smaller private companies: they can take a risky strategy, if they think it might pay off. Overall, private risk taking helps generate new ideas, that push society forward.
But the public sector, which is responsible for ensuring essential services are not brought down, can’t take that approach. It’s not about the sort of people who work in these sectors. It’s more about what we expect of them, says Power.
“I don’t think we’ve got people queuing up to go through a door that says ‘I don’t like risks, therefore I work in the public sector’ or go through a door that says ‘Yeah, we love risk, come this way [into the private sector]’, it is just bound up in a much more philosophical way of how those areas work.
“We don’t want people in the public sector to be too quick on making decisions, on information which might be elusive. But we do want them to make decisions that are timely, that are relevant and—above all—are attainable.”
Can we bring that agile mindset, out of the world of startups, and into that of listed companies and public sector organisations? Power thinks we can. He spent his early career in the army, and then the police. Some militaries, like that of Russia, take a top down approach. But this ignores a key point about planning: ‘No plan survives contact with the enemy’. Organisations need to give their staff the ability to respond, when a crisis comes up.
“If somebody a bit lower down the chain says, ‘Here’s a better way of doing this, here’s a quicker way of doing that, that person should be thanked, not castigated. We should have a risk positive approach.”
But when your neck’s on the chopping block—when it’s your name as CEO that’ll be in the papers, when it’s you that has to appear before a parliamentary committee or judicial inquiry—it can be hard to let go of responsibility. But some leaders manage it.
“Sir Stuart Rose [now Lord Rose of Monewden], when he ran Marks & Spencers, understood that he wasn’t a very good crisis manager. So as soon as a crisis started to happen, he’d delegate that to somebody else, while he would do what he’s good at: run board meetings, face the camera, and say good things to the press, and so on. It’s very rare to find people like that now.”
Many large private companies have more resources to draw on in a crisis. But that can also make them slow-to-act and risk averse. “A large organisation has the capacity to absorb more shocks and still remain buoyant. They have mechanisms to reassure their shareholders and so on and so on. On the downside, large organisations can be organisational dinosaurs, they can be very, very slow in actually gearing up to deal with a crisis, to outmanoeuvre it, get in front of it, to stop it getting any worse.
“They’re going to be hidebound by a series of financial constraints and controls, and their governance might be so strict, it allows very little wriggle room and not enough agility. But they’re big and they can absorb shocks.”
Smaller organisations can be more agile, but they are often limited by resources. “They can’t put together big teams there, they struggle with succession planning. The speed that a small organisation can work is enviable, but if they take a hit, there’s absolutely no slack in the system to absorb any shocks.”
Take responsibility, delegate
If these smaller businesses are considered in isolation, we might say that their individual success or failure doesn’t matter, at least not to the country as a whole. But the truth is that—as a sector—they account for most of the economy in a country like the UK, and much of any countries vital infrastructure relies on the work of smaller organisations.
The new UK Resilience Framework proposes a model for handling risk in an agile manner. “They really do want to learn as best they can from the private sector. They are talking about partnerships, now, the government, between sectors and through experts being brought in to the government, to deliver an informed and vital work of resilience.”
At the same time, resilience needs leadership. The formation of a Resilience Academy, may play a vital role in bringing this leadership. Power quotes Oliver Dowden MP, Chancellor of the Duchy of Lancaster, Secretary of State for the Cabinet Office, and deputy PM, about the government’s aims.
“He is saying—and I loved this —that ‘a re-invigorated national exercise programme will test preparedness throughout their whole resilience system’.” That is, as Power says, a tall order. But, if the UK government and others can put models like this in place, providing national oversight while drawing on the foresight, hindsight and insight of private sector experts, then they might truly be able to build resilient societies.
