=Paper=
{{Paper
|id=Vol-2763/CPT2020_paper_s3-5
|storemode=property
|title=Organizational resilience. Cost optimization approaches
|pdfUrl=https://ceur-ws.org/Vol-2763/CPT2020_paper_s3-5.pdf
|volume=Vol-2763
|authors=Larisa Sachenko
}}
==Organizational resilience. Cost optimization approaches==
https://ceur-ws.org/Vol-2763/CPT2020_paper_s3-5.pdf
Organizational resilience. Cost optimization approaches
L.A. Sachenko
sachenko@risk-profile.ru
Risk-profile LLC
The article considers the possibility of applying the theoretical concept of resilience to the optimization of activities to improve the
resilience of organizations. For this purpose, various approaches to the concept of resilience and its practical implementation are
analyzed. The generalizing point for these approaches is the understanding of resilience as the degree of readiness to respond adequately
to unforeseen events and circumstances. Thus for organizations, resilience is cognate to risk management. In order to optimize costs,
the analysis of the relation between these types of activities was carried out. Based on the definition of resilience as a component of risk
management, a multi-level approach to optimizing the cost of improving the resilience of organizations is proposed. In this approach,
the most effective measures to improve resilience are selected end-to-end, while increasing the scope of the task consistently: from the
level of specific activities to the analysis of interactions between organizations. This reduces the impact of uncertainty on risk-based
decisions by maximizing consideration of factors and boundary conditions.
Keywords: organizational resilience, risk management, cost-benefit analysis.
1. Introduction social issues. Despite the wide cross-disciplinary scope of
use, to date it has not developed a common understanding
Recent examples of natural, man-made, and of the term [1]. However, by now it is possible to
humanitarian disasters have revealed a lack of readiness of distinguish the main approaches that can be used as a basis
companies to deal with unforeseen threats of a serious scale. for working on the resilience of organizations.
"Black swans", that is, catastrophic events difficult to The Latin word “resilio", passed into English as
predict, from a rare phenomenon passed into the category “resilience” in the sense of “bounce back, go back”. It is
of quite probable. In such circumstances, traditional risk in this sense that resilience is understood in the first
management methods focused on a thorough threat analysis approach – the ability of the system to return to its original
and based on the extrapolation of retrospective assessments position after being out of balance. At the same time,
and expert assessments representing a generation of a more resilient species overcome adverse external influences at
stable period will no longer work. This does not allow the expense of internal resources [3]. This static approach
companies to develop adequate responses to sudden shocks, to resilience is used in ISO 22313 [4].
which often leads to significant losses. The second approach understands resilience as the
To solve this problem, organizations must develop the ability of a system to adapt to stressful events without
ability to withstand an emergency and recover from a necessarily returning to its original state. The main
failure. This is the goal of the concept of resilience, which disadvantage of such adaptability in socio-ecological
has recently become one of the most frequently used in systems, as noted by A. Hornborg [5], is the fact that post-
various disciplines when considering sustainable stress equilibrium is likely to assume the oppression of the
development issues. natural system, since the significance of social systems for
The main purpose of the work is to study the decision-makers is higher.
possibility of applying the theoretical concept of resilience D. Chandler [3] proposed the third, so-called dynamic
to optimize the activities aimed to improve the resilience approach. It defines resilience as "an emerging and
of organizations. The first section provides the basic adaptive process of subject-object relationships". Chandler
concept of organizational resilience. In the second section, explains "the subject does not survive solely because of its
resilience is considered in the context of risk management internal resources, but survives and thrives because of its
activities. In the third paragraph, a multi-level approach to ability to adapt or interact dynamically with the socio-
optimizing the cost of improving the viability of ecological environment."
organizations is proposed. The definition of resilience, which summarizes all
2. Organizational resilience these approaches, is used in the UN Strategy for disaster
risk reduction [6]: “The ability of a system, community or
The term resilience or stress resistance in Russian society exposed to hazards to resist, absorb, accommodate
translation was used by scientists, starting with Seneca and to and recover from the effects of a hazard in a timely and
Cicero, then Bacon and others in the middle ages, efficient manner, including through the preservation and
gradually becoming more universal and relevant over time restoration of its essential basic structures and functions”.
