People & Resilience: developing your resilience culture

“Company culture” … often quoted as a driver for recruitment and employee retention, has also been praised by companies, as it helped them navigate through the uncertainties during the pandemic and provide strong leadership, good relationships and adaptable employees. How can organisations make culture an asset to tackle crises? This article explores the concept of resilience culture and provides insight into how it can be developed, measured/assessed and improved to enhance your ability to respond to crises.

Why have a resilience culture?

The UK Financial Services regulators (Bank of England, PRA, FCA) define operational resilience as “the ability of firms and the financial sector as a whole to prevent, adapt, respond to, recover and learn from operational disruptions”. In order to increase their resilience, firms must identify their critical services and the tolerable level of disruption to these services for their customers, themselves and the market. They must put in place the necessary measures so critical services can always be provided, whatever happens. This is at the core of “Resilience by Design”.

Achieving this outcome requires a mindset change: as a firm, you must always be planning for the worst case, as zero-risk does not exist. This means putting in place the right capabilities in the key operational domains of resilience (incident and crisis management, cyber defence, IT recovery, business and IT continuity, third party resilience, operational risk management), but also ensuring that the concept is integrated at an individual level and that people in your organisation behave in a resilient way. To have resilient individuals, you need to promote a “resilience culture”: a set of values, beliefs and behaviours that nurture resilient individuals.

What is a resilient individual?

We define a resilient individual with 7 attributes:

Creative & innovative – adapts to change, proposes new things

Outcome focused – focused on outcome for the customer and finds alternative solutions fast in case of disruption

Agile in ways of working – can deliver positive results from anywhere in any circumstances

Team player – on board with the collective project – follows and does their best to support the organisation in the decisions they take

Transparent – is able to acknowledge risks, issues, errors and communicate them

Empowered & proactive – shows initiative, does not need to be micro-managed

Challenger – always questions the current state, thinks of how things could be done differently or better

How to set up a resilience culture and influence positive change

In order to set up the right culture for resilience and promote positive change, Wavestone recommends the following four steps:

Step 1: Identify the core of your resilience culture

In order to set up a resilience culture that is aligned to your company DNA, you need to look for its foundations in your company values. How do these values make you more resilient and help you in a crisis? For example, having “Audacity” as a value means that you are encouraging individuals to be proactive, think outside the box, make decisions fast – all qualities that will be useful in a crisis. This translation of your values into resilience outcomes will make it easier to embed resilience in the organisation. This should be coupled with 3 enablers which must sit at the core of your resilience culture: a sense of common purpose, a flexible mindset, and transparent and frequent communication in the organisation.

A critical success factor to this cultural change is that senior management should be driving and supporting the initiative. They play a key role in defining the vision of the target culture, embodying the change and showing the way.

Step 2: Define the behaviours you want to encourage

From your values and enablers, the next step is to articulate clear, bespoke behaviours you want to encourage, for individuals, for management, and in relationships with external stakeholders and partners. For example, to promote “transparent” individuals, the behaviour you want to encourage for employees is “if I notice a risk, issue or mistake, I am able to acknowledge it and communicate it without fear of repercussions”. On the other hand, for managers, the behaviour to encourage is “I will listen to employees communicating risks, issues or mistakes, and encourage them to share them by avoiding putting the blame on the messenger”.

You should define multiple levels of behaviours, as not everyone in your organisation will have the same maturity when it comes to resilience. We have identified four resilience maturity levels from an individual point of view which contribute to developing a resilience culture at organisational level:

Level 1 – knowledge: “I am aware of resilience good practices and attributes and try to apply them”. Such individual understands the concept of resilience and knows what is expected of him/her.
Level 2 – comprehension: “I know how to apply my resilience knowledge in case of crisis”. Such individual is aware of the different policies and procedures and governance existing within his organisation and the appropriate steps to follow in case of crisis.
Level 3 – application: “I behave as a resilient individual in my day-to-day job” . Such individual is able to put the theory into practice in his/her working environment on an everyday basis: he/she embodies the best practices.
Level 4 – influence: “I am a champion for the resilience culture, I act as a role model to spread the right behaviours.” Such individual is able to transfer his/her knowledge to upskill and guide other individuals to adopt the right behaviours and automatisms. This individual is also able to suggest new ideas and to challenge the status quo to improve resilience processes. Champions can be informal, or they can also be part of an official ambassador community within the organisation dedicated to promoting the resilience culture.

These levels of behaviours can then be integrated into HR processes and embedded into employees’ professional development objectives. This will ensure that they are turned into concrete actions and that employees have an incentive to reach the higher level.

Step 3: Set up concrete capabilities to encourage these behaviours

To improve through these different maturity levels, you should set up concrete capabilities encouraging resilient behaviours. We see two types of capabilities: capabilities that develop these resilient behaviours (training, communication, agile ways of working, etc.) and capabilities that test those behaviours (surveys, exercises, etc.).

These concrete capabilities change in nature based on which behaviour maturity level you want to encourage:

Maturity levels	Development capabilities	Test capabilities
1 Knowledge	Top-down information sharing (e.g. communications, newsletters, Town Hall meetings)	Pulse surveys or quizzes with closed or open-ended questions
2 Comprehension	Participative training & awareness (e.g. Interactive training session or gamified training)	Concrete situations (e.g. escape games and role-playing)
3 Application	Real professional experience (e.g. crisis simulations)	External feedback from clients (e.g. client satisfaction surveys)
4 Influence	Channels encouraging people to share success stories where they witnessed good behaviours	Outputs of these channels (e.g. ideas, success stories, knowledge sharing sessions)

To accelerate the setup of new capabilities, you can leverage technology since the market is very active in tools that facilitate and accelerate cultural change: gamified training, micro-learning, mini-surveys, collaborative recognition solutions, etc.

Step 4: Measure the maturity of these capabilities and take positive action

As you put in place resilience capabilities, you should always think about metrics to measure their maturity and their contribution to your overall resilience. In the case of culture, maturity of capabilities can be expressed through the levels of behaviour maturity they help develop (from knowledge to influence) and through quantitative and qualitative results from tests, simulations, and feedback received.

Culture needs to be integrated in your resilience MI as one of the key operational domains that contribute to resilience, like incident and crisis management, cyber defence, IT recovery, business and IT continuity, third party resilience, and operational risk management. Each culture capability needs to have a maturity score expressed in a similar way to how you would assess the maturity of all other capabilities and needs to be mapped to the specific threats it helps tackle. This will allow you to get a view of the maturity of your resilience culture and how it contributes to facing threats.

Final Thoughts

Fostering a resilience culture in your organisation requires developing resilient capabilities in line with company values and encouraging the right behaviours to enable your employees to become resilient individuals. Such a cultural change can be accelerated by leveraging innovative HR & Change technologies and tools to deploy these capabilities. Defining maturity metrics and KPIs to measure these capabilities quantitatively and qualitatively will in-turn allow your organisation to take action and influence positive change durably.

Contact our team to find out more