key: cord-0050584-phpwziqm authors: Schäffer, Utz title: Levers of Organizational Resilience date: 2020-09-24 journal: Control Manag Rev DOI: 10.1007/s12176-020-0133-3 sha: dfba5d6c1ca22a694e10f6cf676dbcf073a1f331 doc_id: 50584 cord_uid: phpwziqm nan How can companies deal with low-probability, high-impact events? More importantly, what can they do to prepare for external shocks? For a long time neither of these questions were -to put it mildly -at the forefront of scholarly debate or boardroom discussion. However, awareness has grown sharply in the wake of shocks such as 9/11, the 2008/2009 Financial Crisis andin particular -the current COVID-19 pandemic. Company leaders increasingly understand that this type of event may not be that rare after all and that they are unlikely to correctly anticipate the next disruptive shock. Consequently, companies need to invest in organizational resilience. What many had previously considered a buzzword suddenly seems to matter. At the same time, I often find the discussion and the underlying understanding of what organizational resilience really is to be rather vague. In the popular press, resilience tends to be reduced to the notion of financial slack, redundant supply chains, and maybe one or two other aspects of the overarching concept. However, such an approach seems to be too restrictive and once a crisis passes companies will likely struggle to justify seemingly inefficient practices like redundant suppliers and IT systems. What companies need is an indepth understanding of organizational resilience and a clear roadmap illustrating what managers and controllers can do to prepare their organization for the next crisis. With this in mind, I define resilience as the ability to respond and adapt to new challenges and sudden disruptions (Lee/Vargo/Seville 2013; Distel 2017; Kahn et al. 2018 ) and set out a framework encompassing four levers that companies can mobilize to enhance organizational resilience: strategic risk management, adaptive management, resource availability, and, lastly, robust and flexible operations. I explain what it takes to activate each of these levers before discussing why enhancing a company's resilience is not as simple as it may initially appear and what CFOs and controllers need to do. What do you need to do to prepare for an external shock? Let us first think about this from a more personal, common sense perspective. Having access to sufficient resources, be it money in your bank account, some gold under your pillow, or sufficient food and beverages in your storage room, will surely help, as will your degree of personal autonomy and the diversification of your assets. The theory is simple: a self-sufficient farmer would find it easier to survive a crisis than a scholar who cannot fix simple things himself and relies heavily on one or two outside suppliers for his daily needs. But be careful: the farmer is not safe either, and so he had better diversify his activities to ensure that he can still survive should a virus kill his cattle or a pest infest his grain. Similarly, if you have invested your assets in one particular stock or house, you will likely be in trouble if an external shock hits; you should therefore diversify your belongings. You can also develop your resilience by becoming more adaptive, i.e. learning that succumbing to shock can be fatal and that you need to react in the right way: calmly, decisively, quickly. Last but not least, your resilience score will likely be higher if you -Mail: utz.schaeffer@whu.edu prepare yourself by anticipating challenges and external shocks, if you think things through in advance, take out insurance, and implement adequate precautions. Sounds simple enough? The good news is that we can apply the same theory at corporate level. To become more resilient, companies need to understand how to: • manage strategic business risks as well as external, uncontrollable risks and prepare accordingly, • make management more adaptive in terms of processes and culture, • make sure that sufficient resources are available, and -last but not least -; • set up robust processes and flexible structures by securing a sufficient degree of autonomy, redundancy, and diversification (see Figure 1 ). In other words: organizational resilience is built upon resources, processes, and structures, as well as the approach to management and strategic risk. Therefore, organizations, in their quest for resilience, need to go beyond doing one or two things differently just because these happened to be helpful during a previous crisis. Resilience is more than just a new tool or process; it is a fresh perspective on business and the required resources, processes, and structures. Let us now take a look at the four levers in more detail. Anticipating external shocks is difficult and managers far too often think they can increase resilience by predicting low-probability, high-impact events Resilience is more than just a new tool or process; it is a fresh perspective on business. (Taleb/Goldstein/Spitznagel 2009) . However, as previous crises and the current pandemic have shown, this frequently does not work. Trying to anticipate internal and external shocks is not enough to guarantee resilience; companies need to make sure that they are prepared for the unknown. While that may sound