[1]. In the modern context, the use of the term in relation One of the important areas of research on resilience is
to ecosystems was initiated by the work of Halling [2], organizational resilience. Here, as in the mainstream of
who defined resilience as the ability of an ecosystem to research, there is a high degree of activity of researchers
independently maintain and restore the level of basic with many different approaches to the subject. M.
relationships in it by absorbing shocks and fluctuations in Linnenluetske [7] traces the development of the concept of
the parameters of external or internal influence. In the last "organizational resilience" from the ability to resist
decade, the concept of resilience has played an external influences in the 1980s, the understanding of
increasingly important role in the development of political resilience as reliability in the 1990s, to strategies for
solutions, in addressing environmental, technical and
Copyright © 2020 for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY
4.0)
working with staff, the adaptability of business models and The following characteristics are proposed for assessing
the stability of supply chains in the 2010s. the seismic stability of systems: robustness, redundancy
L. Hiao, and H. Cao [8] note that the fundamental and diversification, entrepreneurship, and efficiency.
difference between organizational resilience and These characteristics are quite universal relative to the
adaptability, flexibility, reliability, etc. is that the application area.
resilience of the organization is understood not only as the J. Park et al. [12] consider resilience as a cyclical or, as
ability of the organization to respond, but also to develop they write, recursive process, in which it is important to
in a state of uncertainty, interruptions and emergencies. In pass the following main stages of information processing
addition, the same researchers suggest a multi-level and development of adaptation measures: sensing,
approach to considering the sustainability of the anticipation, adaptation, learning.
organization from the individual level (personnel), to the I. Linkov et al. [13] identify and apply [14] four jointly
level of divisions and the entire organization, and also note exhaustive components of any complex system: physical,
the importance of transit relations between these levels. informational, cognitive, and social.
A large number of studies have been devoted to the As a result of their combination with the process of
development of indicators for determining the level of resilience, the authors obtained [13] the so-called
resilience of companies [9, 10]. M. Bruno et al. [11] define resilience matrix, which takes into account the quality of
four aspects of resilience that are of interest for seismic each of the selected vital components of the system for
events: technical, organizational, social and economic. each of the processes of ensuring resilience (Table 1) [13].
Table 1. Example of the resilience matrix
Prepare Absorb Recover Adapt
Physical
Informational
Cognitive
Social
The use of the matrix does not imply the use of certain targets can be changed in accordance with changed
quantitative estimates, but allows you to get a circumstances.
comprehensive view of the system's readiness for shocks The risk management process, as presented in the most
and to identify weaknesses that require priority study. popular ISO 31000(2018) [17] standard, is represented by
The work [15] proposes a methodology for quantifying a cycle of the following stages: scope and criteria - risk
the system's resilience based on the concept of critical assessment - risk treatment - monitoring and control –
functionality, which is the minimum necessary set of documentation. As risk management has moved into the
functions during a crisis. management area from the technical one, which was used
Companies that are active users of natural resources for the risk analysis of dangerous objects, it has adopted
can use approaches to assess so-called "sustainable the characteristics of probabilistic safety analysis of
resilience" [16]. technical objects. This approach is used most extensively
Thus, at the moment, there are a number of approaches in the nuclear power industry, due to the severity of the
to assessing the current level of resilience of an consequences. It allows to assess the possible size of
organization, from which you can choose the most nuclear damage, taking into account the probabilities, and
appropriate to the context of the organization's activities to organize the safety management of a nuclear facility by
and the required accuracy of analysis. Based on the results developing recommendations for improving safety
obtained from such assessment, it is possible to plan (reducing risk) based on the results of risk assessments.
further steps to improve the level of preparedness of Conducting such an analysis allows, on the one hand, to
organizations to respond to unexpected stressors. ensure a given level of security of nuclear facilities, and on
the other hand, to optimize the size of investments in
3. Resilience and risk management security. A characteristic feature of risk management
When implementing the concept of resilience in approaches from the point of view of the nuclear industry
companies, it is necessary to understand that this activity practice is that even such a deep approach to the study of
does not replace the need for existing risk management the safety issue could not completely exclude major
practices. Resilience can be either an independent line of nuclear accidents. So, since the publication of the WASH
work or a complementary function in relation to risk -1400 report [18], released in 1975 shortly before the
management. To successfully combine these practices, it accident at the Three Mile Island nuclear power plant,
is necessary to clearly understand the difference between none of the major accidents (Three Mile Island,
their main goals and methods. Chernobyl, Fukushima) has exactly followed a pre-
The main difference between the two approaches is predicted scenario. The largest accidents were caused by a
that risk management is aimed at identifying and combination of unforeseen events.
