Small Business MBA

The 4 C’s of Risk Based Resiliency

Structured Resiliency Planning

Building a resilient organization requires challenging assumptions and understanding elements that may appear to be well known. Regardless of the scope of planning, government and commercial strategists can benefit from a fresh look at the problem from another perspective.

Time-tested, cross-discipline methodologies allow practitioners to take an objective look at how to solve critical problems in constructing resilient organizations. Taking a page from Deming’s “Plan, Do, Check, Act” model and applying it to risk management gives us a solid foundation to construct meaningful, and adaptable strategies for city and regional resilience. Through the use of a “4 C” model, governments and industry can come together to identify, prepare and respond to crises in their area. In addition, the fourth “C” — Correct — builds a plan to “fail forward”, learning from past events to improve service delivery through the next series of events that occur — even if they are not directly related.

This model fits within an overall framework to form a comprehensive structure for citizen-centric planning. It provides proactive, risk-based capability analysis to support the overall local/regional goals of disaster avoidance, sustainability and resilience.

Catalog

In order to understand your organization’s operational ecosystem, a detailed and inclusive view of the landscape is required. Beyond a simple ‘risk registry’, the risk catalog is an aggregation of both the systematic approach to identify and define specific risk, as well as the complex, networked risk model produced by this analysis.

The risk catalog contains detailed attributes that provide a rich ecosystem view of potential hazards. Placing them into an operational context, risks are associated with other elements of the system to form a comprehensive model of the organization’s exposure. This provides a solid baseline from which the balance of analysis and actionable information can be developed.

Risk catalog assessment builds on this foundation by combining traditional evaluation and mitigation techniques with rich ecosystem details of organizational, infrastructure and external supply chain details. Hazards are not evaluated as stand-alone events, but rather they are viewed as a systematic continuum rooted in comprehensive analysis.

By presenting a model that simultaneously views risk from multiple perspectives, organizations can objectively visualize how business exposure is linked to operational, technical and environmental hazards. This analysis allows planners and strategists to effectively communicate outstanding risk and objectively drive organizational behavior to effect change.

Communicate

The value of business information lies in its ability to drive effective actions. Building an awareness of risk across the organization requires placing them into meaningful context illustrating the impact to specific areas. Leadership, employees — and even customers — must “see themselves” in the problem to find the most effective methods to mitigate and respond to risks. This analytic view personalizes risk while producing comprehensive, systematic change across the entire organization. Additionally, by providing an operational view of exposure, this model clarifies holes in the risk/response fabric that can be filled at all levels of the organization using new and innovative approaches to reducing underlying factors.

Awareness also informs governance processes across the organization. In addition to technical governance; business, organization and resource governance processes benefit by having an objective change driver than can be evaluated for effectiveness. On an individual level, clear risk communication builds a culture of compliance by overlaying strategic risk and exposure onto day-to-day activities.

Governance input and operational engagement are key success factors in building a complete, inclusive, and resilient organizational system.

Systematic mitigation of risks provides a comprehensive approach to reducing exposure and improving response. A complete model of the ecosystem — including internal and external elements — allows organizations to objectively understand how complex interactions can magnify or reduce efforts to limit negative effects of events. Preparation, response and recovery actions can be developed at the strategic and operational level to support optimized resource allocation towards social, economic and environmental events.

Applying standard metrics across organizational mitigation efforts allows for a comprehensive measurement of the effectiveness of resource investment. This analysis benchmarks performance and informs capital planning to effectively engage resources and produce auditable, transparent records for financial and non-financial reporting.

Coordinate

While successful implementation requires diligent design and planning efforts, execution of those solutions provides critical feedback into the resilient organizational system. Organizations prepare for adverse events along three distinct vectors: performance of assets, diversity of resources and redundancy of systems. Combined with coordinated improvements in the organizational capacity to adapt to changing situations, the planning model provides a comprehensive net of resiliency for the organization.

When events happen, the framework clearly defines the appropriate response. Through simple, clear and consistent processes and procedures, organizations can rapidly adapt to situations and apply controls and contingencies appropriate to the risk. Objectively mapped out in advance, the model manages events to produce consistent and predictable outcomes. Transparent lines of governance establish suitable resource allocations to mitigate exposure, returning the organization to an operational posture.

Correct

Through systematic planning and orchestrated response to risk, recovery can effectively be managed to nominal operations. Using standardized, tested and well communicated processes, organizations minimize negative impacts and monitor consequences. As the organization returns to normalcy, the data points collected can be overlaid with Key Risk Indicators (KRIs) in the planning model to quickly and accurately develop root cause assessments to understand the origin and evolution of adverse events.

Each event becomes an organizational learning opportunity, improving resilience and outlining a path to ‘fail forward’. Flowing analysis back into the original framework provides an unbiased approach to measure organizational readiness and response to risk events. The Daniel Group has developed a Risk Management Maturity Model to benchmark progress across all areas of the organization. This structured methodology enhances governance, risk and compliance processes, building a more robust and resilient organization by design, not chance.