EXECUTIVE SUMMARY

Organizational
Resilience
A summary of academic evidence, business insights and new thinking
by BSI and Cranfield School of Management

ORGANIZATIONAL RESILIENCE | BSI AND CRANFIELD SCHOOL OF MANAGEMENT 1

2 ORGANIZATIONAL RESILIENCE | BSI AND CRANFIELD SCHOOL OF MANAGEMENT
Introduction
Organizational Resilience is the ability of an organization to anticipate, prepare
for, respond and adapt to incremental change and sudden disruptions in order to
survive and prosper.1

There is an acute need for organizations to become more resilient. Currently, just
one third of CEOs are confident in the long-term survival of their businesses.2 But
identifying common practice, let alone best practice, in Organizational Resilience
is a significant challenge because of the conflicting guidance found in a variety of Key point:
information sources. Organizational
In response to this challenge, BSI commissioned Cranfield School of Management to Resilience is the ability
assess almost half a century’s management thinking, from 1970 to the present day, of an organization to
on how organizations can become more resilient. Over 600 academic papers were anticipate, prepare for,
initially screened, of which 181 were considered worthy of deeper analysis, together respond and adapt to
with a wealth of additional books and reports. incremental change and
sudden disruptions in
This report combines Cranfield’s findings from this substantial body of academic order to survive and
knowledge and managerial experience with practical insights from organizations prosper.
across the globe that exhibit good practice in Organizational Resilience.

“In the past, Organizational Resilience at Infosys

relied on policies, procedures, enforcement
and accountability, but now it is seeing a move
towards more analytics and agility”
Executive Vice President - Corporate Strategy and Chief Risk Officer, Infosys

1. Definition from BS 65000:2014, Guidance on Organizational Resilience, BSI

2. Organizational Resilience: Building an enduring enterprise: EIU/BSI 2015

ORGANIZATIONAL RESILIENCE | BSI AND CRANFIELD SCHOOL OF MANAGEMENT 3

 The ‘Tension Quadrant’

The report describes how thinking on Organizational Resilience has evolved over
time, and has been split by two core drivers: defensive (stopping bad things happen)
and progressive (making good things happen); as well as a division between
approaches that call for consistency and those that are based on flexibility.

These four drivers and approaches form the axes of the Organizational Resilience
‘Tension Quadrant’, as illustrated below.

Historically, there has been a preoccupation with the defensive agenda, with much
less attention given to resilience as a progressive ‘strategic enabler’ that can help
organizations adapt to the big, complex issues that arise in modern business – and
seize the fresh opportunities that spring from them.

Key point: In addition, Cranfield identifies four ways of thinking about Organizational Resilience:
Organizational Resilience
• Preventative control Organizational Resilience is achieved by means of robust
requires preventative
risk management, physical barriers, systems back-ups, safeguards and standards,
control, mindful action,
which protect the organization from threats and allow it to ‘bounce back’ from
performance optimization
disruptions to restore a stable state. Preventative control is essentially a
and adaptive innovation.
defensive strategy based on consistency
Paradoxical thinking helps
leaders shift beyond • Mindful action Organizational Resilience is created by people who use their
‘either/or’ towards ‘both/ experience, expertise and teamwork to anticipate and adapt to threats and
and’ outcomes. respond effectively to unfamiliar or challenging situations. Mindful action is also
defensive, but based on flexibility.

4 ORGANIZATIONAL RESILIENCE | BSI AND CRANFIELD SCHOOL OF MANAGEMENT

• Performance optimization Organizational Resilience is formed by process
optimization, continually improving, refining and extending existing competencies,
and exploiting current technologies, to serve present customers and markets
more efficiently and effectively. Performance optimization is essentially a
progressive approach based on consistency.
• Adaptive innovation Organizational Resilience is created through innovation,
exploring unfamiliar markets and adopting new technologies. In this way, forward-
thinking businesses can themselves embody the disruption in their environment.
Adaptive innovation is progressive, based on flexibility.

The drivers of Organizational Resilience do not operate in isolation. They all interact
with each other, as shown by the Tension Quadrant, illustrated below:

PROGRESSIVE Diagram: Organizational Resilience

PERFORMANCE OPTIMIZATION
Improving and exploiting (Achieving results) ADAPTIVE INNOVATION Tension Quadrant: blending defensive
Imagining and creating
and progressive thinking

ABILITY TO
ANTICIPATE, PREPARE Key point:
CONSISTENCY FOR, AND RESPOND Organizational Resilience
FLEXIBILITY
(Goals, processes, AND ADAPT TO (Ideas, views,
routines) INCREMENTAL actions) involves changing before
CHANGE AND the cost of not changing
SUDDEN becomes too great.
DISRUPTIONS This requires learning
Integration, balance and fit
(for purpose) are essential to do new things by
changing underlying
values and assumptions,
PREVENTATIVE CONTROL creative problem solving,
Monitoring and complying DEFENSIVE MINDFUL ACTION
(Protecting results) Noticing and responding innovation and learning.