simple, managers often fall short of drawing the necessary conclusions, and risk related practices tend to be dominated by risk reporting and a rules based compliance and control approach (Gleißner 2017) . As a result, risk management tends to be perceived as a compulsory bureaucratic exercise rather than a learning opportunity. To be clear: compliance, reporting, and control are largely appropriate for preventable risks arising from within a company. However, they are highly unsuited to managing strategic business risks and external, uncontrollable risks. If organizational resilience is to be increased, these risks need to be dealt with differently (Kaplan/ Mikes 2012; Kaplan/Leonard/Mikes 2020; Schäffer/Weißenberger 2020): • Internal and external business risks require proactive risk dialogue and a healthy degree of risk appetite. With the help of risk maps and interactive discussions, management can effectively reduce the likelihood and impact of these risks. • External, uncontrollable risks cannot be avoided either. However, practices such as scenario analyses, wargaming, and stress testing help management overcome the 'illusion of certainty' and practice how to deal with different outcomes. These practices also allow management to prepare for extreme scenarios by undertaking insurance and hedging programs and by deploying crisis management (or business continuity) procedures and management teams for critical incidents. In short: current risk management practices tend to be dominated by efforts to avoid or eliminate risks arising from within a company cost effectively and to comply with risk regulation. Organizations wanting to enhance resilience need to go further and set up a business-led dialogue on strategic business risks and external, uncontrollable risks. Both risk types require not only a different control model, but also a different risk culture: learning and dialogue need to complement compliance and control. While strategic risk management can help to ensure that managers are prepared, it is not enough to simply consider flexibility and speed in decision-making in functional terms. Therefore, the second resilience lever takes into account the fact that management teams need to react quickly when an external shock hits their company. Lean and flexible management processes are clearly an asset in such situations. Projects that reduce the granularity of planning ('lean' , 'simplify') are a potential gateway toward making management more adaptive, but companies also need to make sure that political behaviors and well-established bureaucratic routines are reduced and -ideally -eliminated. As Hope and Fraser (2003) , Bogsnes (2016) , and the Beyond Budgeting Round Table ( BBRT) community have argued for over twenty years, companies need a more fundamental re-Summary • Organizational resilience is in vogue. However, it is often unclear what companies can do to become more resilient. • The framework developed in this article includes four levers that organizations can operate: strategic risk management, adaptive management, resource availability, and robust and flexible operations. • Building a truly resilient organi zation is no easy undertaking and overcoming the barriers requires substantial effort. design of steering processes and substantial changes in the context in which managers operate, specifically the organizational structure and the culture of the company. They provide a framework (see Figure 2 ) that encapsulates many of the aspects management teams need to consider if they want to become more adaptive, and have documented many use cases (available at www.bbrt.org). Make no mistake: the path toward business agility is built on both, processes as well as a new management philosophy that needs to be entrenched within the management system. As a consequence, truly adaptive management requires a major transformation effort (Bogsnes 2016; Schäffer/Weber 2019) . Let me highlight three aspects that I find to be of particular importance for every organization embarking on this journey. Values and purpose can orient and guide managers and employees in times of crisis. Mental fortitude and an optimistic, self-confident attitude (i.e. important aspects of human resilience) will help them cope and move forward. Lastly, the right type of culture will play a vital role in overcoming gaming, overly hierarchical decision-making, and established political routines: a culture that fosters transparency and open information exchange, the power of the better argument ('bouncing things off each other is fun'), goal orientation, and accountability (Schäffer/Weber 2017). Let us now turn to the third resilience lever: slack, or the availability of (actual or potential) resources that provide a buffer in times of crisis (Bourgeois 1981) . It is important to note that slack comes in different forms and should not be restricted to so-called financial slack, i.e. sufficient levels of cash and Source: Bogsnes et al. 2016 Management processes • Social slack: goal alignment and embeddedness within a broader system and thus potential access to additional resources from suppliers, customers, governments, local authorities (Reeves/Levin/Ueda 2016; Lengnick-Hall/Beck 2005), etc. Whatever its form, slack is a double-edged sword. From the perspective of efficiency, you want