Organizational resilience. Cost optimization approaches L.A. Sachenko sachenko@risk-profile.ru Risk-profile LLC The article considers the possibility of applying the theoretical concept of resilience to the optimization of activities to improve the resilience of organizations. For this purpose, various approaches to the concept of resilience and its practical implementation are analyzed. The generalizing point for these approaches is the understanding of resilience as the degree of readiness to respond adequately to unforeseen events and circumstances. Thus for organizations, resilience is cognate to risk management. In order to optimize costs, the analysis of the relation between these types of activities was carried out. Based on the definition of resilience as a component of risk management, a multi-level approach to optimizing the cost of improving the resilience of organizations is proposed. In this approach, the most effective measures to improve resilience are selected end-to-end, while increasing the scope of the task consistently: from the level of specific activities to the analysis of interactions between organizations. This reduces the impact of uncertainty on risk-based decisions by maximizing consideration of factors and boundary conditions. Keywords: organizational resilience, risk management, cost-benefit analysis. 1. Introduction social issues. Despite the wide cross-disciplinary scope of use, to date it has not developed a common understanding Recent examples of natural, man-made, and of the term [1]. However, by now it is possible to humanitarian disasters have revealed a lack of readiness of distinguish the main approaches that can be used as a basis companies to deal with unforeseen threats of a serious scale. for working on the resilience of organizations. "Black swans", that is, catastrophic events difficult to The Latin word “resilio", passed into English as predict, from a rare phenomenon passed into the category “resilience” in the sense of “bounce back, go back”. It is of quite probable. In such circumstances, traditional risk in this sense that resilience is understood in the first management methods focused on a thorough threat analysis approach – the ability of the system to return to its original and based on the extrapolation of retrospective assessments position after being out of balance. At the same time, and expert assessments representing a generation of a more resilient species overcome adverse external influences at stable period will no longer work. This does not allow the expense of internal resources [3]. This static approach companies to develop adequate responses to sudden shocks, to resilience is used in ISO 22313 [4]. which often leads to significant losses. The second approach understands resilience as the To solve this problem, organizations must develop the ability of a system to adapt to stressful events without ability to withstand an emergency and recover from a necessarily returning to its original state. The main failure. This is the goal of the concept of resilience, which disadvantage of such adaptability in socio-ecological has recently become one of the most frequently used in systems, as noted by A. Hornborg [5], is the fact that post- various disciplines when considering sustainable stress equilibrium is likely to assume the oppression of the development issues. natural system, since the significance of social systems for The main purpose of the work is to study the decision-makers is higher. possibility of applying the theoretical concept of resilience D. Chandler [3] proposed the third, so-called dynamic to optimize the activities aimed to improve the resilience approach. It defines resilience as "an emerging and of organizations. The first section provides the basic adaptive process of subject-object relationships". Chandler concept of organizational resilience. In the second section, explains "the subject does not survive solely because of its resilience is considered in the context of risk management internal resources, but survives and thrives because of its activities. In the third paragraph, a multi-level approach to ability to adapt or interact dynamically with the socio- optimizing the cost of improving the viability of ecological environment." organizations is proposed. The definition of resilience, which summarizes all 2. Organizational resilience these approaches, is used in the UN Strategy for disaster risk reduction [6]: “The ability of a system, community or The term resilience or stress resistance in Russian society exposed to hazards to resist, absorb, accommodate translation was used by scientists, starting with Seneca and to and recover from the effects of a hazard in a timely and Cicero, then Bacon and others in the middle ages, efficient manner, including through the preservation and gradually becoming more universal and relevant over time restoration of its essential basic structures and functions”. [1]. In the modern context, the use of the term in relation One of the important areas of research on resilience is to ecosystems was initiated by the work of Halling [2], organizational resilience. Here, as in the mainstream of who defined resilience as the ability of an ecosystem to research, there is a high degree of activity of researchers independently maintain and restore the level of basic with many different approaches