The article considers the possibility of applying the theoretical concept of resilience to the optimization of activities to improve the resilience of organizations. For this purpose, various approaches to the concept of resilience and its practical implementation are analyzed. The generalizing point for these approaches is the understanding of resilience as the degree of readiness to respond adequately to unforeseen events and circumstances. Thus for organizations, resilience is cognate to risk management. In order to optimize costs, the analysis of the relation between these types of activities was carried out. Based on the definition of resilience as a component of risk management, a multi-level approach to optimizing the cost of improving the resilience of organizations is proposed. In this approach, the most effective measures to improve resilience are selected end-to-end, while increasing the scope of the task consistently: from the level of specific activities to the analysis of interactions between organizations. This reduces the impact of uncertainty on risk-based decisions by maximizing consideration of factors and boundary conditions.
Recent examples of natural, man-made, and humanitarian disasters have revealed a lack of readiness of companies to deal with unforeseen threats of a serious scale. "Black swans", that is, catastrophic events difficult to predict, from a rare phenomenon passed into the category of quite probable. In such circumstances, traditional risk management methods focused on a thorough threat analysis and based on the extrapolation of retrospective assessments and expert assessments representing a generation of a more stable period will no longer work. This does not allow companies to develop adequate responses to sudden shocks, which often leads to significant losses.
To solve this problem, organizations must develop the ability to withstand an emergency and recover from a failure. This is the goal of the concept of resilience, which has recently become one of the most frequently used in various disciplines when considering sustainable development issues.
The main purpose of the work is to study the possibility of applying the theoretical concept of resilience to optimize the activities aimed to improve the resilience of organizations. The first section provides the basic concept of organizational resilience. In the second section, resilience is considered in the context of risk management activities. In the third paragraph, a multi-level approach to optimizing the cost of improving the viability of organizations is proposed.
The term resilience or stress resistance in Russian
translation was used by scientists, starting with Seneca and
Cicero, then Bacon and others in the middle ages,
gradually becoming more universal and relevant over time
[
The Latin word “resilio", passed into English as
“resilience” in the sense of “bounce back, go back”. It is
in this sense that resilience is understood in the first
approach – the ability of the system to return to its original
position after being out of balance. At the same time,
resilient species overcome adverse external influences at
the expense of internal resources [
The second approach understands resilience as the
ability of a system to adapt to stressful events without
necessarily returning to its original state. The main
disadvantage of such adaptability in socio-ecological
systems, as noted by A. Hornborg [
D. Chandler [
The definition of resilience, which summarizes all
these approaches, is used in the UN Strategy for disaster
risk reduction [
One of the important areas of research on resilience is
organizational resilience. Here, as in the mainstream of
research, there is a high degree of activity of researchers
with many different approaches to the subject. M.
Linnenluetske [
L. Hiao, and H. Cao [
A large number of studies have been devoted to the
development of indicators for determining the level of
resilience of companies [
J. Park et al. [
I. Linkov et al. [
As a result of their combination with the process of
resilience, the authors obtained [
The use of the matrix does not imply the use of certain quantitative estimates, but allows you to get a comprehensive view of the system's readiness for shocks and to identify weaknesses that require priority study.
The work [
Companies that are active users of natural resources
can use approaches to assess so-called "sustainable
resilience" [
Thus, at the moment, there are a number of approaches to assessing the current level of resilience of an organization, from which you can choose the most appropriate to the context of the organization's activities and the required accuracy of analysis. Based on the results obtained from such assessment, it is possible to plan further steps to improve the level of preparedness of organizations to respond to unexpected stressors.
When implementing the concept of resilience in companies, it is necessary to understand that this activity does not replace the need for existing risk management practices. Resilience can be either an independent line of work or a complementary function in relation to risk management. To successfully combine these practices, it is necessary to clearly understand the difference between their main goals and methods.
The main difference between the two approaches is that risk management is aimed at identifying and neutralizing risks that can cause unacceptable deviations of the company's indicators from the planned ones. At the same time, resilience is designed to respond to unknown threats, and in the process of responding, the original targets can be changed in accordance with changed circumstances.
The risk management process, as presented in the most
popular ISO 31000(2018) [
Given the fact that risk management based on the
identification and analysis of risks cannot completely
exclude the occurrence of unforeseen events, and their
frequency has been objectively increasing in recent years,
the resilience approach, which consists in organizing the
company's actions in the event of unforeseen events, is the
missing link in the risk management activity. J. Park et al.
[
To explain the differences between the scope of
classical risk management and resilience, we provide a
graphical explanation in Fig.1. At time T1, classical risk
management methods can be used to extrapolate current
knowledge of possible risk (direct V1 = f1(T1)). However,
due to the inertia of human thinking and the methods used,
there has recently been a gap between the rate of increase
of vulnerability V=f(T) from the area of assessed risks (the
area under the line V1 = f1(T1), highlighted in Fig.1.).
Therefore, at time T2, there remains a risk area that is not
covered by risk management activities. It is precisely to
close this gap that the company's resilience is being
developed. And the higher the growth dynamics of risk
exposure is, the higher the significance of activities for the
development of resilience.
Working to improve the resilience of companies shifts
the focus of risk management to strategic risks and
strategic assets. This is due to the fact that in the process
of responding to a stressful event, resilience does not
exclude modifications of the main process, the loss of
individual components of the system, and other changes.
In the work [
Thus, the concept of resilience can be considered as an element of risk management activities with due consideration of the identified differences and the development of boundary conditions. With high dynamics of changes in the quality and level of risks, such activities can significantly compensate for the inertia of traditional risk management approaches.
