10 minute read 19 Oct 2023
Looking up into the tree canopy circle formation

How boards can support resiliency in the face of constant crisis

Authors
Cigdem Oktem

EY US Central Region Center for Board Matters Leader

Agile and future-focused leader. Cross-discipline, multicultural connector and innovator. Storyteller. Artist.

Kris Pederson

EY Americas Center for Board Matters Leader

Boardroom champion. Corporate director. Strategy leader. Long-term value architect. Purpose-focused professional. Enjoys skiing, running and golfing with her family in the mountains of Boulder, CO.

Jeffrey Sallet

Investigations & Compliance, Forensic & Integrity Services, Crisis Management Leader

Former federal investigator. C-suite leader. CPA. Boston native. 5x Boston Marathon finisher. Devoted to family.

10 minute read 19 Oct 2023

Show resources

  • EY CBM: How boards can support resiliency in the face of constant crisis (pdf)

    Download 627 KB

From ad hoc response to truly “ready for anything,” boards and their organizations are setting aside the traditional crisis playbooks to focus on resilience.

In brief

  • Today’s crises are more rapid and interconnected, causing boards to rethink traditional approaches that can hinder a dynamic and agile crisis response.
  • Leading boards view crisis management through a longer-term lens focusing on organizational resilience rather than waiting for the next crisis.
  • To enable resiliency, crisis responsiveness must be embedded and reinforced in the company culture, processes and resourcing.

A leader’s statement or a customer incident goes viral globally on social media. A ransomware attack halts operations. A CEO is suddenly incapacitated. An investigation implicates senior management. An activist demands board seats. A product defect leads to massive recalls. A new technology threatens to make the company obsolete. A virus triggers a pandemic shutdown. A war breaks out and reroutes the global supply chain paths.

These examples of crises that reverberate in the boardroom were cited by directors during recent discussions about the challenges of overseeing crisis management in today’s environment. While they may take many different forms, crises all create an urgent call to action that goes outside the normal course of business and processes. At least, that’s how crises have traditionally been characterized and addressed. The problem facing leaders today, however, is that we now live in a world where a crisis never seems to end, with integrated geographies and systems driving spillover – all as the impact is accelerated by social media. No wonder the term ”permacrisis” is quickly finding its place in the corporate lexicon. 

Directors characterize a crisis as: urgent, adverse, consequential, people-related and of uncertain duration.

In this environment, boards and management teams can no longer afford to think in terms of traditional one-off crisis management, because doing so leaves the organization in a constant scramble to put out fires with outdated plans. Instead, we increasingly see leaders shifting to a resiliency approach that enables more effective capabilities with less stress on the organization.

Outdated approaches to crisis management hinder resilience

When a catastrophe arises, management teams typically reach for the shelf to pick up whichever crisis playbook applies and then – because there’s no such thing as a textbook crisis or opportune conditions – improvise as the crisis unfolds. And if the crisis involves the management team itself, the board turns to its own playbook.

Instead of making organizations ready for anything, this limited approach has resulted in increasingly siloed and specific actions that require resources and re-learning – every time. In addition, flawed decision-making about how to handle the crisis du jour can further impede the organization. Below are the common approaches and thought patterns that may hinder a dynamic and agile response to a crisis:

Conventional approaches to crisis

Mindset Potential downsides
This crisis is like the last one. Boards and management teams have a tough time preparing for and predicting the next crisis, and they often end up reacting to the last crisis, ultimately overinvesting in the wrong areas.
We have the playbook. In these dynamic times, having a set playbook for a crisis can lead to missteps, including outdated contacts, resources, and tools. While playbooks communicate the baseline response, they inadvertently encourage a limited approach rather than the agility organizations need to respond to changing conditions.
We have plenty of time to prepare. Humans have a well-documented bias known as “hyperbolic time discounting,” which means that they excessively discount the future, focusing instead on short-term rewards. Because people don’t take long-term risks as seriously as they should, organizations put off corrective actions that could avert future disasters.
It won’t be that bad. Management teams are accustomed to scenarios with typical assumptions and ranges. The challenge in a crisis is that the “down” case for the assumptions may not be sufficient. For example, directors noted that throughout the pandemic, less-seasoned executives had no concept of how bad things could get and seriously underestimated the worst-case scenario.
Someone has it covered. There is not always clarity on who owns what during a crisis, and more importantly what the risk appetite guidelines are. Not to mention who has decision-making authority for timely decisions. Relying on the usual organization chain of command can be a huge hindrance.
Take it one crisis at a time. Perhaps the most outdated mindset is that a crisis is a stand-alone problem that is then addressed in siloed fashion as an ad hoc agenda item. This guarantees that organizations are not only underprepared when simultaneous crises hit, but that interdependencies will be overlooked, resulting in greater impact.

Looking across these standard approaches, the picture that emerges is of static limited responses to crises (expected and unexpected), which feels out of step in the increasingly dynamic and volatile business environment of today and tomorrow.

Rethinking crisis management with an eye toward resilience

In the face of static approaches to dynamic and interrelated crises, perhaps it is not surprising that boards are now asking, “How are we preparing differently for the next crisis?” And the answer they are hearing from leading organizations is, “By building resilience.”

What does resilience really mean? At its core, resilience is about being able to handle disruption and keep going – or, as one director put it, to “have the muscles to take the hit and remain standing so you can get back in the game.” Less poetically, resilience means having a systematized approach to crisis management that is aligned to risk management. So, rather than careening from crisis to crisis, a sustainable approach is embedded into the corporate DNA, integrated into the culture and processes, including communications protocols. This also means focusing on the threats and early interventions to get ahead of a crisis.