neutralizing risks that can cause unacceptable deviations Given the fact that risk management based on the
of the company's indicators from the planned ones. At the identification and analysis of risks cannot completely
same time, resilience is designed to respond to unknown exclude the occurrence of unforeseen events, and their
threats, and in the process of responding, the original frequency has been objectively increasing in recent years,
the resilience approach, which consists in organizing the
company's actions in the event of unforeseen events, is the To explain the differences between the scope of
missing link in the risk management activity. J. Park et al. classical risk management and resilience, we provide a
[12] cite the article by Marais et al.: “It is not necessary to graphical explanation in Fig.1. At time T1, classical risk
predict all potential causes of a ship sinking in order to management methods can be used to extrapolate current
provide life boats and other emergency measures“. In the knowledge of possible risk (direct V1 = f1(T1)). However,
same paper, the authors [12] provide a comparative table due to the inertia of human thinking and the methods used,
of risk management and resilience approaches. In addition there has recently been a gap between the rate of increase
to the differences in goals already mentioned above, there of vulnerability V=f(T) from the area of assessed risks (the
are differences in design strategies, analysis models, and area under the line V1 = f1(T1), highlighted in Fig.1.).
attitudes to sustainable development. There is a significant Therefore, at time T2, there remains a risk area that is not
difference in the mechanism for coordinating response covered by risk management activities. It is precisely to
measures: while risk management methods provide for close this gap that the company's resilience is being
centralized execution of emergency response plans, developed. And the higher the growth dynamics of risk
resilience methods provide more "bottom-up" initiative exposure is, the higher the significance of activities for the
depending on the specific situation. development of resilience.
Fig. 1. Differentiation of areas of application of classical methods of risk management and resilience
Working to improve the resilience of companies shifts need a tool to analyze possible alternatives and choose the
the focus of risk management to strategic risks and best solution to improve their resilience. However,
strategic assets. This is due to the fact that in the process investments in risk management measures and resilience
of responding to a stressful event, resilience does not have a number of significant differences from commercial
exclude modifications of the main process, the loss of investment projects. The main difference is that the
individual components of the system, and other changes. assessment of the effect of such activities is based on
In the work [19], this approach is called "hard resilience", probabilistic estimates of events that are not fully
in contrast to "soft resilience", which assumes full understood. This can cause difficulties in making a priori
restoration of the system's functionality after a failure. decisions. For any organization, making a wrong decision
Thus, the concept of resilience can be considered as an about the level of resilience in an uncertain environment
element of risk management activities with due can lead to the following adverse consequences [20]:
consideration of the identified differences and the • "insufficient countermeasures can lead to incidents
development of boundary conditions. With high dynamics with significant losses;
of changes in the quality and level of risks, such activities • over-investment in security can reduce the
can significantly compensate for the inertia of traditional organization's performance."
risk management approaches. To reduce uncertainty and maximize consideration of
all factors associated with increased resilience, we perform
4. Optimizing the cost of resilience a cost-effectiveness analysis at four levels (fig. 2).
As with any other investment decision, companies
Fig. 2. Multi-level cost-benefit analysis of resilience
This approach will allow to identify the most effective the risk of natural disasters has shown that the vast
measures at each level, from which the most relevant for majority of them were profitable in terms of a posteriori
the organization could be selected. cost-benefit analysis [21].
At the first level of analysis, we will highlight the In the general case, the cost effectiveness of the
measures that are most effective in reducing losses after resilience Еres could be determined by the ratio of areas
incidents. As known, it is better to prevent a fire than to ΔSloss/Sres (Fig. 3).
extinguish it. And the effective cost of resilience has a rule
of leverage – relatively small costs at the preparatory stage
where ΔSloss - reduction in incident response costs; Sres –
give a huge effect in the case of risk realization. For
costs for improving resilience.
example, an analysis of many projects aimed at reducing
Fig. 3. Intertemporal distribution of expenses for preparation and response to the incident
At the second level, we will consider the impact of companies and coordinated with firefighters, it was
costs of resilience as part of the risk management possible to save most of the relics and art objects stored in
activities. To do this, we use the total cost of risk (TCR) the Cathedral [22].
indicator, which takes into account the entire amount of At the same level, the entire risk management process
possible costs associated with risks. This indicator is often is coordinated to determine the resilience project's scope
used to optimize risk management and insurance in terms of boundary values. In this sense, it is useful to
measures. The total cost of the TCR risk is determined by use experience from high-risk industries that have
the sum of the following components: accumulated some experience of planning activities in
TCR = Cret + Cins + Crm → min conditions of uncertainty. Thus, the International
where Cret - capital reserve for self coverage of expected Commission on Radiation Protection (ICRP) introduces
and unforeseen losses; Cins –insurance premium; Crm - non- the following principles of radiation protection [23]:
insurance costs. • the principle of justification;
Non-insurance costs will consist of two components: • the principle of optimizing protection;
risk reduction costs (Crisk) and resilience costs (Cres): Crm= • the principle of using dose limits.