to minimize slack because it conflicts with the quest for efficiency and provides "an additional cost to the organization or the customer" (Galbraith 1973, p. 15 ). At the same time, slack can help stimulate innovation and "smooth organizational performance in the face of environmental hostility" (Bourgeois 1981, p. 37) , i.e. it can augment organizational resilience. Managers therefore need to balance efficiency with resilience and innovation and find the optimal level of slack (see Figure 3 ). This type of conscious rationalization, however, does not seem to be common practice in the corporate boardroom (Martin 2019; Bourgeois 1981) and is difficult to achieve. As external shocks become more common and fundamental challenges to business models like digitalization call for more innovation and change, management teams need to rise to the challenge and reconsider given levels of slack. Organizations can mobilize four levers to enhance their level of resilience. Robust and flexible operations make up the fourth lever of this framework. While there are many ways to increase resilience by adjusting organizational processes and structures, three design variables stand out: autonomy, diversification, and redundancy. I will now address each variable in turn. A high degree of autonomy reduces an organization's vulnerability and thus contributes to organizational resilience. It can take many forms. Where there are interfaces with other organizations, vertical integration and deglobalization will both tend to enhance organizational autonomy and therefore reduce exposure to potential shocks. Within a company, autonomous cells and modular structures can adapt more quickly and thus help the company to stay afloat in times of crisis (Yu/Greeven 2020) . In addition, modularity prevents failures of individual cells from having too much of an impact on other, less affected parts of the organization. Diversification and redundancy in turn build on the old saying that you shouldn't put all your eggs in one basket; instead, organizations should try to benefit from the risk-mitigating effect of a portfolio. Overly high levels of specialization can help maximize performance in the short term, but increase the likelihood of your organization being a victim of the next crisis. This applies at all levels: diversification across businesses and regions, but also redundancy along the supply chain and across communication channels and vital internal systems. Just like having two kidneys, interchangeable suppliers and factories, alternative transportation routes, and redundant IT systems can make all the difference in times of difficulty. Making resilience work across the four levers is not as straightforward as it may seem, for (at least) five simple reasons. First of all, organizational resilience requires many organizational capabilities across corporate functions such as supply chain management and operations, finance (including accounting, treasury, controlling, and risk management), and, last not least, HR (Williams et al. 2017) . Some of these capabilities cannot be developed in the short term. Adaptive management or cultural competencies, for instance, mostly require a long journey of organizational transformation that may or may not be successful. Scope and time frame thus constitute the first and the second barriers to organizational resilience. The third barrier relates to the strategic nature of resilience. Most elements of this framework (enhancing robustness and flexibility in operations, for instance) will likely affect how a company tries to generate value. Similarly, changing the way a company deals with suppliers, customers, local authorities, and governments when striving to increase its social capital is strategic in nature. Most efforts to increase resilience consequently involve some form of strategic, and not just operational, change. At the same time, organizational resilience hardly appears compatible with the mindset of short-term efficiency and performance maximization that prevails in stock-listed and many other companies. The pressure to deliver Autonomous cells and modular structures can adapt quickly. and perform on a quarterly basis within these companies is immense and, perhaps even more importantly, most managers have internalized the view that we need to increase efficiency and maximize performance on a shortterm basis rather than identify robust, sustainable levels of shareholder return. Those are the deeply internalized rules of the game, it seems, and everything that violates the corresponding mindset of performance extremeness is likely to be reserved for marketing brochures but will not be taken seriously 'in real life' . Cultural change is difficult and establishing a mindset of prudence, sustainability, and moderation ("das rechte Maß", see also Sanders/Hambrick 2007) requires time and energy. Lack of compatibility with established mindsets therefore constitutes the fourth and possibly the most important barrier. Finally, let me highlight a fifth barrier to organizational resilience. Not only is the challenge posed in terms of scope, time frame, strategic nature, and change in mindset immense, but ownership over organizational resilience and the required change effort are frequently insufficiently clear. When I conducted interviews for this