WHAT IS CORPORATE RESILIENCE AND HOW IS IT ACHIEVED. Bruce Braes David Brooks

Transcription

1 WHAT IS CORPORATE RESILIENCE AND HOW IS IT ACHIEVED Bruce Braes David Brooks

2 Disagreement exists whether Organisational Resilience is A Behaviour, An Ability or Principle. So What Is Corporate Resilience?

3 What is Resilience? Engineering: Resilience is the property of a material to absorb energy when it is deformed elastically and then, upon unloading to have this energy recovered. Psychology: Resilience in psychology is the positive capacity of people to cope with stress and adversity. Ecology: In ecology, resilience is the capacity of an ecosystem to respond to a perturbation or disturbance by resisting damage and recovering quickly. Networking: Resilience is the ability to provide and maintain an acceptable level of service in the face of faults and challenges to normal operation. Organisations: Resilience is defined as the positive ability of a system or company to adapt itself to the consequences of a catastrophic event.

4 ASIS Organisational Resilience Resilience is an organization s ability to quickly, efficiently, and effectively adapt to a change, such as disruptive events (natural, intentional or unintentional), by implementing adaptive, proactive and reactive strategies. (Marc Siegel Sydney 2010) BCI Organisational Resilience Holistic management process that identifies potential threats to an organization and the impacts to business operations those threats, if realized, might cause, and which provides a framework for building organizational resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities."

5 Our Understanding of Organisational/Business Resilience Source: Australian Journal Emergency Management

6 Resilience & Maslow DEVELOPMENT NEEDS Continuous Improvement Exercising REPUTATIONAL NEEDS Crisis Management Crisis Communications CULTURAL NEEDS Programme Management, Teams & Processes, Training SECURITY NEEDS Risk Management, Information Security BASIC NEEDS ICT Disaster Recovery Work Area Recovery

7 The First Dimension Enterprise Risk Management (ERM) Corporate Security Management (CSM) Business Continuity Management (BCM) Health Safety & Environmental Management (HSE) Governance & Compliance Management (GCM) Information Security Management (Infosec) Emergency Response & Crisis Management (ERCM)

8 Source: Australian Journal Emergency Management

9 The Second Dimension Mission & Goals Business Strategies Policies & Procedures Organisation & Human Resources Business Processes Information & Technology Facilities & Equipment

10

11 The Third Dimension Values Leadership Change Sensitivity Integration Interdependencies Agility Awareness Communication

12 Source: Australian Journal Emergency Management

13

14 Source: Dr Amy Lee, Stephenson Resilience

15

16 How Can Risk Management Assist Source: AS/NZ ISO

17 And What of Security Adapted from D. Brooks 2004

18 And Business Continuity Avoidance Prevention Protection Preparedness Response Recovery

19 And Then There Are A Few Standards AS/NZS ISO Risk Management Standard AS/NZS ISO Quality Management System AS Fraud & Corruption Control AS Good Governance Principles AS Planning for Emergencies in Facilities AS/NZ Business Continuity Managing disruption related risk AS Planning for Emergencies Health Care BS 7799 Information Security Management BS Risk Management: Code of Practice BS Business Continuity management ASIS SPC Security, Preparedness and Continuity Management Systems ISO/IEC Security frameworks ISO/IEC IT security management ISO TR Financial services - information security guidelines ISO 20858: 2007 Ships and marine technology -- Maritime port facility security assessments and security plan development IS Security Management Systems for the supply chain

20 LEADERSHIP The Top Down Dynamic Leadership align O.R. with business objectives Leadership uses O.R. to seize new business practices e.g. technology Leadership embraces new organisational principles i.e. corporate governance Leadership drives and supports change in internal and external environments Leadership MUST delegate operational responsibility to business units Leadership MUST value diversity Leaders MUST protect shareholder value Leadership can use O.R. to deliver long term value

21 Source: Australian Journal Emergency Management

22 Organisational Resilience is also BOTTOM UP The numerous functional processes including Security Management, Risk Management, BCM, Health & Safety, Governance, Internal Audit, Financial Management drive O.R from bottom up Businesses MUST nurture Creativity and Learnability within to allow bottom up influence on O.R. Behaviours and Trust must be embedded from the Bottom Up Communication MUST be a two way interaction Bottom up as well as Top Down

23 Source: Australian Journal Emergency Management

24 SO WHERE TO FROM HERE? Identify and understand the essential elements of Organisation Resilience Capture the principles Deliver a practical O.R. model to assist organisations to become more resilient Ultimate aim to gain consensus as to what organisational actually is Source: Australian Journal Emergency Management

25 Thank You Questions Bruce Braes Perth Western Autralia resileince.com.au Dr. David Brooks School of Computer & Security Science Edith Cowan University Perth Western Australia Source: Australian Journal Emergency Management