Resilience through rapid response

Resilience is essential to surviving in a volatile business environment. But just what traits or abilities does a company need in order to achieve such toughness? Roads to Resilience, a report by Cranfield School of Management on behalf of the risk-management association Airmic, developed a blueprint for grit, based on case studies of companies that had faced major crises. The report found that the ability to respond rapidly to crises was one of the five crucial abilities displayed by resilient companies. In an edited excerpt of the report, we examine why rapid response is important and explain how companies employ it to their advantage.

Resilient organisations need to have the capability, resources and relationships to respond rapidly and appropriately to emergencies and small changes that could ultimately develop into a disaster. Rapid response also allows a company to seize opportunities — the upside of risk. This capability is based on empowered teams, practised processes and flexible resources. Resilient organisations rehearse responses to anticipated scenarios so that an effective response to serious or significant unexpected developments becomes possible, and they recognise that rapid response to an adverse development needs to achieve more than recovery of operations. It also should include a media response that protects the company’s reputation.

Understanding rapid response

There are four components to ensuring decisive and rapid response:

1  Decisive and appropriate actions: Acting quickly can prevent issues from developing into problems or, worse, crises. Repeated small issues can mark the beginning of a trend — the total risk posed by multiple, concurrent issues can be significant. The ability to recognise the early indications of an emerging opportunity, and respond accordingly, also is a positive benefit of resilience.

2  Identified teams and processes: Processes can provide a useful platform for a response, but skilled employees should tailor the response to the unique situation. These teams need to be cross-functional and empowered to decide what type of response is appropriate.

3  Empowered responses: Organisations must be flexible enough to provide a response while not being overburdened by the pressures of running their normal business. Allowing employees a degree of empowerment when responding to customers can often solve a problem before it becomes serious.

4  Rehearsed reaction plans: Although it’s impossible to predict the details of every potential problem, organisations can still practise their responses to crises. When rapid-response plans and teams are established in advance, the organisation is much better positioned to prevent the incident from becoming a crisis.

Getting comfortable with uncertainty

Achieving a rapid-response capability depends on several elements of a company’s business. Let’s review each of their contributions in turn.

People and culture: Under normal conditions, risks can be managed by means of structures, standard operating procedures, trained operatives and continuous improvement. But when business conditions become more volatile, resilient organisations also have people with the right skills, empowerment and motivation to deal with unexpected developments.

Rapid response requires experienced employees who are comfortable with uncertainty. They also must be able to integrate diverse perspectives and resources. This tends to lead to the formation of flat, self-organising, multi-disciplinary project teams supported by leadership that gives people high levels of autonomy within their roles. Leadership is careful not to stifle creativity and innovation.

As an example, the Roads to Resilience case study of InterContinental Hotels Group, or IHG, found that the company has the awareness to recognise incidents, a strong communication network to report them and a clear process by which to respond. The company has codified and embedded crisis process management and has management teams at both global and regional levels. Crisis teams are carefully selected to create a rounded team with the right crisis owner. The owner has the authority to make decisions and add the appropriate risk managers, communications staff and specialists to the team.

Critically, these specialist teams include representatives who are trained to deal with members of the media. This prevents senior managers from being in the position of having to respond to a crisis, the press and other stakeholders at the same time.

Business structure: Understanding and responding to risk is, by its nature, a cross-functional task. Instead of having a silo mentality, senior managers must take a more horizontal view across the business.

The Roads to Resilience case study of the Drax Group, a power station operator, provides an example of how cross-functionality can be achieved. Drax has representatives from many teams — including production, finance, procurement, fuel purchasing and logistics — collaborate on major tasks. The company also has assembled a technical risk steering committee. Due to the nature of its business, rapid response at Drax needs to be co-ordinated with external organisations such as the fire brigade. This demonstrates that a rapid-response capability also depends on another principle of resilience: relationships and networks.

Strategy, tactics and operations: No organisation can predict every possible problem, but resilient companies have the flexibility necessary to respond to unexpected situations. Companies need enough resource and management
capacity to respond while still managing the day-to-day business.

Many organisations do not fully appreciate the risks that are associated with corporate strategies and major programmes. This can lead to a focus on operational risks, while the risks associated with business strategy are overlooked. But operational incidents can have significant strategic implications, especially if they have wider brand or reputational implications. This is especially true amid the increasing impact of social media. Resilient organisations recognise that responding to adverse circumstances is not just about operational recovery or continuity; protection of reputation should be paramount.

The Virgin Atlantic case study (see “Case Study: Virgin Atlantic’s Rapid-Response Teams” for excerpts) explains that airline employees involved in operational and strategic decision-making go through a common risk-management training programme so that everyone works with one concept of risk. Managers try to predict the consequences of their decisions. When adding new destinations, for example, managers try to determine in advance the best ways to ensure crew and passenger safety on those routes.

Leadership and governance: Major risks sometimes emerge suddenly and unexpectedly. To deal effectively with these challenges, some organisations have separate structures that are normally dormant but can be quickly mobilised in case of emergencies. These emergency-response or crisis teams are typically task-focused, comprising specialists from across relevant functions. Good communication is crucial in both recognising and responding to risks, and some companies specifically have governance forums responsible for reviewing the effectiveness of risk-related communication.