article, I often heard that nobody really feels in charge of resilience and that it was hard to say who I should talk to. With this in mind, the successful implementation of any resilience-oriented roadmap requires CEOs and CFOs to make it abundantly clear that they believe in organizational resilience and are ready to walk their talk. They also need to be explicit about who the resilience champions and the respective process owners are. This begs the question: how can controllers contribute to the journey toward greater organizational resilience? Controllers can shine in a crisis (Schäffer/Weber 2020) . They add value by evaluating the crisis' impact on profit and cash flow, ensuring that the company has sufficient liquidity, pinpointing savings, identifying which investments can most easily be cut, and keeping management focused on the essentials. However, it is usually less clear how controllers could help their company prepare for the next crisis. I find that controllers can contribute to corporate resilience in three ways. Firstly, they can generate value by demonstrating ownership over the resilience levers falling within their traditional remit, namely the design of the corporate steering process, strategic risk management, and optimal flexibility of the cost structure. CFOs and controllers need to take the concept of business agility seriously and push ahead with their efforts to organize finance in a way that best supports agile management teams. At the same time, they should not leave strategic risk management to internal audit teams and staff groups focused on risk reporting. Controllers need to facilitate interactive, business-led risk dialogue and assist the management of strategic business risks as well as external, uncontrollable risks by utilizing their exper tise in risk maps, scenario analyses, et cetera. Last but not least, controllers need to make sure that the cost structure reflects an adequate balance of efficiency considerations and flexibility. Resilience requires a major change effort across functions as well as a new mindset. Secondly, controllers can act as guardians of corporate resilience by analyzing how much businesses should invest in different resilience levers. As we have seen before, resilience tends to be costly and in the short term it can easily be confused with inefficiency and waste. It is therefore essential that the debate about the optimal degree of resilience moves beyond intuition and gut feeling. Controllers can help in this endeavor by applying their expertise in evaluating investments and risk modeling to topics like the optimal degree of financial and non-financial slack, robustness, and flexibility for different business units and the company at large. That will, however, only be successful when controllers are close to the business and thoroughly understand the organizational processes and structures in question. Thirdly, controllers can act as change agents and add value by challenging current resilience levels, driving transformation efforts, and coordinating resilience-oriented activities across business units and functions. Setting up a task force coordinated by controllers will generally prove beneficial. Before the resilience task force starts working, it needs to assess the actual need for more resilience. This may vary considerably depending on the business unit, region, and time frame involved. The task force also needs to secure the unwavering commitment of the top management team. Without the proactive support of CEOs and CFOs in particular, every resilience initiative will quickly degenerate into a waste of time and energy. As soon as both these conditions are satisfied, the task force can assess the potential resilience contribution of the different levers and their respective components. When it comes to this second step, it is important to understand that there is no one-size-fits-all solution, but that companies need to focus on different levers for different industries and business models. Moreover, task force members need to understand that the levers are substitutes and complements, rather than working in isolation. Sufficient slack can compensate for progress in adaptive management and strategic risk management. Operational, human, and social slack can compensate for financial slack. In all these cases, both levers act as substitutes. At the same time, adaptive management processes and interactive discussions in strategic risk management will likely not work without an enabling context: values and purpose that give direction, mental fortitude, and an optimistic, self-confident mindset as well as the right type of decision-making culture. Process and context serve as complements. Similarly, autonomous cells in the supply chain will benefit hugely from, or may even be impossible without, adaptive management processes and mindsets. As a consequence, the task force needs to evaluate individual initiatives from a more holistic, 'resilience as a package' perspective. In a closely related third step, the managers and controllers involved should evaluate the company's absolute and relative strength per lever and identify critical resilience gaps by contrasting relevance and actual strength. This leads to the fourth step, where the task force should assess the investment and change effort