The tensions within the Quadrant will vary according to the nature of the
organization and the environment and circumstances it faces. For example, a
potentially high-risk nuclear power business is likely, as a matter of course, to
‘skew’ the Tension Quadrant towards defensive consistency. But in the light of a
new requirement to be, say, more commercially competitive – perhaps because of a
withdrawal of state subsidy – more progressive flexibility would be brought into play.
In contrast, the nature of an entrepreneurial commercial enterprise would normally
emphasize progressive flexibility. But a setback, such as a quality failure and product
recall, might prompt increased defensive consistency.

It follows that there is no ‘right’ or ‘wrong’ shape for the Tension Quadrant, and for
any given organization its position will alter over time, as external factors dictate.

ORGANIZATIONAL RESILIENCE | BSI AND CRANFIELD SCHOOL OF MANAGEMENT 5

 Five phases of resilience

Cranfield identifies several distinct phases of Organizational Resilience that have

evolved over time as approaches to it matured. As the graph below illustrates,
they began with preventative control and have progressed through mindful action,
performance optimization and adaptive innovation. Importantly, the latest and final
phase is paradoxical thinking.
Diagram: The evolution of
Organizational Resilience
thinking over time BALANCING AND
MANAGING TENSION PARADOXICAL
THINKING
ORGANIZATIONAL RESILIENCE MATURITY

IMAGINING AND ADAPTIVE

CREATING
INNOVATION

IMPROVING AND PERFORMANCE

EXPLOITING OPTIMIZATION

MINDFUL
“What I have
NOTICING AND
RESPONDING ACTION

discovered over
many, many years of MONITORING AND
COMPLYING
PREVENTATIVE
CONTROL
working in business
and in the military
TIME
is that it is very
rarely the individual Paradoxical thinking
who we can ‘blame’
Organizational Resilience requires senior leaders to strike an appropriate balance
for something. It is between the sometimes-conflicting objectives and requirements of preventative
invariably a gap in control, mindful action, performance optimization and adaptive innovation.
the process.” Paradoxical thinking helps leaders shift from ‘either/or’ to ‘both/and’ outcomes:
both defensive and progressive; both consistent and flexible.
CEO, NxtraData

Organizational Resilience requires constant effort. If neglected, preventative control,

mindful action, performance optimization and adaptive innovation will erode over
time and can result in organizations sleepwalking into disaster or irrelevance.

Preventative control may be diminished because of latent problems, such as

“You need to have defective maintenance, poor training, or when local practice takes over from written
good systems procedure.

but not be over- Mindful action may be weakened when organizations stop investing in the
burdened with red competence of their people to maintain standards and encourage growth. As well as
tape.” undermining structures and practices, people become inattentive and indecisive.

Chief Risk Officer, Baiada Performance optimization may be eroded when organizations enjoy a long period of
success and become complacent, discounting the possibility of future failure.

Adaptive innovation may be inhibited when the organization feels the threat of
impending crisis. Organizations tend to control expenditure and resources and focus
on the one thing they do well (e.g. their core product or service), but at the expense
of losing their ability to adopt better alternatives

6 ORGANIZATIONAL RESILIENCE | BSI AND CRANFIELD SCHOOL OF MANAGEMENT

Mastering tension through paradoxical thinking
“However good
Once threatened with failure, most organizations respond by bolstering preventative
control – adding new safeguards, reinforcing barriers, perhaps increasing training we think our
efforts – but rarely showing the flexibility to make fundamental changes to mindful management
action and adaptive innovation. Instead, paradoxical thinking is required in order system approach
to manage the tensions between defensive and progressive views of Organizational
may be, we’ve got to
Resilience. Integration of preventative control, mindful action, performance
make sure that it’s
optimization and adaptive innovation is essential where these distinct areas are not
yet part of a holistic framework. grounded in reality,
and believe me, the
Overemphasis on the defensive agenda impedes resilience because the organization
best way to ground
becomes inflexible and unproductive. Overemphasis on the progressive agenda
impedes resilience because solely striving to achieve more from less can cause something in
organizations to lose focus on their core business, resulting in failure. Resilient reality is to get the
organizations must be both highly adaptable to external market shifts, while employees as part
simultaneously focused on their own coherent business strategy. Senior leaders
of that process”
must manage the tension between consistency and flexibility, finding the right
Corporate Social
balance needed between controlling risks and taking opportunities.
Responsibility Director, Ciena

4Sight: a way forward

Cranfield argues that business leaders and decision-makers can use a new
methodology, ‘4Sight’, to introduce and sustain Organizational Resilience.