Many industries have experience dealing with a range of serious accidents and security and weather-related incidents. Hence, many of these unexpected situations are, in a sense, routine or business-as-usual events. This enables emergency-response and crisis teams to rely on well-rehearsed contingency plans and adapt them to the particular situation. During the handling of these events, response teams will have direct lines of communication with executive levels, but they typically operate independently.

When an emergency or crisis occurs, response teams can take the incident away from top management and deal with it separately, thereby minimising the impact of the event on normal operations.

To obtain the full Roads to Resilience report, email Georgina Oakes at georgina.oakes@airmic.co.uk.

---

Case study: Virgin Atlantic’s rapid-response teams

A feature of Virgin Atlantic’s flat structure is that operations and crisis-management roles are separated to allow faster and more effective responses to major unexpected events. In this structure, emergency response or duty commanders are not executives or even necessarily operational employees.

This separation of roles prevents senior leaders from being overwhelmed during an emergency. Instead, they step back, monitor the bigger picture, and act as a sounding board for the duty commander. Senior leaders also are free to manage key external stakeholders on the duty commander’s behalf if needed. During any emergency, an experienced and well-prepared response team can manage the situation separately in the Crisis Centre, thus minimising the influence on normal operations.

Airlines encounter many unexpected events during operations, yet Virgin’s emergency-response team is engaged infrequently. That’s because most unexpected events, such as flight diversions for weather or medical reasons, occur so frequently that they are considered business as usual. Those events are addressed through standard operating procedures. Even when an aircraft declares an emergency — a problem with an aircraft’s undercarriage, for instance — the operations department typically is able to handle the situation. In those instances, the duty commander will be alerted and will be on standby, but generally response teams will step in only when an event:

• Can attract significant media attention;
• Can lead to a large number of enquiries by passengers
• and staff;
• Affects multiple routes; and
• Has direct safety and security implications.

Airlines have experience dealing with a range of security, terrorist and weather-related incidents. Therefore, even some events meeting the above criteria will still be addressed through standard contingency plans.

---

Rapid-response tips

Decisive and Appropriate Actions

• Classify risks to resilience so that appropriate risk monitoring and/or risk escalation/trigger procedures can be established.
• Include near-miss, scenario-planning, accumulated risks and behavioural aspects in risk-response plans.
• Receive, investigate and respond to whistleblowing reports to develop a willingness to report these circumstances.

Identified Teams and Processes

• Establish nominated crisis-management teams that are separate from normal management and have defined roles and responsibilities.
• Introduce shared and structured training sessions to enhance plans and demonstrate that resilience is about culture, not rules or process.
• Ensure that trigger levels and escalation procedures are established for emergency teams to eliminate ambiguity in activation of the crisis plans.

Empowered Responses

• Establish authority levels for empowerment of staff, suppliers and contractors to deal with adverse circumstances and developments.
• Conduct scenario-testing to ensure that responses are embedded and crisis team(s) with the necessary authority levels are identified prior to the crisis.
• Align resilience activities with other roles and responsibilities to ensure normal activities can continue during a crisis or disruption.

Rehearsed Reaction Plans

• Establish a schedule of crisis rehearsal activities involving different parties according to the scenario being tested.
• Arrange for independent appraisal of the results of the scenario-testing exercises, with written reports, if necessary.
• Evaluate the scenario-testing appraisal reports and incorporate improvements and recommendations as appropriate.

---

The four other keys to resilience

Roads to Resilience, a 2014 report by Cranfield School of Management on behalf of Airmic, found that resilient companies had five core capabilities or principles in common. No one principle is more important than the others, nor can any of them be ignored. The capability to ensure decisive and rapid response is one of those principles. Here are the others:

1. Resilient organisations have exceptional risk radar, which gives an early warning by helping an organisation identify issues before they develop into major incidents. It also helps organisations consider risks in aggregate and allows different types of risk information to be collated. Resilient companies ensure that everyone in the organisation is aware of the importance of risk and the need for vigilance in relation to strategy, tactics and operations.
2. Resilient organisations have resources and assets that are flexible and diversified. They establish clear operational risk appetite positions and then identify potential weaknesses through scenario analyses and stress-testing of strategy, tactics and operations. They use the diversity of resources to reduce risk and develop the skills for risk management throughout the organisation and beyond. This could include reducing dependence on single critical resources — such as suppliers, markets, brands, products, investors, knowledge and customers. (See the CGMA special report Rethinking the Value Chain on page 25.) Resilient organisations are aware of intangible assets — reputation, for instance — and develop proactive strategies to manage these assets.
3. Resilient organisations value and build strong relationships and networks. They proactively manage risk throughout their networks of customers, suppliers, contractors and business partners. A customer-centric approach is crucial, as it shapes the way all types of relationships are formed. Openness with all stakeholders engenders trust and loyalty, as well as a desire to collaborate and share information.
4. Resilient organisations review and adapt to changes and adverse events. Risk-management procedures and staff training are tested, refined and enhanced. This produces employees who are self-critical and willing to openly admit mistakes and report near-miss incidents. Every potential adverse event or circumstance is identified, analysed and evaluated.