Could your business run on the bare minimum? 4 steps to resilience

Cyber attacks, system outages and supply chain failures are hitting more companies. Leaders now need to prepare for prolonged disruption, not just short-term shocks.

Risk leaders in our network are helping their boards and strategy teams respond. They are turning short-term incident response into longer-term frameworks for operational resilience.

<< Download our workshop template: Defining your minimum viable business 

Through collaborations that we're facilitating, members are comparing approaches to resilience. Here are the four key steps they're taking to make their businesses more adaptable.

1. Decide what really matters

The most forward-thinking companies in our network are defining a 'minimum viable business' to deal with external volatility. Executives and the board endorse it. It is a baseline definition of what the company must sustain at all times, whether a system goes down or a key supplier goes bust.

To define yours, strip away everything non-essential and focus on your core purpose.

It also helps to build a hierarchy of priorities. One member shared this example in a recent collaboration:

Ready to define yours?

Download our minimum viable business workshop template and work through it with your team.

Download

2. Build resilience in layers

3. Shift ownership to operational teams 

Many risk leaders name the same barrier to resilience: the belief that business continuity plans (BCPs) belong only to risk and resilience teams.

In the ideal set-up, the enterprise risk management (ERM) team acts as a facilitator. Business units and subject matter experts own the scenarios.

Handing over ownership takes deliberate engagement. One risk leader avoids abstract frameworks and starts with a practical question:

“What are your core objectives, and what operational breakdowns would prevent you from achieving them?”

Head of risk

FTSE organisation

Another company uses a "crawl, walk, run" approach:

Crawl: Build scenarios for specific, highly critical teams. Lead the discussion without overwhelming them.

Walk: Add pressure by asking teams to make difficult decisions on public communications, operational trade-offs and ransomware negotiations.

Run: Once a baseline is in place, stress-test leadership under full pressure.

4. Measure preparedness

Risk leaders agree that paper audits can't measure preparedness for long-term disruption. Instead, measure resilience capabilities and plan progressively over time.

At one member organisation, executive leadership exercises run every 12 to 18 months. The scenario gets more severe in stages, which stress-tests the plans and exposes blind spots.

Other members use outcome-based metrics. One example is a simple yes or no: can we complete core transactions at every location using manual or backup processes?

Build your resilience plan with peers

Risk leaders are embedding resilience at an operational level, and they are also watching the horizon. Preparedness depends on knowledge as well as process.

One way we help members is through Horizon Scanner 2.0. We developed this system to automate the identification and summary of global data, surfacing emerging risks and showing how they might affect your organisation.

Start with the basics: Download the minimum viable business workshop worksheet

Want to go further? Find out more about Horizon Scanner 2.0, or talk to peers about how they're building resilience, book a 15-minute exploratory call.