Building a Resilient Organization Ready for What Comes Next

Being prepared is an ongoing activity. Pictured members of our CWE community increasing their awareness with presenter Frank Fazio.

In IT, change is more an environment than an event; to thrive, organizations must be resilient. Challenges evolve, new issues present themselves and often what worked yesterday is only a partial response today. Organizational resilience is a requirement. But unlike many requirements, you can’t install it, issue a purchase order for it, or have it delivered. Resilience is built.

The first pillar of organizational resilience is your core values.

Saying that a system needs core values may seem counter-intuitive, but every system is built on something, for something, serving someone. Values define why and how that happens. When everything else changes, organizational values remain the same. Values tell you who you are and how you make decisions. They define your principles. They guide your response when disruption disorders your business.

Brian Chesky, founder an CEO of Airbnb  lost 80% of his business in a matter of weeks in 2020. The company was on the verge of one of the largest tech IPOs ever, valued at over $30 billion. Chesky faced what he has since called in interviews his ‘darkest professional moment.’  The company faced uncertainty to a previously unimaginable scale. The company, its stakeholders and a whole lot of people would look to the CEO to guide the Airbnb boat. In a crisis, “you make principle decisions, not business decisions,” he said. “A business decision is a decision predicting the best possible outcome. A principle decision is irrespective of the outcome” (Stolzoff). Chesky’s list of guiding principles included four things: Act fast, preserve cash, act with all stakeholders in mind, and play to win the next travel season.

Principles are the “How”. Values are the “Why” that powers them.

But resilience requires more than values, they need to be tested against what’s actually true – which is where the next pillar comes in.

The second pillar of resilience is commitment to dealing staunchly with reality.

The 1993 bombing of the World Trade Center killed six people and damaged the building, but it left Morgan Stanley with a question: was this a one-time act of violence, or the first attempt at something that would happen again?

The World Trade Center was a symbol of American financial and political power, and symbols make appealing targets. Dealing with reality meant recognizing that their building was a major source of risk. Protecting the firm now meant protecting the lives of the thousands of people in it – not something that was part of the average financial services company plan. Morgan Stanley committed themselves to that as a reflection of the company’s values.

CWE Team member Laura McCabe capturing insights at a resilience planning exercise with one of our stakeholders.

Staring down reality told Morgan Stanley what was coming. But knowing a threat exists and being ready to act on it in the moment are two different things — which is where the third pillar comes in.

The third pillar of building resilience is practice

Preparation is critical, but who hasn’t felt annoyed or inconvenienced by a fire drill? Most of the time, a drill is a false alarm – ten minutes to leave your laptop and just enough time to break your concentration. All for a threat that probably will never come.

Knowing that, Morgan Stanley’s Head of Security Rick Rescorla was insistent.

For the next seven years, 2,700 Morgan Stanely employees, housed across 22 floors in the south tower, practiced their safety evacuation plan twice a year. On September 11, 2001, one minute after the first plane struck the north tower, Rick Rescorla issued the evacuation order, counter to Port Authority announcements telling people to stay in place. 2,687 Morgan Stanley employees safely escaped the south tower between 8:46 am and 9:03 am when the second plane struck the south tower.

Head knowledge isn’t enough. Having a binder isn’t enough. Resilience is a learned reflexive response.

But beyond being reflexive, resilience is also built on reflection

When we face the reality of the risks in our environments and build in regular opportunities to discuss them, we begin to “train ourselves to survive before the fact”. We transform that planning into navigational knowledge through what we capture afterwards.

The form that learning takes changes by industry but has a common thread: Airbnb held ‘listening sessions’ with their hosts after the pandemic stopped travel.  Morgan Stanley took the 1993 attacks very seriously and applied Rescorla’s military experience to its safety protocols. Technical teams run post-mortems and incident reviews after an outage. Different rooms, different vocabularies, same discipline — the discipline to capture what can be learned, so the organization can start from “a higher baseline” next time.

Values, reality, practice, remembrance — these are the structures a resilient organization builds. But structures don’t respond to a crisis. People do.

The final pillar, and arguably the most valuable, is your people

The strength of an organization is its people – pictured: Navraj Toor, Amandeep Sandha, Joanne Soave, Aislyn Laurent.

People bring the creativity and resourcefulness. Their wellbeing is the organization’s wellbeing. If they are overworked, stressed and pushed to the limit in daily life, they won’t have the resilience, creativity and courage to respond.

The challenge, according to Shanna B. Tiayon, Ph.D is that “employers aren’t incentivized to invest in [employee well-being]…thus if preparatory resilience isn’t hard baked into the organization’s values, it often goes overlooked.” Wellbeing investment shows up as a cost this quarter and a benefit some unknown quarter in the future, and most incentive structures aren’t built to reward that trade. Which is exactly why the organizations that treat it as optional usually find out the hard way that it wasn’t.

Resilience is a system that is built before the crisis happens. You don’t have a system if you’re building it as you’re bailing out the water. But also, none of our examples put focus on resilience planning until after a significant event happened to them or those around them. Resilience is rarely built from a blank page; it’s built by treating the first crisis as a design brief for surviving the next one.

Organizational resilience reflects the collective strengths of your planning, systems and people (Tiayon).

They are often the “Important” things that aren’t “Urgent”. Until they are.

Taking the time (and a page out of Steven Covey) to look at your systems, to check in with your people, to capture your thoughts and make notes can feel like a low-priority item. It’s easy to put off. But it’s these insights that allow you to build your resilience brick by brick.