We are now exposed to an unprecedented number of complex risks—from regulations to cyber threats, supply chain disruption to geopolitics to climate change—all of which are driving factors for disruption.
The purpose of resilience is to have measures in place which will enable an organisation to withstand or absorb those risks, should they materialise, and where this is not possible, respond appropriately to minimise the impacts and remain within pre-defined tolerances. Every critical component, system, service, process or activity should be resilient, recoverable or have continuity plans in place.
When, however, a disruption impact exceeds the acceptable level of impact for an organisation, it becomes a crisis. In a crisis, resilience plans may be overwhelmed and the tolerable levels of impact may be breached. A crisis management capability should provide a flexible and dynamic approach to enable an organisation to manage unforeseen disruptions, continue to deliver its strategic aims, and return to a viable operating state in these conditions of extreme uncertainty.