Operational resilience is now a strategic imperative for firms in the post-pandemic global economy. The early 2000s and 2010s saw a rise in firm strategies that focus on developing the most cost-effective operations while leveraging global resources, leading to the creation of far-flung global value chains. Firms often concentrated essential operations in a single country as part of their centers of excellence strategies. For example, companies concentrated on Chinese facilities for manufacturing and Indian facilities for call centers and software development. The COVID-19 pandemic and escalating geopolitical risks have highlighted vulnerabilities within business operations and underscored the need for a proactive approach to building resilience in global value chains. This paper explores how firms can build operational resilience, focusing on governance, risk management, supply chains, technology and regulatory compliance. We also provide insights for embedding resilience as a core capability.
Operational resilience is an organization’s ability to absorb, adapt to, and recover from disruptions while keeping critical business functions running. To achieve this, firms must develop three critical competencies – agility, adaptability and alignment (the “triple-A” framework, Lee 2004) – that allow them to respond swiftly to change, adjust to longer-term shifts and coordinate efforts across the organization. In a world where disruption such as cyberattacks, natural disasters and regulatory changes are increasingly frequent and severe, resilience must become a strategic priority. Unlike traditional risk management, which focuses mainly on protection and prevention, operational resilience emphasizes a proactive approach to recovery and continuing adaptability.
In today’s global economy, there are four major forces that shape the strategies adopted by firms to develop greater resiliency: supply chain interdependencies, cybersecurity, customer and stakeholder expectations, and government regulations. Today’s interconnected global supply chains greatly amplify the impact of disruptions. The prolonged impact of the COVID-19 pandemic shock, for example, is a direct effect of weaknesses in global supply chains. The spread of interconnected digital technologies in the value chain exposes firms to cyberthreats, such as data breaches and ransomware attacks. Even a glitch in a benign software update (such as the one from CrowdStrike in July) can bring down operations, with delayed flights, cancelled medical procedures and disrupted banking services. Often the ability to recover from such shocks is strongly influenced by the underlying operational strategies and technologies adopted by the firm. As seen in the graphic below, Delta Air Lines (DL) faced prolonged recovery times, owing to its heavy reliance on a centralized hub-and-spoke system and specific crew scheduling challenges. United Airlines (UA), by contrast, recovered more quickly because of greater operational flexibility and redundancy.
Investors, customers and employees increasingly expect firms to be resilient and adaptable. Operational disruptions can damage a firm’s reputation, diminish customer loyalty and decrease shareholder value, making resilience essential to business strategy. Hendricks and Singhal (2005) demonstrated that relative to controls, firms that experienced operational glitches reported on average 6.92% lower sales growth, 10.66% higher growth in cost and 13.88% higher growth in inventories in subsequent months.
Expectations Increase for Resilience Practices
Governments worldwide are increasing expectations for resilience practices. Guidelines emphasize the need for continuity in essential services, with specific attention to managing risks physical, digital, political and financial in nature. There is, for instance, an increased political focus in the US on reducing reliance on Chinese suppliers in critical global supply chains such as semiconductors.
Implementing robust resilience measures requires significant investment, which can be challenging for small and midsize firms. Even for larger firms, such strategies lead to increased costs in the near term. Further, embedding resilience into risk management and operations often requires cross-functional collaboration and organizational change, which can be difficult to achieve. In today’s global economy, firms rely extensively on their networks of suppliers and partners. Ensuring that these entities have aligned resilience strategies is a complex task.
Resilience in business operations is reliant on several key factors. First and foremost, an effective resilience strategy relies on identifying, assessing and managing potential risks. Using an assessment matrix, firms should evaluate risks based on their impact and likelihood, allowing for the prioritization of high-impact, high-probability risks. Examples include natural disasters, technology failures and regulatory changes. Regular scenario-based simulations and tabletop exercises allow organizations to test their resilience plans. Simulations help identify gaps, validate existing protocols, and ensure that all employees are prepared to respond to disruptions. Predefined response plans are essential for swift recovery. Plans should include specific protocols for different scenarios, such as natural disasters, cyberattacks and supply chain disruptions.
Next, technology plays an integral role in developing operational resilience, since global supply chains have far-flung partners, employees and customers who collaborate using digital technologies. Cyber resilience requires robust security protocols, data encryption and backup systems to safeguard against data breaches and ransomware. Incident response plans should be in place to contain and mitigate cyber incidents. Leveraging digital advancements such as artificial intelligence and predictive analytics can greatly enhance resilience. AI-driven tools, for instance, can help detect vulnerabilities and enable real-time responses to threats.
An array of resilience strategies can be implemented for risk mitigation and control. Relying on a single supplier or region can increase vulnerability, so firms could reduce supply chain risks by diversifying suppliers across regions and implementing backup sourcing options. Maintaining buffer stock and redundancy with key suppliers can help firms manage supply chain shocks. This strategy is especially useful for essential goods and high-demand products during crises. Diversifying production capacities and enabling demand switching could further reduce the impact of local disruptions. Operational resilience is a dynamic process that requires constant monitoring and adaptation. Performance indicators for resilience include recovery time objectives, which set the maximum acceptable downtime for critical operations; mean time to recovery, which measures the average time needed to restore functionality after a disruption; and third-party risk scores. Tracking these metrics helps firms measure and improve their resilience over time. Given the rapidly changing risk landscape, firms should periodically review and update their approaches by incorporating insights from recent disruptions and adapting to emerging challenges
The Role of Regulatory Compliance
Compliance with regulatory standards is another component of operational resilience, particularly for firms in highly regulated sectors such as finance, supply chain, healthcare and critical infrastructure. The Federal Financial Institutions Examination Council, for instance, outlines expectations for resilience planning, particularly around data security and third-party management, for financial institutions. Meanwhile, public-private partnerships, such as the US Supply Chain Resilience Center, focus on ensuring the continuity of critical supplies like semiconductors and medical equipment, providing guidance on risk mitigation and contingency planning.
Governance structures should ensure that resilience is prioritized at all organizational levels. The board and executive team play a critical role in establishing a culture of resilience. This includes establishing clear responsibilities and fostering cross-functional collaboration. A firm should have resilience policies and frameworks that enable consistent policies and practices across the organization and that outline risk tolerance levels, resilience objectives and specific actions for achieving these goals.
In an era of growing uncertainty, building operational resilience is essential for US firms to ensure continuity, protect stakeholder interests and stay competitive. It is imperative that firms develop a robust strategy around operational resilience. This approach should include diversifying suppliers, maintaining critical buffer inventory and closely monitoring third-party risks to ensure business continuity. Firms should also invest in secure, adaptable technology systems capable of withstanding cyberthreats and operational disruptions and proactively adapting to those risks. Resilience must be embedded within the organizational culture, championed by leadership, and integrated into decision-making processes across departments. While most of these efforts are likely to increase the underlying cost structure in the short term, pursuing them will strengthen a firm’s ability to adapt and thrive in a volatile environment, ensuring continuity, enhancing customer trust and securing a competitive advantage.
