Recent examples of natural, man-made, and humanitarian disasters have revealed a lack of readiness of companies to deal with unforeseen threats of a serious scale. "Black swans", that is, catastrophic events difficult to predict, from a rare phenomenon passed into the category of quite probable. In such circumstances, traditional risk management methods focused on a thorough threat analysis and based on the extrapolation of retrospective assessments and expert assessments representing a generation of a more stable period will no longer work. This does not allow companies to develop adequate responses to sudden shocks, which often leads to significant losses.
To solve this problem, organizations must develop the ability to withstand an emergency and recover from a failure. This is the goal of the concept of resilience, which has recently become one of the most frequently used in various disciplines when considering sustainable development issues.
The main purpose of the work is to study the possibility of applying the theoretical concept of resilience to optimize the activities aimed to improve the resilience of organizations. The first section provides the basic concept of organizational resilience. In the second section, resilience is considered in the context of risk management activities. In the third paragraph, a multi-level approach to optimizing the cost of improving the viability of organizations is proposed.
The term resilience or stress resistance in Russian translation was used by scientists, starting with Seneca and Cicero, then Bacon and others in the middle ages, gradually becoming more universal and relevant over time [1]. In the modern context, the use of the term in relation to ecosystems was initiated by the work of Halling [2], who defined resilience as the ability of an ecosystem to independently maintain and restore the level of basic relationships in it by absorbing shocks and fluctuations in the parameters of external or internal influence. In the last decade, the concept of resilience has played an increasingly important role in the development of political solutions, in addressing environmental, technical and social issues. Despite the wide cross-disciplinary scope of use, to date it has not developed a common understanding of the term [1]. However, by now it is possible to distinguish the main approaches that can be used as a basis for working on the resilience of organizations.
The Latin word "resilio", passed into English as "resilience" in the sense of "bounce back, go back". It is in this sense that resilience is understood in the first approach -the ability of the system to return to its original position after being out of balance. At the same time, resilient species overcome adverse external influences at the expense of internal resources [3]. This static approach to resilience is used in ISO 22313 [4].
The second approach understands resilience as the ability of a system to adapt to stressful events without necessarily returning to its original state. The main disadvantage of such adaptability in socio-ecological systems, as noted by A. Hornborg [5], is the fact that poststress equilibrium is likely to assume the oppression of the natural system, since the significance of social systems for decision-makers is higher. D. Chandler [3] proposed the third, so-called dynamic approach. It defines resilience as "an emerging and adaptive process of subject-object relationships". Chandler explains "the subject does not survive solely because of its internal resources, but survives and thrives because of its ability to adapt or interact dynamically with the socioecological environment."
The definition of resilience, which summarizes all these approaches, is used in the UN Strategy for disaster risk reduction [6]: "The ability of a system, community or society exposed to hazards to resist, absorb, accommodate to and recover from the effects of a hazard in a timely and efficient manner, including through the preservation and restoration of its essential basic structures and functions".
One of the important areas of research on resilience is organizational resilience. Here, as in the mainstream of research, there is a high degree of activity of researchers with many different approaches to the subject. M. Linnenluetske [7] traces the development of the concept of "organizational resilience" from the ability to resist external influences in the 1980s, the understanding of resilience as reliability in the 1990s, to strategies for working with staff, the adaptability of business models and the stability of supply chains in the 2010s.
L. Hiao, and H. Cao [8] note that the fundamental difference between organizational resilience and adaptability, flexibility, reliability, etc. is that the resilience of the organization is understood not only as the ability of the organization to respond, but also to develop in a state of uncertainty, interruptions and emergencies. In addition, the same researchers suggest a multi-level approach to considering the sustainability of the organization from the individual level (personnel), to the level of divisions and the entire organization, and also note the importance of transit relations between these levels.
A large number of studies have been devoted to the development of indicators for determining the level of resilience of companies [9,10]. M. Bruno et al. [11] define four aspects of resilience that are of interest for seismic events: technical, organizational, social and economic.
The following characteristics are proposed for assessing the seismic stability of systems: robustness, redundancy and diversification, entrepreneurship, and efficiency. These characteristics are quite universal relative to the application area.
J. Park et al. [12] consider resilience as a cyclical or, as they write, recursive process, in which it is important to pass the following main stages of information processing and development of adaptation measures: sensing, anticipation, adaptation, learning.
I. Linkov et al. [13] identify and apply [14] four jointly exhaustive components of any complex system: physical, informational, cognitive, and social.
As a result of their combination with the process of resilience, the authors obtained [13] the so-called resilience matrix, which takes into account the quality of each of the selected vital components of the system for each of the processes of ensuring resilience (Table 1) [13]. The use of the matrix does not imply the use of certain quantitative estimates, but allows you to get a comprehensive view of the system's readiness for shocks and to identify weaknesses that require priority study.
The work [15] proposes a methodology for quantifying the system's resilience based on the concept of critical functionality, which is the minimum necessary set of functions during a crisis.
Companies that are active users of natural resources can use approaches to assess so-called "sustainable resilience" [16].
