Enterprise Resilience:What does BS65000 mean for you?

www.pwc.co.uk

Charley Newnham

BCI Forum, June 2015

PwC

For your consideration

• What is organisational resilience?

• The bluffer’s guide to BS65000

• Practical resilience models you can use in your workplace

2

June 2015

PwC

Challenge #1

• Jot down 3 companies that have failed in recent years

• Jot down 3 companies that seem to be thriving right now

3

June 2015

Questions

• Are the companies on the second list more resilient than those on the first?

• Is it likely that any of the 3 failed companies didn’t have BCM, Risk Management or Crisis Management protocols?

• What are the key differences between the organisations in the first and second lists?

PwC

What is organisational resilience?

4

June 2015

What’s your definition?

“The ability of an organisation to provide and maintain an acceptable level of service in the face of faults and challenges to normal operation by preventing, avoiding and

resisting damage and recovering quickly.”BCI Conference Speaker 2013 (paper from 2011)

“The capacity of an organisation to plan for and adapt to change or disruption, through anticipation, protection, responsive capacity and recoverability”.

BCI Working Group Paper, 2012

“The capability of an organisation to anticipate, and respond and adapt to, incremental change and sudden disruptions in order to survive and prosper.”

BS65000

“The capacity of an organisation to react to change to survive and evolve.” PwC

PwC

Why BCM isn’t resilienceThe Crisis Continuum mapped to Business Continuity Management

5(Newnham, 2012, after Burnett, 1998)

Business Continuity Management

effort to the ‘left of bang’

Time

To manage /respond during and

to the right of bang

Requirement to

RespondOpportunity to build resilience

Sense check

How many of your “3 failed” organisations disappeared because of a single event?

PwC

Three key points

1

2

3

An organisation’s resilience is its capacity for sustaining survival and success

Resilience is generated and diminished by ‘who’ you are, ‘what’ you do and ‘how’ you

do it as an organisation.

Resilience that is understood can be altered, manipulated and leveraged to

enable sustained existence and success.

6

June 2015

PwC

Perception of increasing

industry/sector failures

Stakeholders expect more

from us

Increased regulatory pressure

Increased resilience guidance

What’s driving the conversation?

• “RBS apologises for Cyber Monday technology breakdown” (FT);

• “1200 dead and no one to blame” (The Sun on Mid Staffs NHS Trust);

• “News of the World closes down” (FT);

• “FCA stands by decision to sanction Paul Flowers as Co-op Bank chairman” (FT);

• “Council fined over loss of 78 unencrypted laptops” (Daily Mail);

• “Whitbread promises supply chain crackdown amid horse meat scandal (The Telegraph);

• “Blackberry outrage hits RIM on iPhone5 day” (CNN Money);

• Closures of established firms: Woolworths, Barings Bank, Lehman Brothers, Sea France, ITV Digital...

• BS65000 – Organisational Resilience Guidance Standard (2015);

• Roads to Resilience (Airmic, 2014)

• ISO 22316 Organisational Resilience (expected 2017);

• Australian government Organisational Resilience website

• ICSA guidance

• Bank of England: Resilience Benchmarking

• OfWat: Resilience Outcome Focussed Regulation;

• OfGen: Lords investigating regulator role in resilience;

• ORR: Demand Network Rail consider resilience • Staff

• Customers

• Shareholders

• Regulator(s)

• Government(s)

• Public perception

• Company lifespans are getting shorter

• Change feels deeper and/or more rapid

PwC

The bluffers guide to BS65000What it says

8

June 2015

Benefits

• Sustained viability

• Competitive advantage

• Coherence

• Efficiency & effectiveness

• Reputation

• Societal resilience

Operational aspects include

• Risk management

• Health & safety

• Business continuity

• Environmental management

• Facilities management

• Security

• Supply chain

• [It’s a long non-exhaustive list!]

Enabling survive and thrive:

• Be informed: what’s coming?

• Set direction: stress test strategies and change course when needed

• Be coherence

• Develop adaptive capacity

• Strengthen the organisation through it’s culture, approaches, innovation and actions

Challenges

• Redundancy costs money

• Just in time v just in case

• Reliability v innovation

• Stated values v behaviours

• Legal and regulatory obligations

PwC

Enterprise ResiliencePwC periodic table of key resilience indicators

It

Se

Lg

In

Cr

Co

Rm

Sc

Pe

Re

Te

Fi

Xr

Ir

Sa

Bv

Va

Vi

En

Sc

Gv

Le

St

Su

Iv

Va

lue

pro

tect

ion

Ca

pa

bil

ity

&

Ca

pa

city

Co

nte

xt

Iden

tify

Lea

der

ship

9

June2015

IdentityIncludes: values, behaviour, social capital

Context and environmentIncludes: situational awareness, networks and dependencies

LeadershipIncludes: governance, stress-tested strategies, disciplined innovation

Value protectionIncludes: risk management, BCM, security, crisis management

Capability and capacityIncludes: people, supply chain, finance

Who We

Are

PwC

It

Se

Lg

In

Cr

Co

Rm

Sc

Pe

Re

Te

Fi

Xr

Ir

Sa

Bv

Va

Vi

En

Sc

Gv

Le

St

Su

Iv

Va

lue

pro

tect

ion

Ca

pa

bil

ity

&

Ca

pa

city

Co

nte

xt

Iden

tify

Lea

der

ship

10

June2015

June2015

PwC Enterprise Resilience Framework

PwC periodic table of resilience indicators and PwC Resilience outcomes

PwC

Other models for Organisational Resilience

11

June 2015

Source: ResOrgs c 2012Source: International Consortium for Organisational

Resilience (ICOR – community focussed)

PwC

How resilient is your organisation?What shape is your resilience?

12

PwC

Why is your organisational resilience that shape?

13

PwC

Jim Collins’ Five Stages of DeclineOne theory worth bearing in mind…

14

June 2015

Organisations can live on past success for quite a long time

In reality, the profits (represented by this line) can be going up while the organisation is dying

A company can survive up to Stage 4; return from Stage 5 is almost impossible

PwC

Let’s talk about elephant in the roomIs enterprise resilience on the board’s agenda?

Repeated failures

Reduction in sales

Decreasing operating profit

Greater competitor activity

Increasing regulatory pressures

Living on past success Planning for acquisitions

Exciting change

Planning for growth

Entering new markets

Emerging opportunity

When was the last time “organisational resilience”

was on the Board’s agenda? Building on success

15

June 2015

Thoughts, questions, questions for each other?

This publication has been prepared for general guidance on matters of interest only, and does not constitute professional advice. You should not act upon the

information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is given as to the

accuracy or completeness of the information contained in this publication, and, to the extent permitted by law, PricewaterhouseCoopers LLP, its members,

employees and agents do not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act,

in reliance on the information contained in this publication or for any decision based on it.

© 2015 PricewaterhouseCoopers LLP. All rights reserved. In this document, "PwC" refers to the UK member firm, and may sometimes refer to the PwC network.

Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details.

Charley Newnham

M: +44 (0) 7930 402575E: charley.newnham@uk.pwc.com