Episode 72 - Resilience is good business

Emily Khan: Welcome to the latest episode of our Business in Focus podcast. I'm Emily Khan, and I'm your host for this episode. More and more over the past few years the conversation around resilience has moved to an integrated, proactive, and agile response that moves beyond the usual boundaries of the chief risk officer. We've seen a continuing need to adapt and respond to an environment that contains the type of large scale challenges both internal and external, that previously would have been a once in a generation issue. Not only to respond to risk, but to take it. Today, we'll be discussing what that looks like in practice, and the lessons others can take to their own organisations. I'm excited to be returning to a topic that's close to my heart, and especially so when joined by two such excellent guests. Today, I'm joined by Elaine Bucknor, former group chief information security officer, and group director of technology strategy at Sky, and currently a PwC strategic adviser covering cyber, technology, and enterprise resilience. Elaine, great to have you here.

Elaine Bucknor: Thank you, Emily, and thank you for the introduction. I'm really looking forward to the conversation.

Emily: To pick up on that interconnected role of resilience in the wider board agenda I'm also delighted to welcome Elisa Moscolin, executive vice president for sustainability at Sage, who can help us bring to life the wider opportunities of tackling resilience with a broader mindset. Elisa, so glad you could also join us.

Elisa Moscolin: Thank you very much for having me. I do think that sustainability and resilience are synonyms. So, really looking forward to the conversation.

Emily: Well, brilliant to have you both here. Let's dig right into it. It's a big topic. It's been a while since we've looked on this series at the resilience landscape, and I think it's fair to say that it continues to be quite a challenging time. You've both been contributing to some of the recent work we've been doing on resilience, rethink resilience. Maybe we should start with some of those big trends, and how boards are looking at those. Elisa, maybe I'll come to you first for a perspective on that if I may.

Elisa: Yes, of course. Well, look, we live at the time that's been defined as a permacrisis, or polycrisis. When you have to invent words to explain the context you're living in it's quite telling. I think that now more than ever it is important to think about resilience. It's interesting, before this podcast I was looking at the World Economic Forum Global Risk Report, and half of the topics that are listed as top risks pertains to climate change. They tend to rank on the very top for the next ten years. When I look at them more closely they're all somehow related to what I would call the ESG environmental, social, or governance type of issues. I think what that tells us is that we live in a world where we should expect disruptions to become the norm. I think that the only thing that is not going to change is change. So, being able to respond to this change effectively forebodes corporations to be deeply aware of this changing landscape as it is absolutely crucial for their long, but also I would argue, short-term success.

Emily: I definitely recognise that picture. Elaine, does that resonate with you?

Elaine: Yes, completely. I think, you know, boards have got a huge number of, kind of, things on their agenda, and it's going to be a tough few years in terms of trying to tackle all of them, whether it is, sort of, sustainability, all of the environmental challenges, resilience, cyber is still a huge factor on broader agendas. So, I guess one of the big things for me is how they're going to create the right culture and mindset within the organisation. When you think about, for example, businesses and organisations with a truly resilient culture, it, kind of, invariably means that they have things like a foundation of adaptability, you know, they have very strong and open communications. They have a culture of continuous learning, and supportive, kind of, leadership. They're better equipped to basically think about then the long game of issues such as sustainability. So, when the mindset is right, and having that resilience mindset, they can adapt, innovate, embrace change, build trust, and simply, sort of, maximise the value of everything that they do, and ultimately, kind of, create that more competitive advantage.

I'd also, sort of, add that statistics note that the longevity of businesses has without doubt reduced over the last twenty, thirty years. So, yes, there are absolutely, kind of, macro impactors such as, sort of, technology advancements, global competition. Disrupted businesses have created a more volatile and dynamic business environment, but resilience is without doubt an absolute contributor. So, having that right mindset will let businesses tackle those more foundational issues.