4Sight describes a repeatable process consisting of four core processes:

Diagram: The 4Sight model of

Organizational Resilience

FORESIGHT
Anticipate, predict and
prepare for your future

HINDSIGHT
Learn the right lessons
from your experience
ACT
Respond
and create
disruptions and
opportunities

INSIGHT
Interpret and respond to
your present conditions

OVERSIGHT
Monitor and review
what has happened and
assess changes

ORGANIZATIONAL RESILIENCE | BSI AND CRANFIELD SCHOOL OF MANAGEMENT 7

 • Foresight – Anticipate, predict and prepare for your organization’s future. This will
“Overemphasis on require constant surveillance for potential threats and possible opportunities.
the progressive You must explore possible, plausible, probable and preferred futures. Foresight
agenda impedes will help people in your organization to be mentally prepared for uncertainty and
change.
resilience because
• Insight – Interpret and respond to your present conditions. This involves
solely striving to
systematically gathering information and evidence from diverse sources, including
achieve more from first-hand observation of customers in the field or front line staff, to create and
less can cause continually update a shared understanding of the status of ongoing operations
organizations to and the environment you face. You must search relentlessly for latent problems
lose focus on their and errors.

core business, • Oversight – Monitor and review what has happened and assess changes.
This includes putting in place a robust process for identifying, managing and
resulting in failure.”
monitoring critical risks and continuously refining the process as the business
BSI, 2017 environment changes. Balance performance and compliance by ensuring that
management’s actions are consistent with corporate strategy, reflect the culture of
the business, and are in line with the organization’s risk profile.
• Hindsight – Learn the right lessons from your experience. This requires a ‘no
blame’ culture and a willingness to learn from success as well as failure. Future
performance can only be enhanced if your organization is able to change
behaviour as a result of experience.

“We reacted much earlier than everybody else

because we were listening to our customers, we
were observing the market and we were able to
proactively change the way we offered support to
our customers.”
COO Security and Data Protection Officer, SAP

8 ORGANIZATIONAL RESILIENCE | BSI AND CRANFIELD SCHOOL OF MANAGEMENT

“We’ve got to have a plan or a policy or a way
of doing business that caters to all levels of
disruption. If resilience is not in your blood then
you won’t be in business.”
CEO, NxtraData

4Sight is particularly useful for dealing with complex problems such as developing
a new technology, planning a new infrastructure system, implementing a major
change programme or dealing with a crisis. Such challenges are difficult to resolve
Key point:
because of incomplete or contradictory knowledge, the number of stakeholders and
Complex problems
opinions involved, the financial risk, and the interconnected nature of these issues
are difficult to resolve.
with other problems. Mobilizing people to meet these challenges is at the heart of
A new process
Organizational Resilience.
methodology mobilizing
people to meet these
A blended solution challenges is at the
heart of Organizational
Solving complex problems often requires different concepts to be employed
Resilience.
simultaneously, and 4Sight complements the well-established ‘Plan-Do-Check-Act’
(PDCA) methodology. While PDCA provides consistency, 4Sight provides the flexibility
to deal with today’s big, complex issues. A blend of the two methodologies requires
paradoxical thinking – and is key to success in achieving Organizational Resilience.

The emphasis on PDCA or 4Sight will depend on accurately identifying the nature of
the challenges faced by the organization. The report warns that organizations fail
more often because they solve the wrong problem than because they get the wrong
solution to the right problem.

Together, the PDCA and 4Sight models offer a structured framework for
understanding and pursuing both continual improvement and innovation to
mitigate the impact of disruptions and add real value to stakeholders. Whether
you are the Chief Executive setting the direction of the business, or an individual
focusing on a specific task, the models will help you achieve and sustain
Organizational Resilience.

ORGANIZATIONAL RESILIENCE | BSI AND CRANFIELD SCHOOL OF MANAGEMENT 9

MANAGEMENT 9
 Leadership matters

Implementing any framework for Organizational Resilience requires effort and

effective leadership. In an increasingly complex and dynamic world, it calls for
leaders who are able to direct and coordinate change, but to do so collaboratively,
not by alienating their people with ‘top down’ visions and targets, but by harnessing
the talent of those who can develop solutions to emerging challenges.

Executives must manage the tension between the strong supportive leadership
that their people want to see during times of change, and the more challenging
collaborative leadership that will optimize talent. Echoing the report’s main
themes, in leadership, as elsewhere, an increasingly uncertain, complex and
ambiguous world calls for an appropriate balance between defence and progression,
consistency and flexibility.

Finally, the report provides guidance on how Organizational Resilience can be

developed, and illustrates how some world-leading organizations – Infosys, Baiada,
NxtraData, SAP, and Ciena – have prospered through it.

“I just know that our people are the key to the

success of this business, right from our executive
management down to the senior management
and the people on the floor.”
Chief Risk Officer, Baiada

10 ORGANIZATIONAL RESILIENCE | BSI AND CRANFIELD SCHOOL OF MANAGEMENT

“Resilient organizations must manage the tension
between consistency and flexibility, finding the right
balance needed between controlling risks and taking
opportunities.”
Professor David Denyer

ORGANIZATIONAL RESILIENCE | BSI AND CRANFIELD SCHOOL OF MANAGEMENT 11

 The full report is available from bsigroup.com/organizational-resilience

To cite this report:

Denyer, D. (2017). Organizational Resilience: A summary of academic evidence,
business insights and new thinking. BSI and Cranfield School of Management.

bsigroup.com/organizational-resilience
12 ORGANIZATIONAL RESILIENCE | BSI AND CRANFIELD SCHOOL OF MANAGEMENT