to the subject. M. relationships in it by absorbing shocks and fluctuations in Linnenluetske [7] traces the development of the concept of the parameters of external or internal influence. In the last "organizational resilience" from the ability to resist decade, the concept of resilience has played an external influences in the 1980s, the understanding of increasingly important role in the development of political resilience as reliability in the 1990s, to strategies for solutions, in addressing environmental, technical and Copyright © 2020 for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0) working with staff, the adaptability of business models and The following characteristics are proposed for assessing the stability of supply chains in the 2010s. the seismic stability of systems: robustness, redundancy L. Hiao, and H. Cao [8] note that the fundamental and diversification, entrepreneurship, and efficiency. difference between organizational resilience and These characteristics are quite universal relative to the adaptability, flexibility, reliability, etc. is that the application area. resilience of the organization is understood not only as the J. Park et al. [12] consider resilience as a cyclical or, as ability of the organization to respond, but also to develop they write, recursive process, in which it is important to in a state of uncertainty, interruptions and emergencies. In pass the following main stages of information processing addition, the same researchers suggest a multi-level and development of adaptation measures: sensing, approach to considering the sustainability of the anticipation, adaptation, learning. organization from the individual level (personnel), to the I. Linkov et al. [13] identify and apply [14] four jointly level of divisions and the entire organization, and also note exhaustive components of any complex system: physical, the importance of transit relations between these levels. informational, cognitive, and social. A large number of studies have been devoted to the As a result of their combination with the process of development of indicators for determining the level of resilience, the authors obtained [13] the so-called resilience of companies [9, 10]. M. Bruno et al. [11] define resilience matrix, which takes into account the quality of four aspects of resilience that are of interest for seismic each of the selected vital components of the system for events: technical, organizational, social and economic. each of the processes of ensuring resilience (Table 1) [13]. Table 1. Example of the resilience matrix Prepare Absorb Recover Adapt Physical Informational Cognitive Social The use of the matrix does not imply the use of certain targets can be changed in accordance with changed quantitative estimates, but allows you to get a circumstances. comprehensive view of the system's readiness for shocks The risk management process, as presented in the most and to identify weaknesses that require priority study. popular ISO 31000(2018) [17] standard, is represented by The work [15] proposes a methodology for quantifying a cycle of the following stages: scope and criteria - risk the system's resilience based on the concept of critical assessment - risk treatment - monitoring and control – functionality, which is the minimum necessary set of documentation. As risk management has moved into the functions during a crisis. management area from the technical one, which was used Companies that are active users of natural resources for the risk analysis of dangerous objects, it has adopted can use approaches to assess so-called "sustainable the characteristics of probabilistic safety analysis of resilience" [16]. technical objects. This approach is used most extensively Thus, at the moment, there are a number of approaches in the nuclear power industry, due to the severity of the to assessing the current level of resilience of an consequences. It allows to assess the possible size of organization, from which you can choose the most nuclear damage, taking into account the probabilities, and appropriate to the context of the organization's activities to organize the safety management of a nuclear facility by and the required accuracy of analysis. Based on the results developing recommendations for improving safety obtained from such assessment, it is possible to plan (reducing risk) based on the results of risk assessments. further steps to improve the level of preparedness of Conducting such an analysis allows, on the one hand, to organizations to respond to unexpected stressors. ensure a given level of security of nuclear facilities, and on the other hand, to optimize the size of investments in 3. Resilience and risk management security. A characteristic feature of risk management When implementing the concept of resilience in approaches from the point of view of the nuclear industry companies, it is necessary to understand that this activity practice is that even such a deep approach to the study of does not replace the need for existing risk management the safety issue could not completely exclude major practices. Resilience can be either an independent line of nuclear accidents. So, since the publication of the WASH work or a complementary function in relation to risk -1400 report [18], released in 1975 shortly before the management. To successfully combine these practices, it