Episode 8: Why ‘resilience’ is the buzzword of the year

Full transcript

Kristin Rivera: Welcome to our podcast series, Emerge stronger through disruption. I'm Kristin Rivera, and I lead PwC’s global forensics practice as well as our Global Crisis Centre. Once again, I'm coming to you from my home office in Northern California.

In each episode of this series, we speak with global leaders about the challenges facing businesses as they navigate disruption. Today, I'm joined by my friend, Dave Stainback, PwC’s crisis consulting leader in the US. Our topic is resilience. We're hearing about resilience everywhere these days as organisations assess their response to the pandemic and think through what they need to do to prepare for what might come next. Dave, it's great to have you. Tell us a little bit about yourself and your role at PwC.

David Stainback: Thanks, Kristin. Thanks for having me. It's great to be here.

As you mentioned, I lead our US crisis consulting practice and I work very closely with you and the Global Crisis Centre. I'm based out of Atlanta, and really what we do is, kind of two things: It's on the preparedness side of helping clients to build more resilient organizations, prepare for crisis — building plans and resilience programs, doing training and simulations to help them be ready for disruptions should they occur. And then the other half of what I do is I help our clients with responding. So when something disruptive happens to an organisation — a large-scale cyber breach, ransomware attack, some sort of operational disruption — we come in, help our clients get organised around the response, and try to emerge stronger from those situations. One of the things that we're really excited to be able to share the next coming weeks is the results of our Global Crisis Survey for 2021. And the topic of resilience is really on the forefront of that. We set up this survey as a true global after-action assessment. How organisations fare during the response to COVID-19 pandemic and really where they go from here.

We've had more than 2,800 respondents since August 2020 through late January 2021, from over 70 countries and representing 26 different industries. So we have a great set of data that I think will be very valuable for many companies.

Kristin: And I'll point out that this is our second Global Crisis Survey. The first was released in 2019 — of course, prior to the pandemic. And that edition had some really insightful data that we've put to good use, helping companies around the globe prepare for, respond to and emerge stronger from crises and other disruptive events. But then came COVID 19, the ultimate disruptive event, and nearly every organisation around the globe experienced shockwaves of some kind coming from this crisis — and more or less at the same time.

And so, as you say, Dave, this created a really unique opportunity to learn and examine how businesses have responded and are responding to this global disruptive event. And then we benchmark that information to analyse what's working and what's not. So this was an opportunity we couldn't help but to seize upon and to gather this information and study this worldwide response.

And as you mentioned, we'll be releasing the results of that analysis shortly. So let's talk briefly about the survey. From your perspective, Dave, what are the big takeaways with respect to resilience?

David: So the resounding message that we're hearing from business leaders around the world is that organisations are beginning to broaden their approach to thinking about risk and to thinking about crisis and disruptive events, and really think more holistically about how they can build organisational resilience.

And of course, that takes us to the question of — what is resilience? And the definition that we like to use quite a bit is from the National Institute of Standards and Technology. It defines resilience as the ability to prepare for and adapt, to be agile with changing conditions, and withstand and recover rapidly from disruptions including things like deliberate attacks, accidents, naturally occurring threats and incidents.

So you can really understand why 2020 has driven companies to have this renewed and, frankly, elevated discussion and focus on the topic. And that came across very strongly in our survey results, which we'll be able to talk through as we chat today. But one thing to illustrate on the interest is searches for the word “resilience” hit an all-time high, late in 2020. Business searches tripled between December 2019 and April 2020. So significant interest, obviously from business leaders, and corporations and, frankly, many people in the world trying to understand resilience and how they can do it better.

Kristin: Dave, you're absolutely right. There is clearly a great deal of desire, particularly amongst business leaders to know more about resilience and to get it. A quick Google search on resilience reveals more than 214 million hits. It is very clearly the buzzword of 2021. Before the pandemic, I think companies tended to view resilience planning more as a sort of a spreadsheet exercise within each of the individual functional groups that help to manage crisis and unplanned events. There wasn't really a universal definition or alignment across organizations to bring resilience to life.

Now I would be remiss if I didn't say that there are some industries like financial services or nuclear energy that have a leg up here; they've been focusing on resilience in a more holistic way for some period of time. But for many others, in many parts of the world, resilience is a relatively new construct from a business perspective. But It's clear that having lived through a year of massive worldwide disruption, resilience is on the minds of most business leaders.

David: Absolutely, Kristin, and really that attention to resilience aligns with what we're seeing as some of the key takeaways from our Global Crisis Survey.

One of the things that we tried to study in the survey is organisations that felt that they did well during their response, versus those that were more impacted from a negative standpoint. And what we've learned is that organisations that have come out of the pandemic in a better place — to the extent we’re out of the pandemic; we're not totally there — were more likely to say that they had given substantial attention to organisational resilience prior to the pandemic. On the other side of that, only 26% of organisations that have told us that they were heavily negatively affected had addressed that topic significantly, prior to the pandemic.

So you can see that dichotomy. And the other thing that we're seeing now, to your point, is that nine out of 10 companies are planning to increase their investment in resilience going forward in 2021. So we're already seeing business leaders shift and elevate the importance of resilience on their roadmap.

Kristin: That is both fascinating and also reinforces, I think, what I'm seeing in the market. So I guess the question is: What does it mean to build resilience from a corporate standpoint?

