This document discusses the importance of organizational resilience and its link to effective crisis management. It argues that resilience is developed through targeted investments in key areas like people and culture, infrastructure design, command and control procedures, threat assessment, technology, and stakeholder interaction. Having high resilience maturity raises an organization's crisis threshold. The author advocates for regular staff training exercises to test plans and develop a "crisis ready" mindset among employees.

1. Exploring the link between organisational resilience and crisis
management
Alex Serrano MBCI
Deloitte Touche Tohmatsu
In a world increasingly dominated by interest in the headline-obsessed short news cycle, fashion
trends and the minutiae of celebrities’ lives, core values that underpin the strength of our
communities are sometimes overlooked, or even mocked as a relic of ‘history’. One such value is
‘personal resilience’, the character, grit and determination that people demonstrate every day in
achieving their personal goals and in making the world a better place for those around them.
It is this ‘personal resilience’, which to a large degree defines the Australian character and is rooted
in its difficult early history, that has enabled the transformation of an unyielding land into a rich,
productive, and proud country that has survived the exigencies of war, pandemic disease,
dislocation and distance, and countless natural disasters. It is central to the egalitarian spirit of
Australians, and their unsentimental but optimistic attitude to the sometimes significant challenges
that life presents.
This is as true as much today in 2008 as it was in 1908. In 1908 the Australians Douglas Mawson
and Edgeworth David were key members of Ernest Shackleton’s team that was the first to climb
Mount Erebus in Antarctica. In that same year, the worst train crash in Victoria’s history occurred at
Sunshine station, when a Melbourne-bound mail train and a passenger train collided on Easter
Monday, injuring 431 and killing 44 people. Tragic and momentous events like these in the nation’s
history have brought out some of the best human qualities including personal resilience, ingenuity,
selflessness, courage, compassion and practicality.
This decade, terror attacks in Bali and Jakarta, home-grown terror threats in Australia, increasing
bouts of anti-corporate civil protest, unprecedented drought, and the yearly threat of major bushfire
and other extreme weather events have increasingly thrown Australians back upon those so-called
‘old fashioned’ personal qualities that define character and help build communities that can survive
shocks and disaster.
However, there are significant differences between threats prevalent in 2008 and 1908. The nation’s
critical infrastructure, in utilities, telecommunications, energy, financial services, food production &
distribution, and health & community services, are far more complex and interlinked than before.
They are also heavily dependent on technologies that did not exist a century ago.
These days, organisational survival is counted in minutes and days, not weeks and months.
Companies that cannot restore material services in short order risk losing substantial market share
and possibly face losing their licence to operate, incurring hefty fines and claims for compensation.
Organisations that suffer disasters resulting in injuries to their staff face severe public opprobrium if
they fail to manage human needs effectively.
Corporate threats are increasing. Between 1994 and 2003, 50% of the largest global companies
suffered declines in share price value of more than 20% in a single one-month period. Up to half of
this group took two years or more to recover to the share price level before the drop occurred. A
disproportionate number of these value loss events occurred around ‘low-frequency, high-impact’
events such as September 11.i
That is why the term ‘resilience’ is coming into prominence within the management boards of
public and private enterprises alike all across Australia. The country’s corporate and community
1