Thus, at the moment, there are a number of approaches to assessing the current level of resilience of an organization, from which you can choose the most appropriate to the context of the organization's activities and the required accuracy of analysis. Based on the results obtained from such assessment, it is possible to plan further steps to improve the level of preparedness of organizations to respond to unexpected stressors.
When implementing the concept of resilience in companies, it is necessary to understand that this activity does not replace the need for existing risk management practices. Resilience can be either an independent line of work or a complementary function in relation to risk management. To successfully combine these practices, it is necessary to clearly understand the difference between their main goals and methods.
The main difference between the two approaches is that risk management is aimed at identifying and neutralizing risks that can cause unacceptable deviations of the company's indicators from the planned ones. At the same time, resilience is designed to respond to unknown threats, and in the process of responding, the original targets can be changed in accordance with changed circumstances.
The risk management process, as presented in the most popular ISO 31000(2018) [17] standard, is represented by a cycle of the following stages: scope and criteria -risk assessment -risk treatment -monitoring and controldocumentation. As risk management has moved into the management area from the technical one, which was used for the risk analysis of dangerous objects, it has adopted the characteristics of probabilistic safety analysis of technical objects. This approach is used most extensively in the nuclear power industry, due to the severity of the consequences. It allows to assess the possible size of nuclear damage, taking into account the probabilities, and to organize the safety management of a nuclear facility by developing recommendations for improving safety (reducing risk) based on the results of risk assessments. Conducting such an analysis allows, on the one hand, to ensure a given level of security of nuclear facilities, and on the other hand, to optimize the size of investments in security. A characteristic feature of risk management approaches from the point of view of the nuclear industry practice is that even such a deep approach to the study of the safety issue could not completely exclude major nuclear accidents. So, since the publication of the WASH -1400 report [18], released in 1975 shortly before the accident at the Three Mile Island nuclear power plant, none of the major accidents (Three Mile Island, Chernobyl, Fukushima) has exactly followed a prepredicted scenario. The largest accidents were caused by a combination of unforeseen events.
Given the fact that risk management based on the identification and analysis of risks cannot completely exclude the occurrence of unforeseen events, and their frequency has been objectively increasing in recent years, the resilience approach, which consists in organizing the company's actions in the event of unforeseen events, is the missing link in the risk management activity. J. Park et al. [12] cite the article by Marais et al.: "It is not necessary to predict all potential causes of a ship sinking in order to provide life boats and other emergency measures". In the same paper, the authors [12] provide a comparative table of risk management and resilience approaches. In addition to the differences in goals already mentioned above, there are differences in design strategies, analysis models, and attitudes to sustainable development. There is a significant difference in the mechanism for coordinating response measures: while risk management methods provide for centralized execution of emergency response plans, resilience methods provide more "bottom-up" initiative depending on the specific situation.
To explain the differences between the scope of classical risk management and resilience, we provide a graphical explanation in Fig. 1. At time T1, classical risk management methods can be used to extrapolate current knowledge of possible risk (direct V1 = f1(T1)). However, due to the inertia of human thinking and the methods used, there has recently been a gap between the rate of increase of vulnerability V=f(T) from the area of assessed risks (the area under the line V1 = f1(T1), highlighted in Fig. 1.). Therefore, at time T2, there remains a risk area that is not covered by risk management activities. It is precisely to close this gap that the company's resilience is being developed. And the higher the growth dynamics of risk exposure is, the higher the significance of activities for the development of resilience.
Working to improve the resilience of companies shifts the focus of risk management to strategic risks and strategic assets. This is due to the fact that in the process of responding to a stressful event, resilience does not exclude modifications of the main process, the loss of individual components of the system, and other changes. In the work [19], this approach is called "hard resilience", in contrast to "soft resilience", which assumes full restoration of the system's functionality after a failure.
Thus, the concept of resilience can be considered as an element of risk management activities with due consideration of the identified differences and the development of boundary conditions. With high dynamics of changes in the quality and level of risks, such activities can significantly compensate for the inertia of traditional risk management approaches.
As with any other investment decision, companies need a tool to analyze possible alternatives and choose the best solution to improve their resilience. However, investments in risk management measures and resilience have a number of significant differences from commercial investment projects. The main difference is that the assessment of the effect of such activities is based on probabilistic estimates of events that are not fully understood. This can cause difficulties in making a priori decisions. For any organization, making a wrong decision about the level of resilience in an uncertain environment can lead to the following adverse consequences [20]:
• "insufficient countermeasures can lead to incidents with significant losses; • over-investment in security can reduce the organization's performance."
To reduce uncertainty and maximize consideration of all factors associated with increased resilience, we perform a cost-effectiveness analysis at four levels (fig. 2).
This approach will allow to identify the most effective measures at each level, from which the most relevant for the organization could be selected.