David: Yes. So I think the biggest trends that we're seeing, both in practice, working with different companies as they're trying to build resilience coming out of the year 2020, as well as what we've seen from our survey: It's starting to signal how companies are really attacking this, this challenge of building resilience today. And the first thing is we have to figure out — how is it built up to this point? And the reality is, response and resilience capabilities in most organizations have historically been built as silos. You alluded to this earlier. So, business continuity, planning, emergency response, crisis management, disaster recovery, threat intelligence — they're often built in different parts of the organisation, and in many cases from the bottom up over time. So when something hits organisation wide, like the pandemic, the response functions didn't necessarily work together the way that we would have hoped that they would. And in fact, our data from the survey supports that: Only 23% of respondents said that their response functions were well integrated as they tried to deal with COVID-19. So the major shift that we're seeing is really toward integrating and centralising these disparate functions into something that is more holistic.

For example, 70-plus percent of our respondents said that they have plans to better integrate those response functions that we just talked about. 80% plan to better integrate crisis management into a broader resilience program. This is a topic that's clearly resonating, and we're seeing a significant trend towards that centralised governance approach.

And really that concept of having someone in the organisation at a very senior level who really has visibility across into the different previously siloed capabilities. That function then, during times of peace, obviously provides the ability to know your true maturity, get investment for key enhancements that are needed around your program and your plans. And better integrate those plans and teams for the next time. And then during times of response or disruption, it provides the ability to quickly respond and effectively respond with, frankly, greater visibility across the whole organisation.

Kristin: So if I'm a business leader, listening to this podcast, Dave, I think your message would give me some comfort. What I hear from you is that many companies have the component parts of a cohesive resilience program, but perhaps they sit in different parts of the organisation. Perhaps they report to different leaders. Perhaps they're not in close communication with each other. And so there's a real opportunity to sew together the various pieces and parts of what can be an overarching resilience program. I think it's nice to know that you have many of the ingredients already, because it's less of a leap to then pull together a larger program.

David: Yeah, I think that's exactly right. Kristin. Those building blocks are there, and in a lot of cases, most companies have recovery plans, business continuity plans, et cetera. But, in some cases, some of those are stronger than others in companies. But it's a matter of really looking across and figuring out — “where do we have all of the right plans? And how good are those plans? Which ones are better than others? Which ones need to be brought up to speed? Which ones do we need to connect?” Obviously the barriers here to getting that done, right? If, as you said, if I'm a business leader, it's great that I have that, but that sometimes becomes an incentive to say, okay, well, I've got a lot of good — do I really need to make a change? And I think it's that age-old problem of: How do you get leaders to invest in something that's viewed almost as an insurance policy, right? Something that's set aside for a rainy day.

And frankly, if 2020 and the pandemic and all of the disruptive events that took place during this year don't make the case for that in a company, I'm not sure what will. And so we're seeing that, right? They're elevating those that are in charge of resilience in their organisations. They're getting more direct access to C-suite, more investment, et cetera. Now is the time to act while this is fresh in our heads. And we've seen the impacts, frankly — the longer a company waits, the easier it is to get back to business as usual and not take the time to really try to emerge from this stronger.

Kristin: Yep. As Ben Franklin said, "An ounce of prevention is worth a pound of cure." One respondent to our Global Crisis Survey this year, from an energy company, told us that as long as you have a well-structured crisis team, that works through issues regularly, you can apply that crisis response methodology to really any crisis. It doesn't matter what type of crisis you use to practice. It's the exercise of strengthening those muscles that pays dividends down the road. That definitely reinforces some of your comments, Dave. I'm curious, though, how a crisis response program specifically fits into an overall resilience program. If an organisation has a strong crisis program and a good crisis response team ready to handle whatever may come down the road, is that sufficient?

David: That's a great question. And it's one that we get all the time. Kristin. The reality is, having a threat-agnostic crisis management plan and program and team is something that every organization should have. They should be able to respond to any type of an event and understand who comes together, how they come together, and how they're going to respond and divide and conquer without having to know exactly what issue they're facing. But that said, that's just a piece of it, right? There are other pieces of a broader resilience strategy that have to work together and in concert with that crisis management plan and that crisis management team. The reality is, in most cases, the crisis management plan is executed 3% of the time, and 97% of the time is when you're executing on other resilience plans through different levels of incidents. And disruptions only escalated that crisis plan as a last resort. So, the things that you need to do — you need to be able to know what your risks are, make sure that you have the right plans, protocols, trainings, processes in place, across your resilience program. Knowing that you have that layer of the crisis program on top almost as the icing, to be able to handle any type of issue that comes. So by doing that, you can then better anticipate what's coming around the corner, identify your threats earlier, launch coordinated efforts, and sometimes prevent a crisis from actually even happening in the first place if some of your other resilience plans can be enacted early enough — and get things moving. So while having that crisis plan and trained resources to execute it are a very important element of resilience, it's just that one element — and the better connected that team is to the other elements of your resilience program, the better off you're going to be.

Kristin: Dave, thank you so much for joining today. It was a great conversation. In our next discussion, we'll get tactical. We'll talk about what organisations should do to create resilience, how they can build it into the DNA of their organisation as well. I look forward to that conversation. Remember to subscribe to our podcast series, “Emerge stronger through disruption,” wherever you get your podcasts. And don't forget to connect with Dave and me on LinkedIn. Until next time, thanks for listening.