Crisk+ Cres, then In this approach, the ALARA (as low as reasonably
TCR = Cret + Cins + (Crisk + Cres ) . achievable) principle of protection optimization is applied
exclusively in the area of compliance with the required
To minimize the total cost of risk, we select such types levels of collective and individual risk (dose limits), and
of investments in resilience Cres that will minimize the only for activities whose estimated benefit significantly
amount of the contingency reserve for Cret, which will also exceeds the possible harm (justification principle). If the
have a positive impact on the size insurance premium Cins, organization has and is fulfilling certain security
and can also theoretically reduce the estimate of the requirements (for example, industrial or information
expected loss. Taking into account the identified security), then it is necessary to use the amount of work
correlations between the total cost of risk and resilience, that has already been done, thereby minimizing the cost of
as well as working to strengthen the positive relationships increasing the level of resilience.
between TCR components, can lead to a very noticeable In addition to the limits of the optimization area, other
synergistic effect. One of the successful examples of such possible strategies must be considered [24] since
joint activities is the extinguishing of the fire in the Notre- minimizing the total cost of risk is not always the best
Dame Cathedral on April 15, 2019. Thanks to emergency option. While minimizing the total cost of risk, today's real
response plans developed jointly with insurance costs are added to the hypothetical losses of tomorrow. At
the same time, the optimal solution has a strong The proposed multi-level approach to optimizing the
dependence on the quality of risk assessments. The cost cost of resilience reduces the level of uncertainty in
criterion may not always be dominant when making making decisions based on risk assessments by taking into
decisions. For example, for enterprises with critical account factors and limitations as much as possible.
infrastructure, the main criterion may be the duration of
the predicted business interruption. Taking into account all Acknowledgments
possible restrictions and alternatives will allow you to The study was supported by the RFBR, grant № 19-07-
make the most informed decision about the possibilities of 00455
reducing the risk.
At the third level, we will consider applying the cost- References
benefit analysis to the entire organization. At the same
time, both the scope of the problem and the number of [1] Alexander D.E. Resilience and disaster risk reduction:
stakeholders increase significantly. Therefore, before an etymological journey. Nat. Hazards Earth Syst.
performing such an analysis, it is recommended to Sci. 2013 г., Т. 13.
determine [25, 26]: the goals of the analysis, the time [2] Holling C.S. Resilience and stability of ecological
interval, the discount rate, the stakeholders, and the systems. Ann.Rev. Ecol. Syst. 1973 г., Т. 4.
required amount of information. [3] Chandler D. Resilience: The governance of
Careful analysis of the source data for the calculation complexity. N.Y: Routledge., 2014.
is important for two reasons. On the one hand, the [4] ISO 22313:2020 Security and resilience - Business
calculation of financial indicators, such as the benefit/cost continuity management systems - Guidance on the use
ratio or NPV (Net Present Value), is one of the reference of ISO 22301.
points for making a decision. On the other hand, financial [5] Hornborg A. Zero-sum world: challenges in
estimates cannot be the only decision-making tool due to conceptualizing environmental load displacement and
the inaccuracy of the initial data. Therefore, all structured ecologically unequal exchange in the world-System.
information about existing alternatives, assumptions, and Int. J. Comp. Sociol. 2009 г., 50.
limitations is essential for making a decision. [6] UNISDR. Terminology on Disaster Risk Reduction.
For example, when evaluating the key parameter of the United Nations. United Nations International Strategy
analysis - the discount rate, you need to find a balance for Disaster Risk Reduction. Geneva.: б.н., 2009.
between the desire to get returns as quickly as possible [7] Linnenluecke M.K. Resilience in business and
(high rate) and take into account as many potential management research: A review of influential
stressors as possible, sometimes with a long horizon of publications and a research agenda. International
manifestation (low rate). Journal of Management Reviews. 2017 г., Т. 19.1.
