Most organisations still plan for disasters in two separate rooms. In one, the risk team keeps a register of hazards and scores them. In the other, the emergency or business continuity team keeps a plan for what to do when something goes wrong. The two documents rarely refer to each other, and they are often reviewed in different months by different people.
That split is where resilience tends to break down. A flood risk that sits at ‘medium’ in the register has no matching trigger in the response plan, so nobody acts until water is already in the car park. This article looks at how to join the two halves into one enterprise resilience programme, and what practitioners can do about it this quarter.
What enterprise resilience actually covers
Enterprise resilience is the ability of an organisation to anticipate disruption, absorb it, keep critical services running, and recover in a way that leaves it stronger. Response is one part of that. The others sit before and after the event: identifying exposure, reducing it, preparing people and systems, and learning from what happened.
It helps to think of four connected activities:
- Understanding risk: hazards, vulnerabilities, dependencies and the people or assets exposed.
- Reducing risk: structural, operational and financial measures that lower the likelihood or the impact.
- Preparing to respond: plans, trained teams, equipment, communication channels and tested procedures.
- Recovering and adapting: restoring services, then changing the system based on what the event showed.
Frameworks such as the Sendai Framework for Disaster Risk Reduction 2015–2030 and ISO 22301 for business continuity management both push in this direction. They ask organisations to treat risk knowledge and response capability as one cycle, not two projects.
Where proactive risk management and response drift apart
The register has no link to action
Risk registers record likelihood and impact, but many stop there. A useful entry also names the early indicator, the person who watches it, and the point at which the response plan switches on. Without that, the register is a record of worry and not a tool for decisions.
Dependencies are mapped late
Most serious disruptions to a company come through something it does not own: a single supplier, a regional power feeder, a cloud provider, a road that floods. Teams often map these only after an incident exposes them. A dependency map built in advance, even a rough one, shows which outside failures would stop critical services within hours.
Exercises test the plan, not the decision-making
A tabletop that walks through the plan page by page proves the document is readable. It does not show whether the duty manager can decide at 2 a.m. with half the information. Scenarios that remove a key person, a system or a communication link teach more than those that run smoothly.
A practical model for joining the two
You do not need a new department. You need a shared structure that both teams use. The sequence below has worked for organisations of very different sizes.
1. Start with critical services, not assets
List the five to ten services the organisation cannot afford to lose, such as dispatch, patient care, order fulfilment or payroll. For each, agree the maximum time it can be down before harm becomes serious. That number drives everything else, from backup choices to staffing.
2. Tie every top risk to a trigger and an owner
For each high-rated risk, write down what you would see first: a river gauge reading, a supplier delay, a spike in failed log-ins, a heat warning. Then name who watches it and what they are allowed to do without waiting for approval. This one change turns passive monitoring into early action.
3. Set decision rights before the crisis
Decide who can close a site, move staff, switch to a backup system or spend emergency funds. Write the thresholds down. In real incidents, hours are lost when people are unsure whether they have the authority to act.
4. Fund mitigation as an operating decision
Prevention budgets lose out when they compete with visible projects. Presenting mitigation in terms of downtime avoided and recovery costs saved makes it easier for finance leaders to weigh it. Even a simple comparison of the annual loss expected from a hazard against the cost of a control gives the board something concrete.
5. Close the loop after every event and exercise
After an incident, a drill or even a near miss, hold a short review and feed the findings back into the risk register and the plan. Record what changed, who owns it and when it will be checked. Otherwise the same lessons come up year after year.
Measuring whether it is working
Resilience is hard to measure directly, but a few indicators are easy to track and hard to fake:
- The share of top risks with a named trigger, owner and response action.
- Time taken to activate the crisis team from the first warning sign.
- Recovery time achieved in exercises compared with the agreed limit for each critical service.
- Number of actions from past reviews still open after 90 days.
Report these to senior leaders in the same pack as financial and safety performance. When resilience appears next to revenue and incident rates, it gets the attention it needs.
Common mistakes to avoid
Treating the plan as finished once it is approved is the most frequent one. Plans go out of date as soon as staff, suppliers or systems change. The second is buying technology before the process is clear; a dashboard cannot compensate for a trigger nobody owns. The third is leaving out the people on the ground. Site supervisors, control room staff and local responders usually know which assumptions in the plan are wrong, and they should be in the room when it is written and tested.
Key takeaways for practitioners
- Run risk management and response as one cycle with shared owners, not as two separate documents.
- Anchor planning on critical services and the maximum downtime each can tolerate.
- Give every high-rated risk an early indicator, a named owner and a pre-approved action.
- Map outside dependencies before an incident shows them to you.
- Test decision-making under pressure, not just the wording of the plan.
- Track a small set of resilience indicators and report them alongside financial and safety results.
- Review every event, drill and near miss, and record the changes that follow.
The next article in this series looks at urban seismic resilience, where early warning and engineering decisions made years earlier decide what happens in the first minute of an earthquake.