accident at the Three Mile Island nuclear power plant, is necessary to clearly understand the difference between none of the major accidents (Three Mile Island, their main goals and methods. Chernobyl, Fukushima) has exactly followed a pre- The main difference between the two approaches is predicted scenario. The largest accidents were caused by a that risk management is aimed at identifying and combination of unforeseen events. neutralizing risks that can cause unacceptable deviations Given the fact that risk management based on the of the company's indicators from the planned ones. At the identification and analysis of risks cannot completely same time, resilience is designed to respond to unknown exclude the occurrence of unforeseen events, and their threats, and in the process of responding, the original frequency has been objectively increasing in recent years, the resilience approach, which consists in organizing the company's actions in the event of unforeseen events, is the To explain the differences between the scope of missing link in the risk management activity. J. Park et al. classical risk management and resilience, we provide a [12] cite the article by Marais et al.: “It is not necessary to graphical explanation in Fig.1. At time T1, classical risk predict all potential causes of a ship sinking in order to management methods can be used to extrapolate current provide life boats and other emergency measures“. In the knowledge of possible risk (direct V1 = f1(T1)). However, same paper, the authors [12] provide a comparative table due to the inertia of human thinking and the methods used, of risk management and resilience approaches. In addition there has recently been a gap between the rate of increase to the differences in goals already mentioned above, there of vulnerability V=f(T) from the area of assessed risks (the are differences in design strategies, analysis models, and area under the line V1 = f1(T1), highlighted in Fig.1.). attitudes to sustainable development. There is a significant Therefore, at time T2, there remains a risk area that is not difference in the mechanism for coordinating response covered by risk management activities. It is precisely to measures: while risk management methods provide for close this gap that the company's resilience is being centralized execution of emergency response plans, developed. And the higher the growth dynamics of risk resilience methods provide more "bottom-up" initiative exposure is, the higher the significance of activities for the depending on the specific situation. development of resilience. Fig. 1. Differentiation of areas of application of classical methods of risk management and resilience Working to improve the resilience of companies shifts need a tool to analyze possible alternatives and choose the the focus of risk management to strategic risks and best solution to improve their resilience. However, strategic assets. This is due to the fact that in the process investments in risk management measures and resilience of responding to a stressful event, resilience does not have a number of significant differences from commercial exclude modifications of the main process, the loss of investment projects. The main difference is that the individual components of the system, and other changes. assessment of the effect of such activities is based on In the work [19], this approach is called "hard resilience", probabilistic estimates of events that are not fully in contrast to "soft resilience", which assumes full understood. This can cause difficulties in making a priori restoration of the system's functionality after a failure. decisions. For any organization, making a wrong decision Thus, the concept of resilience can be considered as an about the level of resilience in an uncertain environment element of risk management activities with due can lead to the following adverse consequences [20]: consideration of the identified differences and the • "insufficient countermeasures can lead to incidents development of boundary conditions. With high dynamics with significant losses; of changes in the quality and level of risks, such activities • over-investment in security can reduce the can significantly compensate for the inertia of traditional organization's performance." risk management approaches. To reduce uncertainty and maximize consideration of all factors associated with increased resilience, we perform 4. Optimizing the cost of resilience a cost-effectiveness analysis at four levels (fig. 2). As with any other investment decision, companies Fig. 2. Multi-level cost-benefit analysis of resilience This approach will allow to identify the most effective the risk of natural disasters has shown that the vast measures at each level, from which the most relevant for majority of them were profitable in terms of a posteriori the organization could be selected. cost-benefit analysis [21]. At the first level of analysis, we will highlight the In the general case, the cost effectiveness of the measures that are most effective in reducing losses after resilience Еres could be determined by the ratio of areas incidents. As known, it is better to prevent a fire than to ΔSloss/Sres (Fig. 3). extinguish it. And the effective cost of resilience has a rule of leverage – relatively small costs at the preparatory stage where ΔSloss - reduction in