For public companies, it is important to take into [8] XIAO L., CAO H. Organizational Resilience: The
account the views of shareholders. As the practice of large Theoretical Model and Research Implication. ITM
losses shows, the success of the company in the process of Web of Conferences. 2017 г.
responding to an incident affects the share price. In the [9] Rose A., Krausmann E. An economic framework for
case of unsuccessful measures, the yield of shares falls, the development of a resilience index for business
and, conversely, shows an excess of the estimated yield in recovery. International Journal of Disaster Risk
case of successful countermeasures. Reduction. Elsevier., 2013 г., Т. 5.
The fourth level of analysis involves considering the [10] Lengnick-Hall C. A., Beck T. E., & Lengnick-Hall.
possibilities of interaction between different organizations Developing a capacity for organizational resilience
in the event of incidents. Such an association is possible through strategic human resource management.
on a territorial or professional basis. This can be a unified Human Resource Management Review. 2011 г., Т.
response system, the creation of a mutual insurance 21, 3.
company, and so on. The development of joint pre-agreed [11] Bruneau M., Chang S.E. et. al. A Framework to
responses by various organizations can significantly Quantitatively Assess and Enhance the Seismic
improve the effectiveness of investments in their Resilience of Communities. Earthquake Spectra.
resilience. Earthquake Engineering Research Institute., 2003 г.,
This multi-level approach to optimizing the Т. 19.
organizational resilience costs will help to determine the [12] Park J., Seager T., et. al. Integrating Risk and
required level of coverage and identify solutions that best Resilience Approaches to Catastrophe Management
meet the organization's needs at the lowest cost. in Engineering Systems. Risk Analysis. 2013 г., Т. 33.
[13] Linkov I., Trump B.D., Hynes W. Resilience-based
5. Conclusions Strategies and Policies to Address Systemic Risks.
SG/NAEC. Organisation for Economic Co-operation
The analysis of theoretical approaches to the concept and Development., 2019 г., Т. 5.
of resilience allowed us to determine the place of activities [14] Eisenberg D.A., Linkov I., Park J., Bates M.E., Fox-
to improve the organizational resilience as a component of Lent C., Seager T.P. Resilience Metrics: Lessons from
risk management. This positioning of resilience allows to Military Doctrines. Solutions for a sustainable and
combine this activity with existing risk management desirable future. 2014 г., Т. 5, 5.
processes in the organization. [15] Ganin A.A., Massaro E., Gutfraind A., Steen N.,
Keisler J.M., Kott A., Mangoubi R., Linkov I.
Operational resilience: concepts, design and analysis.
Scientific reports. 2016 г., PMC4726063.
[16] Gillespie-Marthaler, L., Nelson K., Baroud H.,
Abkowitz M. Selecting Indicators for Assessing
Community Sustainable Resilience. Risk Analysis.
2019 г., Т. 39, 11.
[17] ISO 31000:2018 (E). Second edition. Risk
management - Guidelines.
[18] NUREG-75/014. WASH-1400 The Reactor Safety
Study. The Introduction of Risk Assessment to the
Regulation of Nuclear Reactors. Manuscript
Completed: August 2016 Date Published: August
2016. Prepared by: Reynold Bartel. 60 p.
[19] Proag V. The concept of vulnerability and resilience.
ScienceDirect. Elsevier., 2014 г., Т. 18.
[20] Białas A. Cost-benefits aspects in risk-management.
Polish Journal of Management Studies. 2016, Т.13, 1.
[21] Hugenbusch D., Neumann T. Cost-Benefit analysis of
disaster risk reduction. Executive Summary. б.м. :
Aktion Deutschland Hilft e.V., 2016.
[22] https://www.insurancebusinessmag.com/uk/news/bre
aking-news/revealed-civil-liability-insurer-of-two-
notredame-de-paris-contractors-165074.aspx
[23] ICRP, 2007. The 2007 Recommendations of the
International Commission on Radiological Protection.
ICRP Publication 103. Ann. ICRP 37 [2-4].
[24] Sachenko L., Amelina M. Corporate insured
strategies. Moscow: Ankil, 2015, 179 p.
[25] Proag S.-L., Proag V. The cost benefit analysis of
providing resilience. Procedia Economics and
Finance. 2014 г., Т. 18.
[26] Mechler R. and. The Risk to Resilience Study Team.
The Cost-Benefit Analysis Methodology, From Risk
to Resilience Working Paper No. 1. Kathmandu,
Nepal: eds. Moench, M., Caspari, E. & A. Pokhrel,
ISET, ISET-Nepal and ProVention., 2008.
About the author
Sachenko Larisa A., PhD., CEO Risk-profile LLC. E-mail
sachenko@risk-profile.ru