Business resilience explained: How organizations keep working through disruption and change

Disruptions to your operations are a constant threat. Cybersecurity incidents can cause data breaches that affect your customers for months (if not years). Supply chain shocks force you to choose between raising prices or losing margin. Workforce shifts have you dealing with gaps in capability until you rush to fill them. When you don’t have a plan for these disruptions, you’ll constantly be on the back foot.

Business resilience describes an organization’s capacity for dealing with these disruptions while keeping operations going as smoothly as possible. Building resilience into your organization is an investment that pays for itself in reduced downtime, faster recovery times, and smoother operations.

Here’s your guide for doing that.

What is business resilience?

Business resilience is an organization’s ability to weather disruptions, adapt to meet new challenges, and maintain operations.

Resilience has three foundational elements, according to longtime HBR editor and contributor Diane Coutu: a down-to-earth perspective of reality, an ability to derive meaning from even terrible events, and an ability to make do with whatever’s available. These elements are just as relevant for business resilience as personal resilience. 

Business leaders who have a grounded perspective can guide their organization through difficult times more effectively than those who are overly optimistic. Teams that can turn obstacles and setbacks into meaningful challenges—rather than becoming demoralized by them—are more resilient. Employees can also make their teams more resilient by learning how to use the resources at their disposal to meet their goals, no matter the obstacles that come their way.

Business resilience vs. adjacent terms

Business resilience is often mistaken for business continuity, disaster recovery, and agility. Here are quick definitions of each term.

Business continuity is about ensuring that operations keep running smoothly through a disruption. It involves identifying potential risks to the organization, their impacts, and drafting an action plan for dealing with these risks. Business continuity plans may be built for scenarios like key leaders leaving or supply chain shocks affecting prices. 

Disaster recovery is specific to IT systems, data, and infrastructure. It’s a plan for restoring these things after disruptive events like outages, cyberattacks, natural disasters, or hardware failure. Where business continuity addresses operations more broadly, disaster recovery is about getting systems back online.

Agility is a broader ability for an organization to detect change and adapt to it quickly. That adaptation can include changing your business strategy, re-allocating resources, or shift operations to address challenges. Agility goes beyond responding to challenges or overcoming obstacles. Agile organizations are best-equipped to capitalize on opportunities as they come.

Business resilience is the overall ability of a business to respond to disruptions and opportunities. Business continuity and disaster recovery are specific practices within business resilience, while agility is a characteristic that helps businesses be more resilient.

Business resilience vs. adjacent terms

Business resilience is often mistaken for business continuity, disaster recovery, and agility. Here are quick definitions of each term.

Business continuity is about ensuring that operations keep running smoothly through a disruption. It involves identifying potential risks to the organization, their impacts, and drafting an action plan for dealing with these risks. Business continuity plans may be built for scenarios like key leaders leaving or supply chain shocks affecting prices. 

Disaster recovery is specific to IT systems, data, and infrastructure. It’s a plan for restoring these things after disruptive events like outages, cyberattacks, natural disasters, or hardware failure. Where business continuity addresses operations more broadly, disaster recovery is about getting systems back online.

Agility is a broader ability for an organization to detect change and adapt to it quickly. That adaptation can include changing your business strategy, re-allocating resources, or shift operations to address challenges. Agility goes beyond responding to challenges or overcoming obstacles. Agile organizations are best-equipped to capitalize on opportunities as they come.

Business resilience is the overall ability of a business to respond to disruptions and opportunities. Business continuity and disaster recovery are specific practices within business resilience, while agility is a characteristic that helps businesses be more resilient.

The core pillars of organizational resilience

The three foundational elements of resilience should lead to broader practices that build resilience in your business. Here are the pillars you should aim for.

Operational continuity and redundancy

Business resilience requires an ability to maintain operations through disruptions, which is called operational continuity.  It’s your organization’s ability to keep operations running relatively smoothly no matter what comes. That involves planning for disruptions, building flexibility into your operations, and even drafting potential scenarios to practice and measure responses.

Redundancy is part of operational continuity. It means having systems that can come online if your main system goes down or having people who can make important decisions when your leaders can’t. Build redundancy into your business by finding its potential failure points and building failsafes.

