The basics

In a storm, buildings collapse while palm trees stay standing: they bend without breaking. Resilience is not hardness but the ability to stay flexible under load.

Can your company say the same of itself? A natural event brings operations to a halt. Allegations against a supplier cost trust that took years to build. A takeover bid raises the question of ownership, while new competitors and technologies shift the market. The pandemic showed how quickly all of this can happen at once.

Resilience cannot be built in at a single point. It rests on six building blocks: three concern the substance of the company — money, offering, organisation — and three its relationships, internal and external.

• Financial headroom. Without reserves, there is no room to respond. A healthy balance sheet is what allows a company to make decisions in a disruption instead of merely reacting.
• Breadth of portfolio. One product, one market, one major customer: every dependency is a predetermined breaking point. Breadth absorbs what a single business cannot.
• Agile organisation. Short paths, few layers, clear responsibilities. Whoever gets fast feedback from the market spots problems while they are still not a crisis.
• Clear purpose. A company that knows what it is there for decides faster and more consistently under pressure. And it keeps the people it then needs.
• Trust. Trust grows when a company is open about missed targets too. It is the reserve it can draw on in a crisis.
• Sound relationships. Customers, suppliers, banks, authorities, neighbours. Those who support each other beforehand also hold under load: a root system withstands more than a single anchor.

The palm tree does not survive the storm because it is hard, but because its roots reach far. The same is true of companies: those with many supporting connections withstand more pressure than those with a single hold.

The image, structure and division into six building blocks follow Paul Polman and Andrew Winston, “6 Types of Resilience Companies Need Today”, Harvard Business Review, November 2021.

The demands on comprehensive and efficient security management are rising. Organised crime knows no borders and operates ever more professionally. Stays by employees in crisis regions are becoming more dangerous, foreign intelligence services engage in industrial espionage, and extremist groups add further risk.

This calls for a rethink of security organisation and security strategy, and not only in large multinational groups. Effective threat prevention needs broad expertise, a great deal of experience and professionalism. It only succeeds when specialists from different disciplines work together in trust.

Security is guided by the goals and processes of the company. It depends on economic conditions as much as on individual employees. Planning for both from the outset lays the foundation for security management that works in the long term and at a reasonable cost.

• Employee safety. All measures that serve personal safety — access control via reception or badge readers, screening of incoming mail, fire protection.
• Buildings, equipment and processes. What protects employees already protects these too. Beyond that, key procedures are redundant or have fallback options; contingency planning keeps a broken supply chain manageable.
• Information. Security-relevant data and business information need protection. Unauthorised disclosure can harm the company, so they only ever reach the right recipients.
• Cost-effectiveness. Security should serve the company’s goals. Excessive measures cost disproportionately much for little gain — in the end, security works against the very operations it is meant to protect.