BRYAN'S BLOG

Risk Leadership: Risk vs Resilience

Over the past six months I have become involved with Jason Gotch and his Organisational Resilience Working Group which has a dedicated LinkedIn Group if you are interested in joining.

Yesterday I replied to an email from a member in the group on the topic of Organisational Resilience vs Risk Management and gave some thoughts on it.  I thought many of you may be interested in OR, so I’m starting our own discussion by copying and pasting the bulk of the email below, which shows my views on resilience, risk and the role of the CRO:-

From my perspective and for a very longtime I have considered that risk management done well delivers value to the organisation.  Not just compliance, not just a provider of comfort to the Audit and Risk Committee and subsequently the Board, but a function that provides insight and strategic leadership. It provides the opportunity to drive strategic growth (see diagram below).

Opportunity diagram

When resilience came along I baulked at the need for it.  For over a decade I have been painting a picture of the risk management journey for Boards and Execs that shows them risk is a journey towards resilience as an organisational state (see diagram below).

RM journey

Having said that, I recognise that Organisational Resilience, Community Resilience and Personal Resilience are all very important concepts and I am not too fussed on how we get there.

Consequently, whether an organisation has a CRO (risk) or a CRO (resilience) I don’t think it makes a difference. I am just not keen on one of each. As you can see the acronym works for either! Then of course you can have an Executive General Manager Risk and Resilience and cover both!  Semantics.

There is significant work going on to articulate OR at the international standards level. See interview with Jason Crask in here http://www.cirmagazine.com/DigitalEditions/January2016/cirJan2016_1.pdf

My main concern for organisations is that we end up with two insufficiently related work streams that would create more work for organisations than any value derived.

I am very hopeful (as both a risk practitioner and an RMIA Director) that the RMIA Special Interest Group on Organisational Resilience that Jason is leading will produce some excellent thought leadership on the subject.  The output of which will help guide organisations to not only achieve resilience but to also achieve it efficiently with a clear understanding of the relationship between risk and resilience in its various guises.