incident response costs; Sres – give a huge effect in the case of risk realization. For costs for improving resilience. example, an analysis of many projects aimed at reducing Fig. 3. Intertemporal distribution of expenses for preparation and response to the incident At the second level, we will consider the impact of companies and coordinated with firefighters, it was costs of resilience as part of the risk management possible to save most of the relics and art objects stored in activities. To do this, we use the total cost of risk (TCR) the Cathedral [22]. indicator, which takes into account the entire amount of At the same level, the entire risk management process possible costs associated with risks. This indicator is often is coordinated to determine the resilience project's scope used to optimize risk management and insurance in terms of boundary values. In this sense, it is useful to measures. The total cost of the TCR risk is determined by use experience from high-risk industries that have the sum of the following components: accumulated some experience of planning activities in TCR = Cret + Cins + Crm → min conditions of uncertainty. Thus, the International where Cret - capital reserve for self coverage of expected Commission on Radiation Protection (ICRP) introduces and unforeseen losses; Cins –insurance premium; Crm - non- the following principles of radiation protection [23]: insurance costs. • the principle of justification; Non-insurance costs will consist of two components: • the principle of optimizing protection; risk reduction costs (Crisk) and resilience costs (Cres): Crm= • the principle of using dose limits. Crisk+ Cres, then In this approach, the ALARA (as low as reasonably TCR = Cret + Cins + (Crisk + Cres ) . achievable) principle of protection optimization is applied exclusively in the area of compliance with the required To minimize the total cost of risk, we select such types levels of collective and individual risk (dose limits), and of investments in resilience Cres that will minimize the only for activities whose estimated benefit significantly amount of the contingency reserve for Cret, which will also exceeds the possible harm (justification principle). If the have a positive impact on the size insurance premium Cins, organization has and is fulfilling certain security and can also theoretically reduce the estimate of the requirements (for example, industrial or information expected loss. Taking into account the identified security), then it is necessary to use the amount of work correlations between the total cost of risk and resilience, that has already been done, thereby minimizing the cost of as well as working to strengthen the positive relationships increasing the level of resilience. between TCR components, can lead to a very noticeable In addition to the limits of the optimization area, other synergistic effect. One of the successful examples of such possible strategies must be considered [24] since joint activities is the extinguishing of the fire in the Notre- minimizing the total cost of risk is not always the best Dame Cathedral on April 15, 2019. Thanks to emergency option. While minimizing the total cost of risk, today's real response plans developed jointly with insurance costs are added to the hypothetical losses of tomorrow. At the same time, the optimal solution has a strong The proposed multi-level approach to optimizing the dependence on the quality of risk assessments. The cost cost of resilience reduces the level of uncertainty in criterion may not always be dominant when making making decisions based on risk assessments by taking into decisions. For example, for enterprises with critical account factors and limitations as much as possible. infrastructure, the main criterion may be the duration of the predicted business interruption. Taking into account all Acknowledgments possible restrictions and alternatives will allow you to The study was supported by the RFBR, grant № 19-07- make the most informed decision about the possibilities of 00455 reducing the risk. At the third level, we will consider applying the cost- References benefit analysis to the entire organization. At the same time, both the scope of the problem and the number of [1] Alexander D.E. Resilience and disaster risk reduction: stakeholders increase significantly. Therefore, before an etymological journey. Nat. Hazards Earth Syst. performing such an analysis, it is recommended to Sci. 2013 г., Т. 13. determine [25, 26]: the goals of the analysis, the time [2] Holling C.S. Resilience and stability of ecological interval, the discount rate, the stakeholders, and the systems. Ann.Rev. Ecol. Syst. 1973 г., Т. 4. required amount of information. [3] Chandler D. Resilience: The governance of Careful analysis of the source data for the calculation complexity. N.Y: Routledge., 2014. is important for two reasons. On the one hand, the [4] ISO 22313:2020 Security and resilience - Business calculation of financial indicators, such as the benefit/cost continuity management systems - Guidance on the use ratio or NPV (Net Present Value), is one of the reference of ISO 22301. points for making a decision. On the other hand, financial [5] Hornborg A. Zero-sum world: challenges in estimates cannot be the only decision-making tool due to conceptualizing environmental load displacement and the inaccuracy of the initial data. Therefore, all structured ecologically unequal exchange in the world-System. information about existing alternatives, assumptions, and Int. J. Comp. Sociol. 