RiskUKAugust2017

Resilience Revisited: Turning Our
Attentions To Successes and Failures
Despite widespread
acknowledgement of
the importance of
‘resilience’ to today’s
organisations, in
practice a number of
questions remain
unanswered. Allison
Wylde suggests that,
despite the emergence
of standards and
research, there’s still
deliberation on an
agreed definition for
the term, while
methods for
understanding and
applying resilience are
somewhat unclear
Dr Allison Wylde BSc (Hons) MA
FRGS FHEA DIC (Imperial):
Faculty Member with Cardiff
University’s Business School
and a Research Fellow at
Cardiff University’s Crime and
Security Research Institute
50
www.risk-uk.com
Arguably, the prevailing position around the
definition of resilience and its
understanding and application appears to
arise partly as a result of its trans-disciplinary
nature. As a consequence, a number of
different schools of thought, theories and
approaches have developed over the years, in
turn giving rise to so-called ‘gurus’ on the
discipline aside from those practitioners
operating in this specialist realm.
Findings from a recent UK survey which
asked what resilience means within private
sector organisations found that more than 80%
of respondents named IT disaster recovery as
the most important element of resilience. 55%
suggested that it was security and 45%
favoured Health and Safety.
There’s an important gap in our knowledge
and understanding of resilience. Further
research might assist our comprehension of the
different ways in which resilience may be
understood and applied and its performance
assessed. Clearly, further work must be
undertaken in discussion with practitioners and
those companies responsible for resilience
plans being implemented.
In addition, the specific requirements for
each company, setting and industry need to be
accounted for. In the here and now, we can
focus on recent empirical studies and
discussions concerning the topic of a resilience
‘success and failure’-style approach. The
overarching aim for all of us is to make sense of
resilience as a discipline.
In the field, practitioners typically
concentrate their focus on a particular stage or
phase of resilience. For example, the business
continuity sector has been concerned with the
stages of recovery from – and to – a ‘business
as usual’ mode of operation.
As is the case with the emergency sectors,
security practitioners have tended to focus on a
broader scope for resilience from the
perspectives of anticipation and preparation as
well incident and/or crisis management and
recovery, together with issues of quality (eg ISO
9000:2005) as well as the key drivers of risk
(ISO Guide 73:2009 and ISO 31000:2009) and
the supply chain (ISO 28002:2011).
Engineers were arguably the first to adopt a
reliability (ie repeatability) lifetime-focused
approach. For their part, some researchers have
more recently suggested that strengthening the
anticipation element of resilience through
concentrating on understanding ‘successes’, as
well as failure, may provide benefits.
Resilient system
According to Hollnagel 1 , a resilient system will
exhibit several different traits or ‘abilities’.
First, there’s the ability to respond. It’s all about
knowing what to do or being able to respond to
regular and irregular changes, disturbances and
opportunities by activating prepared actions or
adjusting the current mode of functioning
within the host organisation.
Then there’s the ability to monitor. Knowing
what to look for, or being able to monitor that
which is or could seriously affect the system’s
performance in the near term (either in a
positive or negative way). The monitoring must
cover the system’s own performance as well as
what happens in the environment.
Next on Hollnagel’s list is the ability to learn.
Knowing what has happened or otherwise
being able to learn from experience, and in
particular learning the right lessons from the
right experiences.
Last, but by no means least, there’s the
ability to anticipate. Here, the focus is squarely
on knowing what to expect or being able to
anticipate developments – such as potential
disruptions, novel demands or constraints, new
opportunities or changing operating conditions
– further into the future.
It’s interesting to note that, from a
policymaker’s perspective, concerns regarding
resilience have largely resulted in the creation
of new standards and guidelines, as well as
additional requirements for governance and/or
safety regulations across organisations and
civil society and during disaster recovery. As a
direct consequence, the requirements for
reporting near misses, due diligence and audit
have increased.
Yet, as the fire at Grenfell Tower in West
London illustrated with such tragic effect back
in June, even in advanced economies disastrous
events and fatalities still occur. Tensions
between the goals of resources versus
efficiencies might have meant that standards
were simply applied as minimum standards,
while collaborations and partnerships may have
fostered confusion and gaps in responsibility.