Emily: What really resonates with me from both of your answers there is that, you know, recognition that the world is changing fast, and maybe faster than ever before, we're coming up with new terms to even describe what that looks like. Responding to it is complex and multifaceted. There is no single silver bullet. Resilience means different things for different organisations. Also, at the heart of it lies opportunity. It's the pathway to success. It's not just about survival. It's about advantage, and achieving your strategy, and achieving your goals, which definitely, you know, is very reflective of the research that we've been doing involving conversations with lots of organisations, and indeed with the public, around rethinking resilience. I'm keen to get into the practicalities of that. So, what does that really look like? If we buy into the fact that this is something that needs attention, it's something that organisations need to look at differently, let's dig a little bit into how that actually plays out. What types of conversations are happening in the boardroom? What types of considerations are we exploring, decisions being made?

Perhaps, Elisa, let's go back to you. You referenced, kind of, resilience and sustainability being hand-in-hand. How does that conversation play out when we're taking actions with those two fronts in mind?

Elisa: Let me take an example, climate change provides us a very good platform for us to play with this. There are lots of uncertainties around the climate agenda, how we're going to achieve net zero. It is crucial that boards have open conversation, and challenges conversation, and challenges management to make sure that corporates are ready, are resilient to the disruptions that climate change will bring, but they are also responsive and contribute to the solution, not the problem. In order to achieve that, we need to be able to have those open conversations, and be comfortable with the uncomfortable. Boards, I believe, need to be much more comfortable with the uncertainty of the environment within which we live, and with the fact that perhaps management may not always have all the answers ready, and it may be also the role of the board to nudge them in the right direction to find the right answers. I think the climate agenda provides a very good example of that. It's an incredibly complex issue. Boards and executive things are grappling with it, as are governments. I don't think anyone has the single right answer, but it's about really collective thinking, and ability to think about our vulnerabilities, and what will make us truly resilient in the medium and long-term.

Emily: We've talked before, I recognise what you just played back there in terms of some of the conversations about Rethink Resilience, Elisa, about it being a system wide conversation as well. So, boards not only looking at their own organisation, but the role they play in it in a broader ecosystem. Is that also part of the conversation that you're talking about here, looking at vulnerabilities not in your own organisation, but in your broader supply chain, and the other organisations that you work with?

Elisa: Absolutely, and look, you cannot talk to someone in Sage without us bringing up small, medium businesses. I think this agenda is incredibly important for big and small organisations. When we discuss at a board level, or executive team about resilience, we always think about supply chains. Small medium businesses make up 90% of our global economy, and they are the backbones of our economies. So, if they're not resilient no one else is. The reality is if you look at any big corporate supply chain it's very likely the top twenty, fifty suppliers maximum, are going to be big corporate. The rest is a very long tail of small medium businesses who are at the heart of global supply chains, at the heart of functioning global corporate, and most importantly at the heart of each and every community where we operate. So, I think that it's very important that we take them along in this journey, and we make sure that we think resilience in the context of their own reality, and support them. A very good practical example of this is again climate change, right, and net zero. Everyone, every big corporate, has committed to net zero, so have governments. Now small medium businesses are feeling this trickle down effect of it. So, any time they apply for tender they get asked to provide information about their carbon footprint. This poses a big burden on them. So, how do we take them along in this journey? How do we make sure they come along, it's important that they transition as well at net zero, but without excluding them, for example, from a tender. It is so important the big corporates hold the hands of small medium businesses. We at Sage committed to net zero, but we could have said we, as a result of that, don't do business with anyone who doesn't commit, but that's unrealistic for small medium businesses. So, it's very important that we hold their hands, we engage in a conversation. One of the things we're doing is really also providing them the tools, the training, and supporting them on their own journey. I think this will make us as a corporate more resilient, it will make them more resilient, and it will make the whole ecosystem more resilient, so everybody wins. We will not succeed in isolation.

Emily: Yes, I can see how when you talk about how it filters down through the tenders that quickly becomes very burdensome for much smaller organisations without perhaps the organisational infrastructure that large corporates are working with around some of these challenges. Elaine, I'd like your perspective on that. You're clearly looking at resilience through, you know, broader technology angles. Does that resonate in that domain as well?

