USE CASE GUIDE Anticipate, prevent, and minimize the impact of business disruptions 9 best practices for building operational resilience 2 USE CASE GUIDE We live in uncertain times. Organizations today face a wide range of operational threats that can disrupt their business and result in massive financial and reputational damage. These threats run the gamut from floods, fires, and earthquakes to cyberattacks, political unrest, and economic downturns. And in addition to these external environmental and societal hazards, businesses also have to contend with internal threats such as labor disputes, technology failures, and data privacy violations—any one of which can bring a business to its knees. Just waiting for disaster to strike isn’t a strategy. It’s a recipe for calamity. Instead, enterprises have to build operational resilience: the ability to anticipate and prevent operational disruptions, as well as the ability to quickly respond to, recover from, and adapt to these events when they occur. Resilience needs to be a core business competency, not an afterthought. And the benefits are clear. Recent research by Boston Consulting Group concluded that resilient organizations lower the shock of crises, recover faster, and recover to a greater extent than organizations that are less prepared. In fact, according to the research, approximately 30% of a business’s relative total shareholder return (TSR) is linked to resilience. But operational resilience doesn’t just happen. It requires organizational commitment, a clear strategy, and effective execution. And operational resilience is an ongoing process. As businesses and the threats they face evolve, organizations need to continuously adapt and expand their operational resilience capabilities. In this white paper, we examine nine best practices— anchored in real- world experience and demonstrated business outcomes— for building and maintaining operational resilience. 3 USE CASE GUIDE 1. Establish effective governance across your organization Operational resilience isn’t a single department. It spans your entire enterprise, involving every business function and all of your critical processes. For instance, if you’re a manufacturing company, then anticipating, preventing, and responding effectively to disruptions involve not just your manufacturing teams but also facilities, HR, IT, procurement, and many other groups. Finance also plays a pivotal role, both to support investment in operational resilience—for example, hardening facilities or strengthening cybersecurity—and to ensure crucial financial processes that underpin revenues and cash flow are also resilient. That’s why operational resilience should start at the top. Boards need to establish resilience as a business priority and identify key areas of focus. In addition, boards must clearly determine and communicate an organization’s risk appetite. Knowing what levels of risk are acceptable, and in what areas, is fundamental to building operational resilience. Then, executives need to take these board-level priorities and turn them into specific resilience initiatives, breaking down organizational silos, empowering business and functional owners, establishing measurable success criteria, and implementing a consistent framework for execution, visibility, and accountability. This governance mustn’t be an overlay on business as usual—it needs to permeate business processes rather than simply being wrapped around them. 3 4 USE CASE GUIDE 2. Identify and prioritize your business services Ultimately, operational resilience is about ensuring your critical business services are strong yet flexible. What is a business service? It’s a specific business capability, such as conducting e-commerce transactions, managing payments to third parties, or providing customer support. Your business likely has dozens—or even hundreds—of these services. However, their criticality varies and depends on your business model. For instance, conducting e-commerce transactions is probably extremely critical if you’re an online retailer, whereas approving new customers might be more critical if you’re a credit card company. Identifying and prioritizing business services requires a consistent, consolidated approach. It can’t be done in organizational silos. To prioritize, you need both centralized visibility and a level playing field. Also, take an “outside-in” approach when evaluating business services. If you only ask a business service owner how critical their service is, they’re likely to overstate its importance. Make sure you also ask the business stakeholders who consume that service or are affected by it. For instance, coming back to the e-commerce example, ask finance what the impact on company revenues would be if your e-commerce capabilities are out of action. Be sure to ask about duration—what is an acceptable length of disruption? A 12- hour disruption for your procurement business service may be acceptable, but a weeks-long disruption might bring your business to a halt. 5 USE CASE GUIDE 3. Map dependencies and interconnections of critical business services Now that you’ve identified and prioritized your critical business services, you need to know how they’re delivered. Typically, each business service depends on a well-defined set of business processes, facilities, people, and technology, and an issue affecting any one of these underlying components represents a threat to the overall business service. By understanding these components and how they’re related, you can quickly and accurately evaluate the potential impact of operational risks and take appropriate action to drive operational resilience (more on that later). Again, this requires a consistent, consolidated approach. It’s also important to take an iterative approach, starting with a few critical business services to accelerate time to value. Capture all of the dependencies and interconnections for your chosen business services in one place. By creating a unified view of the truth, you empower your entire business, allowing multiple business functions to collaborate, make informed decisions, and pull in the same direction to improve your operational resilience. One more note. When you create this unified view of dependencies and interconnections, timeliness and accuracy are important. Poor data results in poor decisions and rapidly undermines the trust of business stakeholders. Don’t try to build and maintain a vast data repository from scratch. Instead, integrate existing data from the systems where this information already lives, or even better, create a unified view on a platform that already hosts much of this data. For example, if your IT organization already has a repository (often a configuration management database, or CMDB) that captures applications, IT infrastructure, and how they’re related, then integrate this data rather than trying to manually replicate it. Not only will you build confidence and drive better outcomes, but you’ll also save enormous time and effort. 6 USE CASE GUIDE 4. Prevent disruptions by proactively identifying and addressing operational risks Effectively managing risk and compliance is the front-line defense in your operational resilience strategy. By proactively identifying risks and addressing them, you minimize the likelihood of business disruptions. Keep in mind that risk management needs to span your entire organization and not just operate as an isolated business function. Make it easy for every employee to highlight risks—for example, by providing self-service interfaces where employees can report emerging risks when they arise. Build collaborative processes that help risk teams and business owners work together to remediate risks. And once again, it’s critical to understand business process dependencies and interconnections to prioritize risks. For instance, you may identify a risk for a process, facility, or even a specific piece of IT equipment. But to understand its criticality, you have to know which business services the at-risk component affects. Compliance is the companion to risk management. By implementing controls, you establish oversight of potential risks, so you can proactively prevent operational incidents from happening. And as we said previously, operational resilience needs to be integrated into your business processes, not just wrapped around them. If you digitize your business processes, you can embed controls directly into process workflows, ensuring they’re consistently enforced. Doing this allows you to continuously monitor controls, rather than just relying on periodic audits. This narrows the risk window, so you can quickly identify systemic noncompliances, recognize them as emerging risks, and address them through your risk management processes. 7 USE CASE GUIDE 5. Increase resilience by identifying and analyzing a wide range of disruption scenarios Operational resilience can’t just be a theoretical exercise. To truly ensure operational resilience, you have to identify and analyze different disruption scenarios to determine the impact each scenario would have on your business. Think of this like playing a game of Jenga. If you pull out a block, does your business fall down or does the tower remain standing? For example, what would happen if a flood affected one of your facilities? Would a supply chain disruption prevent you from delivering on contractual commitments, or is your business resilient enough to quickly switch to alternative suppliers? By examining a wide range of scenarios, you identify gaps in your operational resilience and then treat them as risks that need to be remediated. And, once again (not to belabor the point), you need to understand business service dependencies and interrelationships to analyze these scenarios. Let’s come back to the example of a flooded facility. Which teams work at that facility, which business processes do these teams participate in, and what physical infrastructure is located there? And ultimately, which business services do these people, processes, and systems support? Remember that a disruption of these resources can impact multiple business services, and you need to understand the impact to establish the criticality of the potential disruption.