Measurement: the next big resilience challenge?
- Published: Wednesday, 13 January 2016 09:53
Robin Gaddum looks at the ‘capabilities and capacity’ aspect of organizational resilience and explains why dynamic measurement is an essential requirement.
Resilience is a journey, not a destination. It is a dynamic characteristic because every organization is in a constant state of change, as are the environment in which it operates and its direct and indirect inter-dependencies with other organizations. An Organization may pursue resilience but may only be demonstrably resilient to a particular disruptive event at a moment in time.
So, how do you measure resilience? This is an important question. If you cannot measure its benefits, then making the business case for a resilience programme will be challenging. Quantifying return on investment (ROI) requires some form of measurement to show how the investment input results in valuable output. But how do you measure the unmeasurable?
Capabilities and capacity
The diagram above shows the structure of an organizational resilience model. Previously I have written about the ‘purpose and values’ aspect in this article I focus on ‘capabilities and capacity’, which provides the foundations of operational resilience. Operational resilience is a subset of, and contributes to, organizational resilience. Operational resilience is concerned with the day-to-day task of delivering the organization's products and services, whilst simultaneously seeking continual improvements and tactical adaptive changes. In this context, capabilities and capacity are measurable, but to date business continuity management (BCM) has failed to answer this exam question. In my headmaster's school report, young master BCM simply "must try harder."
Failings of the past
Over the last decade, BCM has adopted a management systems approach, reinforced by new standards such as ISO 22301. This helpfully established a common understanding of terms, a methodology and key management system deliverables that indicate good practice, such as a business impact analysis (BIA) and business continuity plan (BCP). Sadly, a management systems approach also resulted in a focus on activities rather than outcomes. For example, we've been measuring how frequently the BCP is reviewed instead of whether it meets the needs of our customers.
At the same time, requirements have hardened and businesses are increasingly changing from a reactive posture of 'recover after interruption' to enabling continued operations, albeit at a reduced capacity that can quickly return to normal. Across businesses there is also a continued drive to do more with less resource, forcing efficiency gains and the need for constant business transformational change into the mix.
Fly the plane
I'm constantly amazed at how all sorts of businesses operate without a view of their capabilities and capacity to deliver their products and services, and how this dynamically changes based on shifts in demand, adverse events, and so on.
Imagine how hard it would be to fly a plane without a dashboard of information. How much more effort would be needed just for navigation, never mind the added danger of trying to guess airspeed and rate of descent for a safe landing? I wonder whether it's now harder to fly some modern and complex aircraft without instrumentation, as pilots increasingly rely on embedded technology.
Pilots need instrumentation and the information it presents in order to fly the plane efficiently, effectively and safely. So whilst having that dashboard of information is crucial in helping pilots sense, analyse and respond appropriately when something goes wrong, the real value is enabling better operations in 'business as usual'. This should be the ambition of operational resilience. Without it, we're just flying blind.
The BIA isn't good enough
The BIA captures an organization's recovery requirements. More experienced practitioners also capture internal and external dependencies needed to deliver the organization's products and services. In short, they attempt to capture an organization's capabilities and capacity to fulfil the recovery requirements - in terms of people, premises, providers, IT systems, and so on. This enables a capability gap analysis and development of a recovery strategy that underpins the BCP.
The problem is that, even if the BIA does this well (and generally it doesn't) then it is a snapshot accurate at a point in time and typically only used by the business continuity manager. Furthermore, as operational resilience is designed into organizations, the emphasis shifts towards capacity management; moving workloads from one office to another and triaging work where there is a short term capacity shortfall.
A static view of capabilities and capacity simply isn't good enough, whether that static view is embedded in a paper document, a spreadsheet or a BCM software package. Operations management needs dynamic and current capabilities and capacity information to 'fly the plane' as well as to enable resilience.
Capturing capabilities and capacity
In 2004, I wrote an article describing Business Resilience - the next step forwards for Business Continuity and included the layered model that IBM developed to evaluate operational resilience. We've moved on since then, but conceptualising the organization's internal and external dependencies across a number of layers is still part of the tool kit I use today. I enhance existing BCM deliverables, such as the BIA, to build a picture of capabilities and capacity.
The trick is to turn that static capabilities and capacity picture into a dynamic and self-updating 'flight deck' with the right instrumentation and much closer to real time, accurate information feeds. Combine that with information regarding predicted risks, such as an incoming storm, and you can take preparatory action to lessen the impact. IBM has been doing this for years through its Smarter Cities programme using tools such as the Integrated Operations Center to create the 'flight deck'. This approach is equally applicable to businesses, although simpler.
We can measure operational resilience in terms of capabilities and capacity. When we continually measure and monitor, the resulting information has a value beyond short term protection from adverse events. My experience of implementing Integrated Operations Centers is that, whilst enhancing emergency management might have provided the project impetus, the business case is generally made by enabling performance improvement.
Indeed, subsequent insights often arise from a more detailed analysis of gathered information, enabling business case development for further performance improvements.
Resilience managers need to get closer to their business and pro-actively seek performance improvement opportunities that enhance resilience as a secondary objective. Help fly the plane, don't wait for it to crash.