Elaine: Completely, but I was just, sort of, thinking about the board position in all of this. It's super important that boards help create that, kind of, understanding of that total business kind of environment. When you're having these, sort of, macro level conversations, and trying to work them into very actionable plans, it's really important that you have understanding of your entire ecosystem, and that boards and executive teams can work together to create some degree of priority and really to achieve all that needs to be achieved you'll need to weave a lot of those things together to really create that understanding, and to really derive those, sort of, priorities. Then to start really thinking about how you're going to build strength where you need it, or build, or solve problems, you know, on a sequence of how you do that. I was also, sort of, thinking about, you know, this whole ecosystem, and its many, many smaller businesses, the small and medium businesses that exist, all of which will make up a long tail of these giant corporates, or big organisations. With my, sort of, cyber hat on for a moment, you know, if I think back to some of the big cyber events over the last five, six years, things like the NotPetya, and WannaCry, that boards will have heard the names, maybe not fully understood the overarching consequences. Certainly, for many organisations they'll have seen the effect. Some of those issues started with very small organisations being impacted, and then the results were that those impacts, sort of, bled into the bigger organisations. So, you've got to remember that it is the entire ecosystem that you really need to consider when you're thinking about long-term sustainability and resilience of your organisation.

Emily: I feel like we could go on talking for hours about this, because we've talked about, you know, the need for resilience to be looked at differently. The complex, changing picture of risk. It being a system wide issue that you need to tackle within your own organisation and beyond. We try and wrap these conversations up with some, sort of, practical advice. So, perhaps we can just go there before we conclude today. If an organisation was starting to think about doing this differently where might they start the conversation? What's a real, kind of, practical tip that listeners today could take forward if they wanted to move this forward in their own organisation? Elisa, maybe I'll come to you first, if that's okay?

Elisa: Of course. Well, I think start with data, and with an integrated approach. I would argue you do need to involve as many stakeholders as possible within your business, but possibly also outside your business. There is a very helpful exercise called, 'Materiality Assessment,' that sustainability professionals do. It's very similar to a risk horizon scanning. My view is that we should start bringing those together as exercises. That would enable more systemic thinking, because as Elaine said, they are interconnected. We live in a very interconnected world. So, in order to truly make sure that you've got a good radar you need to make sure you look as far and as wide as you possibly can, and then prioritise. The other thing I would say is prevent. You know, it's less about avoiding bad things to happen, but knowing that you're going to be ready when they come, and you have a strong enough immune system to fight them back.

Emily: Thank you, excellent tips there. Elaine, would you build on those?

Elaine: Yes. I mean, I absolutely agree with data. You've got to, kind of, really create understanding. It's this, sort of, expression about relentless curiosity. That's not just within the confines of the business, or organisation. It's very much looking out, bringing in those external data points, really understanding the environment that that business is operating in. It's absolutely about, sort of, culture, and mindset. From a cyber perspective, we always used to talk about people being your human firewall, you know, that first, kind of, line of defence. So, as people start thinking about resilience, we need to think about how can you embed that into the culture, and embed that into the mindset of your people. To do that I think is just one of the most, kind of, important things that you've got to try and, kind of, get right, that continuous conversation and narrative. I'd say I'd also add that there is this thing about how do you take all of the things that a business has to, kind of, achieve, you know, from regulation to new global disrupting technology changes, you know, those things that you've got to take into account, to sustainability, climate, and all of the wrap around things that are associated with creating a healthy business. How do you weave them all together and create, kind of, common threads such that you can maximise the impact of everything that you do? One final point I would add is that this is all about creating opportunities. It's not just about managing risk, and deal with overwhelming amounts of change. It really is an opportunity as well to simplify your business, to drive innovation into the organisation, and to really ultimately maximise value not just for your individual firm or organisation, but also for the ecosystem within which you operate.

Emily: That feels like the perfect place to draw this to a close. Thank you both so much for those final recommendations, and for all of the insights that you've shared today. Thank you listeners for joining us. If this has wet your appetite to read a bit more about resilience, please do take a look at pwc.co.uk/rethinkrisk to see our full findings on Rethink Resilience, and, of course, please subscribe to keep up-to-date with all our latest episodes. Thanks, everyone. See you next time.

Participants

• Emily Khan
  
• Elaine Bucknor
• Elisa Moscolin