RiskUKSeptember2017

Opinion: ISO 22316 Security and Organisational Resilience (Part Two)
with no gaps or overlaps, rather than in
relatively closed silos, creating an environment
for Brexit and other major programmes.
Continual improvement
No organisation has faced Brexit before and it’s
fair to assume that, while some larger firms’
management systems architecture will
accommodate it as just another major change,
the experience will be very new for others. Most
who decide to act in a structured way will
establish a project whose remit and execution
will evolve sporadically, improving only when
driven to do so or when an idea emerges.
Continual improvement is a mindset that
accepts we can always do things better and this
applies particularly to resilience. It means we
systematically and intentionally keep improving
the context model, quality of information and
each of the other attributes listed.
A simplified framework applying this for
Brexit might include making innovation and
improvement part of the strategy and habitual,
regularly scanning for changes and
accommodating them by adapting the strategy,
planning improvements, assigning resources
and making them happen and carrying out
regular reviews while also monitoring what has
been achieved against goals set.
Change drives risk and resilience. If things
didn’t change, equipment would never wear
out, rainfall would be standard and Brexit
wouldn’t happen. Some changes we can
anticipate and plan for, others come out of the
blue or must be imagined because they’re
outside of our experience. In any case,
anticipation and readiness is preferable. The
degree to which we develop and systematise
this will influence our adaptive resilience.
As we’ve seen, Brexit is far from a
straightforward change. It means we need a
mechanism that ensures we’re not surprised or
shocked by what it brings, leaving us wellplaced
to respond and continue with business.
Steps that we can take to build this adaptive
capability might include regularly updating the
context model and using it to look ahead while
scanning for change, modelling change
scenarios and developing response tactics for
those that seem likely, exploring alternatives as
well as ways to deliver on commitments, dual
suppliers and diversifying, planning to respond
and absorb the shock of unexpected
announcements, influencing changes before
and after they materialise and being ready to
adapt without impacting delivery or
compromising vision or core values.
At the headline level, Brexit now seems a
certainty. At almost every other level, though,
the potential remains for surprise. No-one can
be certain how it will unravel, either globally,
nationally or at the organisation level. Our
choices are to either move with the herd and
hope to arrive intact or seize the initiative by
becoming proactive, adaptive and influential.
Contributory factors
The nine attributes focused upon in Part One
and in this month’s article tell us what we
should expect of a resilient organisation. Part 6
of ISO 22316 explains how we can evaluate
these capabilities for ourselves and offers a
governance framework with which to do this.
Again, there’s little if any practical guidance
here to help you decide on acceptable levels of
attainment for each attribute, or a detailed
explanation of how to bring about
improvements in each as this must be
determined by the host organisation.
Apply this framework for Brexit and you
derive a management system that converges on
targets set by top management for each of the
resilience attributes. It – ie the system – needs
to be delivered by a programme or an existing
compatible process that’s kept running for the
duration of Brexit. Delivered as described, it
should continually evolve to track Brexit’s
changing shape and improve such that it aligns
with the organisation’s Brexit-specific and
general resilience objectives or success criteria.
To make it work, you need to set your own
attribute targets and thresholds and monitor
and measure your performance against them.
“Where Brexit’s concerned, and perhaps generally
speaking, intelligence drives resilience. Clearly, we need to
respond acceptably quickly to all kinds of change”
15
www.risk-uk.com