The recent global tech outage shines a light on the critical need for robust resilience planning in the digital age.
Estimated read time: 3-4 minutes
In a perfect world, managing risk means eliminating every single threat. But back in the real business world, with its increasingly interconnected technologies, rapid changes, and multiplying threats, scoring a perfect 100 percent on risk management is just not a realistic goal.
Look no further than the recent global tech outage triggered by an automatic software update from a company that specializes in (wait for it) security and risk management. Because of the company’s entrenched role in enterprise technology, its routine update triggered costly outages and extensive remediation efforts for organizations around the world. The knock-on effects hit especially hard for businesses that lacked strong recovery plans.
Instead of perfection, then, leading-edge risk management today is about being 100 percent prepared for any problems—both potential and actual. That requires a commitment to organizational and operational resilience that will help companies stay ahead of risks as best as possible, rapidly navigate any fails, and quickly get back to business as usual.
As the latest global outage demonstrated, threats can be internal or external, from friend or foe. That’s why resilience planning has become such a critical discipline, requiring ownership across the C-suite and companywide buy-in. Indeed, in one recent KPMG survey, chief risk officers said that ongoing training and communication for the entire organization was the most effective tactic for managing risks.1
Maintaining business resilience is a fluid process. It includes defining essential processes, identifying threats and risks, and designing a resilience strategy grounded in the proper controls, backups, and technology architecture. But like threats, effective resilience strategies don’t sit still. The underlying risk-and-control structures must be tested and optimized on an ongoing basis.
As a starting point, we encourage clients to look for potential disruptions and build preventative controls across three key areas, as we outline in our new report. The big three:
What does an effective business resilience plan look like in action? It’s a question most organizations hope they never have to answer, of course. But virtually every company has faced—and will face again—a real disruption. How companies prepare and respond makes all the difference.
To that end, the recent global tech outage reinforced several insights on the leading practices to face down a real-world challenge. In our observations, organizations with responsive, regularly tested backup and recovery strategies are ideally positioned to quickly limit the damage and restore operations. Their business resilience planning consistently focuses on recovery at scale and under pressure.
1
2
3
4
5
6
7
Broadly, we have observed that companies have made solid progress in establishing a baseline of organizational resilience over the last few years. But that line needs to keep elevating. Bad actors continue to get more industrious and risk matrices will grow ever more complex.
Turn insight into opportunity with unique perspectives and actionable insights addressing the burning issues atop the C-suite agenda. Delivered monthly.
And while a strong resilience foundation relies on tight coordination of the organization’s people, processes, and technologies, companies need to keep in mind another growing consideration: the regulators. Much of the recent regulatory churn—whether new laws or proposed new guidelines—focuses on an organization’s risk management and resilience capabilities. In our recent survey of risk officers, for example, regulatory and compliance issues ranked as the top challenge.
Given that increasingly complex risk environment, then, organizations must strive for bounce-back resiliency, not “it won’t happen to us” perfection. That starts with a clearly defined tech infrastructure, rigorous third-party risk management, responsive recovery plans, and an organization-wide commitment to navigating the digital age’s expanding threats.
1 KPMG Chief Risk Officer Survey
2 Navigating the fallout: Lessons from the CrowdStrike outage
Insight
Navigating the fallout: Lessons from the Crowdstrike outage
Plus 7 key backup and recovery actions
Insight
Building resilience in a hyperconnected world
Most enterprises are operationally dependent on a broad third-party ecosystem that must be equally resilient in the face of disruption.
Insight
CFOs Tackle Enterprise Risk Management
Learn why enterprise risk management is a hot topic for CFOs today