Communication and coordination under stress

Communication and collaboration are already challenging in the best of times. Misunderstandings and misalignment can happen even when things are running smoothly, and the pressures of disruptions and market changes can compound that risk. That’s why resilience requires clear guidelines for communication and collaboration that can withstand additional stress.

These guidelines can include which channels are appropriate for certain types of communication, how mission-critical updates should be communicated, and whether teams should prioritize face-to-face meetings or asynchronous communication.

Adaptive leadership and decision-making

If your decision-making process is overly rigid, your business will be less resilient. You need systems in place for leaders to make decisions that allow the organization to adapt to disruptions and opportunities, like continuous feedback from teams or delegation. You should also have a way of delegating important decisions to other leaders or teams, especially when a leader is unavailable due to a disruption.

Technology and infrastructure resilience

Disruptions of your IT systems and infrastructure can have wide-ranging impacts on the rest of your organization, making resilience in this area essential. Building resilience into your systems can involve having a clear disaster-recovery plan, an on-call rotation for IT teams, and backup systems for when essential tools go down.

Disruptions of these systems are inevitable and always have at least some consequences, so you need to plan for them.

Workforce and cultural resilience

Building resilience into your workforce will help the business as a whole adapt and change as challenges come. Systems and better decision-making aren’t enough.

First, you need to build redundancy and backups into the way people work, the same way you would for technical tools and systems. That can include cross-training, so mission-essential knowledge isn’t stuck in the mind of the one person who may not be available during a disruption. It also means having a clear succession path for leadership roles, so you always have someone ready to step up.

You also need to help your workforce develop psychological and behavioral resilience. Give employees the support they need to be more resilient and meet challenges head on.

How resilient organizations actually operate through disruption

Here are some practical elements of resilience that organizations use to move through disruptions and market changes.

Pre-established decision responsibilities

One of the most important things to do during a crisis is to make a decision. The longer it takes for a team to make a decision, the more it has to compensate when it’s time to act. When a disruption happens, resilient organizations already know who’s responsible for choosing next steps. Tying disruptions to specific departments streamlines the decision-making process, and having clear chains of command means there’s always someone empowered to make a decision.

Scenario planning and stress testing

Resilience doesn’t come from waiting for something to happen. You should have plans in place to deal with potential disruptions, whether that’s a software tool going down, a crucial team member leaving the organization, or a broader market shift affecting your bottom line. When you have these plans in place, you should test them regularly to find potential weaknesses and improve on them.

Cross-functional incident response

A response to a specific incident may be owned by a single department, but the team actually responding to it shouldn’t be pulled exclusively from that department. Take a data breach, for example. While IT may own the systems involved in the breach and the cybersecurity aspects of your response, they shouldn’t be acting alone. Once they handle the initial breach, they may hand things off to legal so you can know the consequences of that breach. From there, another team may draft a statement and prepare responses for affected customers.

Transparent internal communication protocols

A resilient organization should have a clear plan for communicating a disruption, its impacts, and its potential resolution. That means knowing which channels are appropriate, who’s responsible for initial communications and status updates, and clear rules for asking questions and suggesting fixes.

FAQ

What is business resilience?

Business resilience is an organization’s ability to continue its operations while dealing with disruptions—which include system outages, supply chain problems, cybersecurity incidents, and workforce changes. A resilient organization may see small hiccups during these disruptions, but can bounce back quickly.

How is business resilience different from business continuity?

Business continuity is a specific planning process for keeping functions operating during a defined disruption (e.g., a clear succession path should a key leader leave). Business resilience is a broader capability, which includes plans, structures, culture, and decision-making practices that allow an organization to handle a variety of disruptions.

How can organizations start building resilience?

Start by identifying your organization’s failure points. That could be dependency on specific IT systems, a significant amount of decision-making power being concentrated in one person, or unclear communication guidelines. From there, build playbooks for responding to potential disruptions, have clear protocols for communicating during a disruption, and then test what you build with simulated incidents.

Build resilience

A resilient organization outperforms a less resilient one because disruptions are inevitable. Whether it’s workforce changes, a market shift, or a data breach, your ability to keep operating through disruptions will shape your organization’s future. Build resilience by finding your organization’s weak spots, testing them, and documenting the results, and you’ll keep growing even through the toughest challenges.