2. leaders increasingly understand the relevance of a concept that encompasses both the technological
and systemic, as well as the human and cultural factors, that help organisations and communities
thrive in an era of uncertainty, ever-increasing change, competitive pressures, and exogenous
threats.
It is no longer acceptable that responses to corporate threats are treated in a piecemeal, ‘siloed’ way.
Front-line managers cannot assume that ‘Information Technology is someone else’s responsibility’,
unaware of the recovery capabilities in place for their key systems. IT disaster recovery managers
and business continuity teams both need to know and understand what the other is doing.
Organisations are not abandoning the traditional risk management disciplines of IT service
continuity and business continuity management. These disciplines are still relevant and vital.
Rather, they seek ways that focus on ‘hardening’ the organisation against risks, so that their
organisations are less crisis-prone, or such that the negative effects of disruptions are mitigated by
an inbuilt infrastructure resilience, redundant systems, and well-trained staff.
Risk intelligent executives place as much
emphasis on identifying and mitigating
significant corporate risks through a continual
TECHNOLOGY TOOLS
process of risk assessment, risk transfer and
mitigation before an event occurs, as on plans
that help them restore critical activities
STAKEHOLDER THREAT ASSESSMENT
& PREVENTION
INTERACTION
CRISIS
afterwards.
MANAGEMENT
These executives do not expect to find a ‘silver
bullet’ to organisational resilience. Rather, they
understand that resilience is developed as a
COMMAND & CONTROL
PEOPLE & CULTURE
PROCEDURES
result of making targeted investments in
capability. Crisis events are managed first and
INFRASTRUCTURE
foremost by people, supported by systems,
RESILIENCE & DESIGN
processes, and technology, in that order.
Organisations should focus on a resilience framework that maximises organisational capacity in the
key areas of:
• people and culture, supporting a coherent and coordinated human response during periods
of stress and incomplete information;
• infrastructure resilience and design that eliminates single points of failure and reduces the
vulnerability of an organisation to external impacts;
• command and control procedures that enable effective and rapid crisis decision-making;
• effective threat assessment & prevention that is both inwardly and outwardly focussed;
• technology tools that produce simple management reports facilitating decisive crisis
decision making through the rapid interrogation of highly complex multi-dimensional data
sets; and
• clearly defined processes for stakeholder interaction, so that the communication links
between an organisation, its business partners partners, government and community
stakeholders positively enhance corporate strength through pre-planning and crisis response.
2

3. By enhancing their resilience
to threats, organisations can High maturity
raise the threshold beyond
which a problem triggers a
crisis threatening their very
survival. An organisation High threshold trigger
Organisational
with high ‘resilience Resilience
maturity’ exhibits a higher Maturity
crisis threshold trigger point
than other organisations. Low threshold trigger
Low maturity
A recent study found that
Low impact High Impact
25% of companies that Incident Intensity
experienced an IT outage
lasting between two and six days went bankrupt immediately, while 93% of companies that lost
their data centre for at least ten days went out of business within a year.ii
Mitigating foreseeable risks need not be expensive or difficult. A simple plan to store critical IT
data back-ups off site on a regular basis may be the simple precaution that saves a business when
disaster strikes the head office or the data centre. Sometimes more complex strategies are needed,
but this is not the starting point.
It is important for management to assess their ‘current’ and ‘desired’ state of organisational
resilience before embarking on any resilience-building activities. All efforts must be tailored to the
actual risk profile and environmental threats faced by the organisation – there is no ‘one-size-fits-
all’ for corporate investment of limited time, money and human resources in resilience planning.
Significantly, organisations increasingly understand the human dimension of resilience. Crisis
events put staff under unprecedented levels of stress that, despite increased automation and
powerful decision-support systems, create the risk that people will make the wrong decisions under
pressure, potentially exacerbating negative human and financial impacts.
Plans that are untested are unproven – and since it is people that are fundamental to the execution of
all plans, it is vital that staff at all levels be given regular opportunity to participate in exercises that
simulate corporate business disruptions and crisis events, to identify and iron out deficiencies in
paper-based plans, and to develop the kind of ‘crisis ready’ mentality that has allowed exceptional
individuals like Douglas Mawson, as well as everyday Australians, to meet the challenges of the
past. The same tried and true qualities will continue to provide Australians with a well-founded
confidence that they will meet the challenges of the future with the same unassuming resoluteness
and strength of character.
Alex Serrano is a Sydney-based business continuity management specialist in the Risk Services practice of Deloitte
Touche Tohmatsu. He provides audit and advisory services to corporate and government sector clients in organisational
resilience, business continuity, crisis management, and IT service continuity.
i
Deloitte Touche Tohmatsu, ‘Disarming the Value Killers’, 2005
ii
Economist Intelligence Unit, 2007
3