As with any other investment decision, companies
need a tool to analyze possible alternatives and choose the
best solution to improve their resilience. However,
investments in risk management measures and resilience
have a number of significant differences from commercial
investment projects. The main difference is that the
assessment of the effect of such activities is based on
probabilistic estimates of events that are not fully
understood. This can cause difficulties in making a priori
decisions. For any organization, making a wrong decision
about the level of resilience in an uncertain environment
can lead to the following adverse consequences [
To reduce uncertainty and maximize consideration of all factors associated with increased resilience, we perform a cost-effectiveness analysis at four levels (fig. 2). This approach will allow to identify the most effective measures at each level, from which the most relevant for the organization could be selected.
At the first level of analysis, we will highlight the
measures that are most effective in reducing losses after
incidents. As known, it is better to prevent a fire than to
extinguish it. And the effective cost of resilience has a rule
of leverage – relatively small costs at the preparatory stage
give a huge effect in the case of risk realization. For
example, an analysis of many projects aimed at reducing
the risk of natural disasters has shown that the vast
majority of them were profitable in terms of a posteriori
cost-benefit analysis [
In the general case, the cost effectiveness of the resilience Еres could be determined by the ratio of areas ΔSloss/Sres (Fig. 3). where ΔSloss - reduction in incident response costs; Sres – costs for improving resilience. At the second level, we will consider the impact of costs of resilience as part of the risk management activities. To do this, we use the total cost of risk (TCR) indicator, which takes into account the entire amount of possible costs associated with risks. This indicator is often used to optimize risk management and insurance measures. The total cost of the TCR risk is determined by the sum of the following components:
TCR = Cret + Cins + Crm → min where Cret - capital reserve for self coverage of expected and unforeseen losses; Cins –insurance premium; Crm - noninsurance costs.
Non-insurance costs will consist of two components: risk reduction costs (Crisk) and resilience costs (Cres): Crm= Crisk+ Cres, then
TCR = Cret + Cins + (Crisk + Cres ) .
To minimize the total cost of risk, we select such types
of investments in resilience Cres that will minimize the
amount of the contingency reserve for Cret, which will also
have a positive impact on the size insurance premium Cins,
and can also theoretically reduce the estimate of the
expected loss. Taking into account the identified
correlations between the total cost of risk and resilience,
as well as working to strengthen the positive relationships
between TCR components, can lead to a very noticeable
synergistic effect. One of the successful examples of such
joint activities is the extinguishing of the fire in the
NotreDame Cathedral on April 15, 2019. Thanks to emergency
response plans developed jointly with insurance
companies and coordinated with firefighters, it was
possible to save most of the relics and art objects stored in
the Cathedral [
At the same level, the entire risk management process
is coordinated to determine the resilience project's scope
in terms of boundary values. In this sense, it is useful to
use experience from high-risk industries that have
accumulated some experience of planning activities in
conditions of uncertainty. Thus, the International
Commission on Radiation Protection (ICRP) introduces
the following principles of radiation protection [
In this approach, the ALARA (as low as reasonably achievable) principle of protection optimization is applied exclusively in the area of compliance with the required levels of collective and individual risk (dose limits), and only for activities whose estimated benefit significantly exceeds the possible harm (justification principle). If the organization has and is fulfilling certain security requirements (for example, industrial or information security), then it is necessary to use the amount of work that has already been done, thereby minimizing the cost of increasing the level of resilience.
In addition to the limits of the optimization area, other
possible strategies must be considered [
At the third level, we will consider applying the
costbenefit analysis to the entire organization. At the same
time, both the scope of the problem and the number of
stakeholders increase significantly. Therefore, before
performing such an analysis, it is recommended to
determine [
Careful analysis of the source data for the calculation is important for two reasons. On the one hand, the calculation of financial indicators, such as the benefit/cost ratio or NPV (Net Present Value), is one of the reference points for making a decision. On the other hand, financial estimates cannot be the only decision-making tool due to the inaccuracy of the initial data. Therefore, all structured information about existing alternatives, assumptions, and limitations is essential for making a decision.
For example, when evaluating the key parameter of the analysis - the discount rate, you need to find a balance between the desire to get returns as quickly as possible (high rate) and take into account as many potential stressors as possible, sometimes with a long horizon of manifestation (low rate).
For public companies, it is important to take into account the views of shareholders. As the practice of large losses shows, the success of the company in the process of responding to an incident affects the share price. In the case of unsuccessful measures, the yield of shares falls, and, conversely, shows an excess of the estimated yield in case of successful countermeasures.
The fourth level of analysis involves considering the possibilities of interaction between different organizations in the event of incidents. Such an association is possible on a territorial or professional basis. This can be a unified response system, the creation of a mutual insurance company, and so on. The development of joint pre-agreed responses by various organizations can significantly improve the effectiveness of investments in their resilience.
This multi-level approach to optimizing the organizational resilience costs will help to determine the required level of coverage and identify solutions that best meet the organization's needs at the lowest cost.
The analysis of theoretical approaches to the concept of resilience allowed us to determine the place of activities to improve the organizational resilience as a component of risk management. This positioning of resilience allows to combine this activity with existing risk management processes in the organization.
The proposed multi-level approach to optimizing the cost of resilience reduces the level of uncertainty in making decisions based on risk assessments by taking into account factors and limitations as much as possible.
The study was supported by the RFBR, grant № 19-0700455