At the first level of analysis, we will highlight the measures that are most effective in reducing losses after incidents. As known, it is better to prevent a fire than to extinguish it. And the effective cost of resilience has a rule of leverage -relatively small costs at the preparatory stage give a huge effect in the case of risk realization. For example, an analysis of many projects aimed at reducing the risk of natural disasters has shown that the vast majority of them were profitable in terms of a posteriori cost-benefit analysis [21].
In the general case, the cost effectiveness of the resilience Еres could be determined by the ratio of areas ΔSloss/Sres (Fig. 3).
where ΔSloss -reduction in incident response costs; Srescosts for improving resilience.
At the second level, we will consider the impact of costs of resilience as part of the risk management activities. To do this, we use the total cost of risk (TCR) indicator, which takes into account the entire amount of possible costs associated with risks. This indicator is often used to optimize risk management and insurance measures. The total cost of the TCR risk is determined by the sum of the following components:
where Cret -capital reserve for self coverage of expected and unforeseen losses; Cins -insurance premium; Crm -noninsurance costs.
Non-insurance costs will consist of two components: risk reduction costs (Crisk) and resilience costs (Cres): Crm= Crisk+ Cres, then ) (
To minimize the total cost of risk, we select such types of investments in resilience Cres that will minimize the amount of the contingency reserve for Cret, which will also have a positive impact on the size insurance premium Cins, and can also theoretically reduce the estimate of the expected loss. Taking into account the identified correlations between the total cost of risk and resilience, as well as working to strengthen the positive relationships between TCR components, can lead to a very noticeable synergistic effect. One of the successful examples of such joint activities is the extinguishing of the fire in the Notre-Dame Cathedral on April 15, 2019. Thanks to emergency response plans developed jointly with insurance companies and coordinated with firefighters, it was possible to save most of the relics and art objects stored in the Cathedral [22].
At the same level, the entire risk management process is coordinated to determine the resilience project's scope in terms of boundary values. In this sense, it is useful to use experience from high-risk industries that have accumulated some experience of planning activities in conditions of uncertainty. Thus, the International Commission on Radiation Protection (ICRP) introduces the following principles of radiation protection [23]:
• the principle of justification; • the principle of optimizing protection; • the principle of using dose limits. In this approach, the ALARA (as low as reasonably achievable) principle of protection optimization is applied exclusively in the area of compliance with the required levels of collective and individual risk (dose limits), and only for activities whose estimated benefit significantly exceeds the possible harm (justification principle). If the organization has and is fulfilling certain security requirements (for example, industrial or information security), then it is necessary to use the amount of work that has already been done, thereby minimizing the cost of increasing the level of resilience.
In addition to the limits of the optimization area, other possible strategies must be considered [24] since minimizing the total cost of risk is not always the best option. While minimizing the total cost of risk, today's real costs are added to the hypothetical losses of tomorrow. At the same time, the optimal solution has a strong dependence on the quality of risk assessments. The cost criterion may not always be dominant when making decisions. For example, for enterprises with critical infrastructure, the main criterion may be the duration of the predicted business interruption. Taking into account all possible restrictions and alternatives will allow you to make the most informed decision about the possibilities of reducing the risk.
At the third level, we will consider applying the costbenefit analysis to the entire organization. At the same time, both the scope of the problem and the number of stakeholders increase significantly. Therefore, before performing such an analysis, it is recommended to determine [25,26]: the goals of the analysis, the time interval, the discount rate, the stakeholders, and the required amount of information.
Careful analysis of the source data for the calculation is important for two reasons. On the one hand, the calculation of indicators, such as the benefit/cost ratio or NPV (Net Present Value), is one of the reference points for making a decision. On the other hand, financial estimates cannot be the only decision-making tool due to the inaccuracy of the initial data. Therefore, all structured information about existing alternatives, assumptions, and limitations is essential for making a decision.
For example, when evaluating the key parameter of the analysis -the discount rate, you need to find a balance between the desire to get returns as quickly as possible (high rate) and take into account as many potential stressors as possible, sometimes with a long horizon of manifestation (low rate).
For public companies, it is important to take into account the views of shareholders. As the practice of large losses shows, the success of the company in the process of responding to an incident affects the share price. In the case of unsuccessful measures, the yield of shares falls, and, conversely, shows an excess of the estimated yield in case of successful countermeasures.
The fourth level of analysis involves considering the possibilities of interaction between different organizations in the event of incidents. Such an association is possible on a territorial or professional basis. This can be a unified response system, the creation of a mutual insurance company, and so on. The development of joint pre-agreed responses by various organizations can significantly improve the effectiveness of investments in their resilience.
This multi-level approach to optimizing the organizational resilience costs will help to determine the required level of coverage and identify solutions that best meet the organization's needs at the lowest cost.
The analysis of theoretical approaches to the concept of resilience allowed us to determine the place of activities to improve the organizational resilience as a component of risk management. This positioning of resilience allows to combine this activity with existing risk management processes in the organization.
The proposed multi-level approach to optimizing the cost of resilience reduces the level of uncertainty in making decisions based on risk assessments by taking into account factors and limitations as much as possible.
The study was supported by the RFBR, grant № 19-07-00455