By Roland Kupers

In a deeply interconnected world, stresses and shocks propagate across systems in ways that evade forecasting. Climate change is linked to the Syrian civil war, which is connected to heightened concern over immigration, which precipitated Brexit. Lehman Brothers was an investable company, until suddenly it wasn’t and it catalysed a global financial crisis. None of these links are causal in a strict sense, nor could they reasonably be assigned a probability, but they nevertheless clearly form a web of cascading events. Organizations increasingly recognize how rapidly and often unexpectedly such events unfold. Since the 2008 financial crisis, the terms “black swans” and “fat tails” have become a familiar part of the risk conversation. Yet we don’t always fully spell out the consequences.

Standard risk management tools assume that the risks follow a normalized distribution, mainly because this provides easy-to-understand narratives. But fat tail risks are not normal distributions. The only way to maintain the traditional tools is to neglect and wish away the fat tails. Simply denying the existence of black swans is hardly a way to deal with them. This approach may be approximately right most times, but in principle it is wrong. The consequences of being so wrong can impact an enterprise, perhaps catastrophically. Fortunately there is an alternative, which consists of applying a resilience lens where complexity prevails and traditional risk management is insufficient.

Resilience is, in fact, a property of complex systems. And complexity is the science of interconnected systems that has been driving a slow-motion revolution in science over the past 35 years or so. In 2013 the World Economic Forum published a comprehensive overview in Perspectives on a Hyperconnected World, describing the impact of complexity for policy and business. The conclusion is not that policy-makers and managers must become complexity experts. But a level of complexity literacy is crucial to navigate the modern age.

Nine resilience lenses

At the World Economic Forum’s annual meeting in 2012, prominent companies began to take note of resilience. Peter Voser, at the time Shell’s CEO, asked nine of his colleagues from across sectors what the impact of considering resilience would be on their business, on their clients and on their risk management. This led to the creation of the Resilience Action Initiative (RAI), which in turn resulted in a set of resilience tools and approaches informed by complexity theory but grounded in practice. One critical application is enterprise resilience: the capacity of a company or other organization to adapt and prosper in the face of high-impact, low-probability risks. 

Working on the RAI project, we broke resilience into a set of lenses that could be applied across an organization’s operations. We used the resilience lenses to examine the systemic risks and evaluate mitigation strategies. These lenses were then tested and tuned for applicability with the risk managers of the RAI companies. The new resilience tools are intended to be used in addition to traditional risk management tools, not instead of them. Organizations will continue to face normalized risks, which require the traditional tools. It is systemic risks that require the new tools.

The RAI work led to nine resilience lenses, grouped into the following three categories to provide the agenda for a fat-tail risk conversation:

• “Structural resilience” considers the systemic dynamics within the organization itself.
• “Integrative resilience” underlines complex interconnections with the external context. 
• “Transformative resilience” responds to the fact that mitigating some risks requires transformation. 

Structural resilience

This category encompasses redundancy, modularity and requisite diversity. The focus of structural resilience is on bouncing back faster from a disturbance. Redundancy is possibly the most familiar resilience strategy, but like the spare tyre on a car, it is the most expensive approach, because it requires non-performing assets. System modularity builds resilience only if the modules are loosely coupled: separate them too much and you no longer have a system, couple them too tightly and you lose the adaptive capacity. As in nature, diversity is a key resilience strategy. For organizations, however, this requires addressing the hard question of which diversity is fit for purpose for this problem at this time. That is what is meant by “requisite diversity”.

Integrative resilience

This second category also consists of three lenses: multi-scale interactions, thresholds and social cohesion. These elements mainly focus on the context of the organization and its interconnections. The idea of systems operating at multiple scales is perhaps the most abstract, but also one of the most essential. It is perhaps most obvious in the geographic structure of individuals, families, neighbourhoods, cities, provinces and countries. The health of the connections at and between each scale is a potent contributor to the resilience of a system. Thresholds are familiar, but also neglected. The past of every organization shows discontinuities, but its future plans are always smooth. The fact that threshold effects generally cannot be forecast does not mean they should be ignored. Finally, social cohesion—such as the social capital an organization has to fall back on in times of crisis— is a strong source of resilience.

Transformative resilience

This category emphasizes that resilience is not simply about being able to return to the starting point after a shock. In some cases the organization needs to proactively change or it will end up being changed by external circumstances. The first lens is distributed or polycentric governance. Centralizing authority may seem efficient, but it often comes at the expense of resilience. Elinor Ostrom, winner of the Nobel Memorial Prize for Economics, has described how the use of multiple and overlapping levels of governance builds essential adaptive capacity in an organization. The second transformative lens is foresight, which is not the same as forecasting. Systemic effects generally cannot be extrapolated from past data, but require different techniques to engage with the uncertainty of multiple futures. Shell’s scenario practice is an example of a foresight system that has been applied over the past 50 years for the purpose of structuring conversations about futures. The final lens is experimentation and innovation. This is obviously important for coming up with new ideas, but the purpose here is subtly different. Building capacity for change in an organization requires the capacity to explore the edges of the system. This implies having people with the time and resources to go outside the usual organizational boundaries, into possibly uncomfortable territory. Learning faster than competitors confers long-term advantage—having a purposeful system for such enquiry builds resilience. 

It is not the case that measures to deal with systemic risk simply add up to the sum of these nine lenses. The interconnected nature of the underlying system precludes this. However, considering these nine aspects will provide a comprehensive—and, crucially, a practical— method for mitigating those risks. It is essential, however, for this to be a separate and distinct process from the standard processes used for dealing with normalized risks.

Roland Kupers is an adviser on Complexity, Resilience and Energy Transition and a fellow at Oxford University.