“Taking measured risk and being able to emerge from disruption faster than your competitors is critical to business success,” says Nicola McGowan, Director of Internal Audit and Risk at Travis Perkins. “Embedding a culture where people are your antennae and ensuring they have the tools and intelligence to analyse signals - including the weak ones - allows you to assess the potential impact of disruption early and identify where you need to take action now to build that resilience.”
Disruption isn’t new - the 1970s also saw strikes, spiralling inflation, political instability and an oil crisis. What's changed now is the greater impact of disruption due to the domino effect of our interconnected digital economy. Complex dependencies and interdependencies across people, organisations and geographies can cause sudden and catastrophic impacts on the operation of businesses, public services, financial markets and then ultimately, the public.
Expectations of resilience have also changed. Our deliberative research workshops with a cross-section of the UK public, run by Jigsaw Research, show how the experience of COVID-19 and the cost of living crisis have raised people’s expectations - as citizens, consumers and employees - of business and government to maintain core services, provide support and protect national infrastructure, whatever the disruption.
Risks such as total loss of IT or a power outage are scenarios that can be planned for when they are anticipated but, dismissed as improbable, the unexpected and cascading impact can amplify the speed, duration, cost and consequences of the fall out.
That speed of impact is a key reason for regulators increasingly putting the operational resilience of organisations in the spotlight. “The timeframes for adverse events are very short, whether it's an internal failure or an external attack, such as a cyber incident, from having a material impact maybe just on customers to begin with, but then on markets, and then wider than that,” says Duncan MacKinnon, Executive Director for Supervisory Risk Specialists at the Prudential Regulation Authority (PRA). “The speed has really been a big driver of our interest in this and we need firms to be able to mitigate operational risks and adverse events crystallising in the very short term.”
The total impact of disruption
- Cyber attack
- Supply chain disruption
- Climate and weather
Cyber attack
Ransomware
Impact on resilience
- The ransomware attack on the Irish Health Service Executive in 2021 resulted in total loss of IT, leading to healthcare services being severely disrupted, and theft of the personal data of staff and patients. Taking several months, the publicly stated cost of recovery to date is €80m.
- US oil pipeline system Colonial Pipeline was hit by a ransomware attack in 2021 that forced the company to halt all operations to prevent the attack spreading. This caused fuel shortages at petrol stations and a rise in prices, as well as impacting airline flight schedules - leading President Joe Biden to declare a state of emergency.
Supply chain disruption
Blockage of the Suez Canal by the Ever Given container ship in 2021
Impact on resilience
Temporary closure of the canal:
- Impacted around 400 vessels and global trade worth $9.6bn
- Disrupted global supply chains for months afterwards
- Caused delays and shortages in everything from silicon chips used in car manufacturing to household furniture
Climate and weather
Severe flooding
Impact on resilience
A severe flood during the winter of 2022/23 would cost the UK over £1 billion in insurance losses (PwC research), causing:
- Physical damage to people, property and infrastructure
- Travel disruption (airlines, trains, road)
- Power outages leaving homes and businesses without electricity, people unable to use ATMs to withdraw cash, fuel pumps not working, internet and communications down
Rethink Resilience - Four ways organisations can evolve for disruption
We have brought together wide-ranging insights from those with the greatest stake in the resilience of organisations across the UK. Their combined reflections set out the business case for why leaders need to take a more strategic approach to resilience and - by making the right investments in people, technology and data - four clear and practical ways to get there.
Contact us
Risk and Resilience Partner, PwC United Kingdom
Tel: +44 (0)7483 422701
Follow us
