People & Resilience: developing your resilience culture

“Company culture” … often quoted as a driver for recruitment and employee retention, has also been praised by companies, as it helped them navigate through the uncertainties during the pandemic and provide strong leadership, good relationships and adaptable employees. How can organisations make culture an asset to tackle crises? This article explores the concept of resilience culture and provides insight into how it can be developed, measured/assessed and improved to enhance your ability to respond to crises.

Why have a resilience culture?

The UK Financial Services regulators (Bank of England, PRA, FCA) define operational resilience as “the ability of firms and the financial sector as a whole to prevent, adapt, respond to, recover and learn from operational disruptions”. In order to increase their resilience, firms must identify their critical services and the tolerable level of disruption to these services for their customers, themselves and the market. They must put in place the necessary measures so critical services can always be provided, whatever happens. This is at the core of “Resilience by Design”.

Achieving this outcome requires a mindset change: as a firm, you must always be planning for the worst case, as zero-risk does not exist. This means putting in place the right capabilities in the key operational domains of resilience (incident and crisis management, cyber defence, IT recovery, business and IT continuity, third party resilience, operational risk management), but also ensuring that the concept is integrated at an individual level and that people in your organisation behave in a resilient way. To have resilient individuals, you need to promote a “resilience culture”: a set of values, beliefs and behaviours that nurture resilient individuals.

How to set up a resilience culture and influence positive change

In order to set up the right culture for resilience and promote positive change, Wavestone recommends the following four steps:

Step 1: Identify the core of your resilience culture

In order to set up a resilience culture that is aligned to your company DNA, you need to look for its foundations in your company values. How do these values make you more resilient and help you in a crisis? For example, having “Audacity” as a value means that you are encouraging individuals to be proactive, think outside the box, make decisions fast – all qualities that will be useful in a crisis. This translation of your values into resilience outcomes will make it easier to embed resilience in the organisation. This should be coupled with 3 enablers which must sit at the core of your resilience culture: a sense of common purpose, a flexible mindset, and transparent and frequent communication in the organisation.

A critical success factor to this cultural change is that senior management should be driving and supporting the initiative. They play a key role in defining the vision of the target culture, embodying the change and showing the way.

Step 2: Define the behaviours you want to encourage

From your values and enablers, the next step is to articulate clear, bespoke behaviours you want to encourage, for individuals, for management, and in relationships with external stakeholders and partners. For example, to promote “transparent” individuals, the behaviour you want to encourage for employees is “if I notice a risk, issue or mistake, I am able to acknowledge it and communicate it without fear of repercussions”. On the other hand, for managers, the behaviour to encourage is “I will listen to employees communicating risks, issues or mistakes, and encourage them to share them by avoiding putting the blame on the messenger”.

You should define multiple levels of behaviours, as not everyone in your organisation will have the same maturity when it comes to resilience. We have identified four resilience maturity levels from an individual point of view which contribute to developing a resilience culture at organisational level:

• Level 1 – knowledge: “I am aware of resilience good practices and attributes and try to apply them”. Such individual understands the concept of resilience and knows what is expected of him/her.
• Level 2 – comprehension: “I know how to apply my resilience knowledge in case of crisis”. Such individual is aware of the different policies and procedures and governance existing within his organisation and the appropriate steps to follow in case of crisis.
• Level 3 – application: “I behave as a resilient individual in my day-to-day job” . Such individual is able to put the theory into practice in his/her working environment on an everyday basis: he/she embodies the best practices.
• Level 4 – influence: “I am a champion for the resilience culture, I act as a role model to spread the right behaviours.” Such individual is able to transfer his/her knowledge to upskill and guide other individuals to adopt the right behaviours and automatisms. This individual is also able to suggest new ideas and to challenge the status quo to improve resilience processes. Champions can be informal, or they can also be part of an official ambassador community within the organisation dedicated to promoting the resilience culture.

These levels of behaviours can then be integrated into HR processes and embedded into employees’ professional development objectives. This will ensure that they are turned into concrete actions and that employees have an incentive to reach the higher level.

Step 3: Set up concrete capabilities to encourage these behaviours

To improve through these different maturity levels, you should set up concrete capabilities encouraging resilient behaviours. We see two types of capabilities: capabilities that develop these resilient behaviours (training, communication, agile ways of working, etc.) and capabilities that test those behaviours (surveys, exercises, etc.).

These concrete capabilities change in nature based on which behaviour maturity level you want to encourage:

To accelerate the setup of new capabilities, you can leverage technology since the market is very active in tools that facilitate and accelerate cultural change: gamified training, micro-learning, mini-surveys, collaborative recognition solutions, etc.

Step 4: Measure the maturity of these capabilities and take positive action

As you put in place resilience capabilities, you should always think about metrics to measure their maturity and their contribution to your overall resilience. In the case of culture, maturity of capabilities can be expressed through the levels of behaviour maturity they help develop (from knowledge to influence) and through quantitative and qualitative results from tests, simulations, and feedback received.

Culture needs to be integrated in your resilience MI as one of the key operational domains that contribute to resilience, like incident and crisis management, cyber defence, IT recovery, business and IT continuity, third party resilience, and operational risk management. Each culture capability needs to have a maturity score expressed in a similar way to how you would assess the maturity of all other capabilities and needs to be mapped to the specific threats it helps tackle. This will allow you to get a view of the maturity of your resilience culture and how it contributes to facing threats.