required. Ideally, some resilience initiatives will pro-Controllers can act as guardians of corporate resilience. vide an opportunity to simultaneously improve efficiency. Making the steering process more adaptive and moving toward agile forms of management, for example, will regularly bring about such a win-win situation. In many other cases, however, the management team needs to deliberately decide how much efficiency and short-term profit it is willing to sacrifice for increased resilience. This, of course, requires a solid understanding of the company's appetite for resilience as well as a good grasp of how costly different resilience initiatives are. In the final step, the task force should move forward and integrate resilience-related initiatives into the corporate transformation roadmap. Ideally, organizations should not use an isolated resilience roadmap that complements roadmaps on sustainability, digitalization, and the like. Since resilience impacts many (if not all) aspects of managing a company, it should constitute an integral part of the overall corporate transformation roadmap rather than being treated as an isolated project (see Figure 4) . Making a company more resilient usually demands considerable effort. The good news is that changes in resource availability, adaptive management, and strategic risk management that support organizational resilience commonly also help take into account other megatrends facing a company. Let me give you two examples: resilience and the digital transformation of an organization both benefit from agile management approaches (Schäffer/ Weber 2019) and financial slack. Similarly, resilience and the quest for sustainable management practices both typically benefit from deglobalization and robust supply chains. As a consequence, doing your homework on digitalization and sustainability will help your resilience efforts as well. The levers are substitutes and complements, rather than working in isolation. If you believe that the frequency and scope of external shocks that your company is facing will continue to escalate, it is up to CEOs and CFOs to make their organizations more resilient, increasing their ability to respond and adapt to new challenges and sudden disruptions. Trying to anticipate external shocks in strategic risk management is important. However, anticipation has its limits and top management teams need to prepare for unforeseeable shocks. Hedging and insurance, crisis management procedures and pre-assigned response teams, sufficient availability of resources, robust and flexible operations, and, last but not least, adaptive forms of management can help management to enhance resilience. However, building a truly resilient organization is no easy undertaking. On the contrary, managers will face major barriers, as outlined in this article, and overcoming them requires substantial effort. On a final note: when preparing for and dealing with the impact of a crisis, managers should not focus solely on coming out of the situation largely unscathed. Whenever possible, they should see the external shock as an opportunity to make the company stronger. Like the Hydra in ancient Greek mythology: cut off one head and two grow in its place. Implementing Beyond Budgeting: Unlocking the Performance Potential, 2 Update of the Beyond Budgeting Principles, Beyond Budgeting Institute On the Measurement of Organizational Slack Unveiling the Microfoundations of Absorptive Capacity: A Study of Coleman's Bathtub Model Designing Complex Organizations Robuste Unternehmen und strategisches Risikomanagement -Ein Blick in die Vergangenheit und Zukunft Beyond Budgeting: How Managers Can Break Free from the Annual Performance Trap The Geography of Strain: Organizational Resilience as a Function of Intergroup Relations Managing Risks: A New Framework Novel Risks Developing a Tool to Measure and Compare Organizations' Resilience Adaptive Fit Versus Robust Transfor mation: How Organizations Respond to Environmental Change The High Price of Efficiency The Biology of Corporate Survival. Natural Ecosystems Hold Surprising Lessons for Business Swinging for the Fences: The Effects of CEO Stock Options on Company Risk Taking and Performance, in: The Academy of Management Controlling-Kultur -Schlüssel zum Erfolg Controllers Beitrag zum agilen Unternehmen Coronavirus Crisis: Controllers' Can Shine Der nächste Schock kommt bestimmt The Six Mistakes Executives Make in Risk Management Managing the Unexpected: Resilient Performance in an Age of Uncertainty Organizational Response to Adversity: Fusing Crisis Management and Resilience Research Streams How Autonomy Creates Resilience in the Face of Crisis Springer Professional Organizational Resilience Organisationen digital und resilient transformieren -Ein Kompass zur ganzheitlichen Organisationsentwicklung Positive Psychologie und organisationale Resilienz -Stürmische Zeiten besser meistern Resilient by Design -Creating Businesses That Adapt and Flourish in a Changing World Erhältlich im Buchhandel oder bei: beck-shop.de | Verlag Franz Vahlen GmbH · 80791 München | kundenservice@beck.de | Preise inkl The author would like to thank Lars Brückner, Hans-Martin Hellebrand, Nils Kaschner, Matthias Laupichler, Björn Radtke, Marko Reimer, Nathalie Repenning, and Jürgen Weber for their helpful comments.