Enterprise Resilience

But what happens when that situation changes? What happens

• when the needs and wants of your current customers change, so that you can no longer satisfy them as well as others can,
• when disaster strikes, or the economy just shifts so that customers are no longer able or no longer willing to pay you for what you provide, or
• when, due to demographic shifts, the new customers moving into your ‘market space’ no longer need or want what you offer.

I have suggested four ways that Natural Enterprises can deal with such changes:

• discover new unmet needs that replace products and services that are no longer needed (or have been obviated by other companies’ disruptive innovations) — and do some disruptive innovating yourself,
• discover new applications and markets for the products and services you already offer, 
• continuously improve your products and services as you understand more deeply both the customer’s needs and the solution alternatives, and
• organize and operate the enterprise improvisationally, where decisions are open to and built on a continuous flow and exchange of information, ideas, and collaboration, rather than based on pre-determined directives.

Some new research indicates there is a lot more that Natural Enterprises can do to stay resilient in the face of changing markets, economics, needs and demographics. Not surprisingly, much of this new research recognizes that business environments are complex, not just complicated, and that resilience is not about predicting what will happen, but having the capability to adapt positively (not react defensively) to the changes as they occur. This research also suggests that the best subject for study of resilience is nature, the definitive adaptive and enduring complex environment.

This OSU site defines resilient enterprise as one that “adapts successfully to disruptive changes by anticipating risks, recognizing opportunities, and designing robust products and processes”. The authors lay out this model of the resilient enterprise:

I have some reservations about this model, but it’s a good starting point. I’m not sure the strategic/tactical distinction is as important as a distinction between actions that can be taken in advance and those that must be improvised. And some of these actions (fortify, centralize, add security, resist) seem to me defensive rather than resilient.

What’s missing from this model? Scanning, to see what’s on the horizon. Observing, paying attention to what’s happening. Imagining, asking What If questions and dreaming of what is possible. Designing, intentional thinking. Disrupting, changing the rules. Collaborating. Learning, acquiring new capabilities.. Exploring, letting ideas take you where they go. Brainstorming. Experimenting, trying lots of things and failing fast and early. Thinking Ahead, and helping customers and co-workers do this too. Simplifying. Canvassing the crowd, customers, co-workers and the community at large.

Adding them into the mix and eliminating the defensive (rather than anticipatory) actions produces an organizational resilience model that looks like this:

In complex environments, there is only so much we can do in advance. We can anticipate broad classes of challenges (such as competitive threats and disasters) and organize so that, if and when they occur we can cope with them. And we can ‘be the change’ ourselves, innovating to challenge competitors and developing capabilities that let us expand our offerings.

Improvisationally, we can scan for and adapt to changes that challenge our competitive position and viability, and more proactively we can imagine, design and introduce changes and new offerings on a continuous basis.

All of these resilience elements recognize that in complex environments, you can’t plan for or protect against what you can’t predict. But what about the stuff big companies do to be ‘resilient’ — disaster and contingency plans, vulnerability assessments, risk management departments, recovery plans? These really aren’t resiliency actions at all, they’re steps that rigid, unresilient organizations take to get back to their unresilient state after unexpected occurrences.

But shouldn’t resilient organizations have IT disaster recovery plans and contingency plans in case of pandemics or other disasters? I would suggest that a resilient organization wouldn’t have such a complicated computer system that it is dependent on continuity of the power supply and the integrity of its systems (and freedom from computer hackers) in the first place. Plans for natural disasters, pandemics and hostile attacks on your city, at the organizational level, tend to be generic and bottom-up. They are a good idea, for the welfare of your co-workers and (if you are in an essential service) for those who depend on you, but as we have been finding out more and more often of late, they only go so far — it is what you do to adapt improvisationally, more than how you prepare for what you can anticipate, that will determine your success at continuity and resumption of services.

This is still a new field, and a lot of what little has been written on the subject of enterprise resiliency isn’t about resiliency at all, but rather continuity and recovery. It’s a subject that merits further exploration, and an added chapter to Natural Enterprise. What are your thoughts on this, and what can and should organizations do to become, and be, more resilient?