2009 г., 50. limitations is essential for making a decision. [6] UNISDR. Terminology on Disaster Risk Reduction. For example, when evaluating the key parameter of the United Nations. United Nations International Strategy analysis - the discount rate, you need to find a balance for Disaster Risk Reduction. Geneva.: б.н., 2009. between the desire to get returns as quickly as possible [7] Linnenluecke M.K. Resilience in business and (high rate) and take into account as many potential management research: A review of influential stressors as possible, sometimes with a long horizon of publications and a research agenda. International manifestation (low rate). Journal of Management Reviews. 2017 г., Т. 19.1. For public companies, it is important to take into [8] XIAO L., CAO H. Organizational Resilience: The account the views of shareholders. As the practice of large Theoretical Model and Research Implication. ITM losses shows, the success of the company in the process of Web of Conferences. 2017 г. responding to an incident affects the share price. In the [9] Rose A., Krausmann E. An economic framework for case of unsuccessful measures, the yield of shares falls, the development of a resilience index for business and, conversely, shows an excess of the estimated yield in recovery. International Journal of Disaster Risk case of successful countermeasures. Reduction. Elsevier., 2013 г., Т. 5. The fourth level of analysis involves considering the [10] Lengnick-Hall C. A., Beck T. E., & Lengnick-Hall. possibilities of interaction between different organizations Developing a capacity for organizational resilience in the event of incidents. Such an association is possible through strategic human resource management. on a territorial or professional basis. This can be a unified Human Resource Management Review. 2011 г., Т. response system, the creation of a mutual insurance 21, 3. company, and so on. The development of joint pre-agreed [11] Bruneau M., Chang S.E. et. al. A Framework to responses by various organizations can significantly Quantitatively Assess and Enhance the Seismic improve the effectiveness of investments in their Resilience of Communities. Earthquake Spectra. resilience. Earthquake Engineering Research Institute., 2003 г., This multi-level approach to optimizing the Т. 19. organizational resilience costs will help to determine the [12] Park J., Seager T., et. al. Integrating Risk and required level of coverage and identify solutions that best Resilience Approaches to Catastrophe Management meet the organization's needs at the lowest cost. in Engineering Systems. Risk Analysis. 2013 г., Т. 33. [13] Linkov I., Trump B.D., Hynes W. Resilience-based 5. Conclusions Strategies and Policies to Address Systemic Risks. SG/NAEC. Organisation for Economic Co-operation The analysis of theoretical approaches to the concept and Development., 2019 г., Т. 5. of resilience allowed us to determine the place of activities [14] Eisenberg D.A., Linkov I., Park J., Bates M.E., Fox- to improve the organizational resilience as a component of Lent C., Seager T.P. Resilience Metrics: Lessons from risk management. This positioning of resilience allows to Military Doctrines. Solutions for a sustainable and combine this activity with existing risk management desirable future. 2014 г., Т. 5, 5. processes in the organization. [15] Ganin A.A., Massaro E., Gutfraind A., Steen N., Keisler J.M., Kott A., Mangoubi R., Linkov I. Operational resilience: concepts, design and analysis. Scientific reports. 2016 г., PMC4726063. [16] Gillespie-Marthaler, L., Nelson K., Baroud H., Abkowitz M. Selecting Indicators for Assessing Community Sustainable Resilience. Risk Analysis. 2019 г., Т. 39, 11. [17] ISO 31000:2018 (E). Second edition. Risk management - Guidelines. [18] NUREG-75/014. WASH-1400 The Reactor Safety Study. The Introduction of Risk Assessment to the Regulation of Nuclear Reactors. Manuscript Completed: August 2016 Date Published: August 2016. Prepared by: Reynold Bartel. 60 p. [19] Proag V. The concept of vulnerability and resilience. ScienceDirect. Elsevier., 2014 г., Т. 18. [20] Białas A. Cost-benefits aspects in risk-management. Polish Journal of Management Studies. 2016, Т.13, 1. [21] Hugenbusch D., Neumann T. Cost-Benefit analysis of disaster risk reduction. Executive Summary. б.м. : Aktion Deutschland Hilft e.V., 2016. [22] https://www.insurancebusinessmag.com/uk/news/bre aking-news/revealed-civil-liability-insurer-of-two- notredame-de-paris-contractors-165074.aspx [23] ICRP, 2007. The 2007 Recommendations of the International Commission on Radiological Protection. ICRP Publication 103. Ann. ICRP 37 [2-4]. [24] Sachenko L., Amelina M. Corporate insured strategies. Moscow: Ankil, 2015, 179 p. [25] Proag S.-L., Proag V. The cost benefit analysis of providing resilience. Procedia Economics and Finance. 2014 г., Т. 18. [26] Mechler R. and. The Risk to Resilience Study Team. The Cost-Benefit Analysis Methodology, From Risk to Resilience Working Paper No. 1. Kathmandu, Nepal: eds. Moench, M., Caspari, E. & A. Pokhrel, ISET, ISET-Nepal and ProVention., 2008. About the author Sachenko Larisa A., PhD., CEO Risk-profile LLC. E-mail sachenko@risk-profile.ru