An enhanced crisis management framework to ensure resiliency

  • Recognize the broad spectrum of potential crises

    The ability to regularly assess the environment is foundational to resilience. It includes having the appropriate capability to assess a variety of threats in real time based on robust analytics and advanced tools, with trained personnel to add context to incoming data, and ultimately, better inform decision-makers. Viewing the landscape of potential crises through this lens enables the organization to include risks and incidents – reputational, ethical, legal, environmental – as part of its crisis assessment approach.

  • Ready the organization

    Allocating individuals, including leaders, to handle a variety of crises so that they gain knowledge of the affected processes, systems and people builds the muscles for resilience. Whether or not they’re part of a formal crisis management center, designated resources can observe problems, move quickly, and make sure leaders and the board act on those decisions. It’s also noteworthy that leading organizations are enhancing their approaches to encompass multiple simultaneous crises, which is more reflective of our reality. In addition, they’re going beyond tabletop exercises to potentially real-life conditions with a director participating to represent the board.

  • Respond appropriately

    Having the right response – in terms of scale, scope and timeliness – requires clear thinking in the moment, particularly if intersecting crises are happening simultaneously. This is a learned and practiced skill for leadership teams, and boards play a critical role in helping to see the bigger picture and potential longer-term ramifications Equally important is responding with authenticity and integrity to send the clear signal that the organization understands the significance of what’s happening for all stakeholders. As one director aptly observed, “Smart people are a dime a dozen, but people with integrity are the ones that count in a crisis.”

  • Recover and reflect on lessons learned

    This is the crux of resilience. Because the next crisis will be different, but the lessons from the past can and should be applied. Embedding learnings and improvement is essential to build the organizational muscle and enable better responses to the inevitable next crisis. Doing the report-outs to the board helps cement the learnings and appropriate organizational changes. This is also where crisis management can be of service to broader risk management and enhance understanding of risk factors and indicators.

In speaking with directors and crisis management practitioners, the concept of having the right resources in place permanently, given the expectations for continued volatility and crises, came up repeatedly. For some this means a formal crisis management center capable of scanning for and responding to a variety of situations. For others it will mean allocating individuals and having advisors at the ready as part of risk management or operations. Regardless of the resourcing, directors are clear that in our time of permacrisis, even with tighter budgets, their organizations are well-served making crisis management part of ongoing business.

How boards are evolving approaches to resilience

It is noteworthy that, over the past year, leading boards and directors have been shifting their language and the lens through which they view crisis management to a broader and longer-term perspective. As one director who sits on multiple boards notes, “[At this point,] investing in resilience makes more sense than trying to anticipate the next crisis.”

This director is not alone. More boards are discussing and re-examining crisis oversight efforts to bring a greater resiliency mindset. There are implications here not just for management teams but boards as well and how they are including these discussions on a crowded board agenda. Given the board’s focus on long-term value and the threat posed by crises, approaches that can be considered include:

  • Define risk appetite and trade-offs. The board can support management in its decision-making by clearly defining the guardrails for risk and crises to create clarity. While many boards talk about the need for having clear guardrails around risk appetite, few do it with a level of specificity that enables management to make more considered trade-offs.
  • Reconsider risk oversight assignment. Risk committees can be valuable, and in 2022, 11% of S&P 500 companies disclosed that they have separate risk committees, with the majority of those in the financial services sector, where it’s required. Nonfinancial services boards typically delegate overall risk oversight to the audit committee, but oversight for specific risks is sometimes assigned to other committees. For example, talent-related risks may be addressed by the compensation committee, and environmental and social matters by the nominating and governance committee.
  • Pursue diversity of thought. This was an area that directors emphasized as they considered how cross-industry and business cycle experience can prove helpful in identifying risks as they emerge. While boards are recruiting more directors with hot skills, such as cybersecurity, directors need not have a specialized background in these fields to raise valuable insights. Boards can strengthen their own resilience by creating a culture that allows directors to ask questions and challenge points, while maintaining collegiality. Some boards shuffle committee membership every few years to allow for new ideas.
  • Support permanent resources. What’s becoming clear is the need for a combination of abilities to identify risks, then process and escalate them, and finally, communicate well with stakeholders. Where these skills reside and how resources are aligned – whether centralized into a crisis management center or embedded throughout the business – are questions the board can ask to confirm whether capital is allocated accordingly.

In today’s environment, boards play an important role in overseeing crisis management planning and are guiding management teams to look at the entire lifecycle of crisis response, not only to be ready to react to single or multiple crises but also to avoid the crisis in the first place. This highlights the mindset shift underway from crisis management to resilience, which is critical to long-term growth in a short-term volatile environment.

Questions for the board to consider

  • What does our current crisis management entail? How are processes/playbooks built and triggered today?
  • To what extent does the current crisis management approach take into account how different risks may be interrelated and impact each other?
  • What are the board’s crisis and risk comfort levels and thresholds for the organization?
  • How is the board setting clear expectations with the management team about crisis management communications?
  • How is the board ensuring that both it and the management team incorporate the lessons from crisis management efforts of the past few years?
  • Have the board and management considered what types of skills/experience might be needed on an ongoing basis as disruptive events continue?
  • Is the intelligence team appropriately resourced and trained to address critical organizational risks?
  • Has the organization exercised its crisis management plan beyond tabletop exercises, under potentially real-life conditions? Should the board be involved in these crisis management fire drills?
  • Who coordinates the layers of crisis management and how is the plan communicated throughout the organization to ensure people are implementing the right approach? What is the board’s role in the crisis recovery process?

Summary

As crises become increasingly interconnected and persistent, traditional one-off crisis management approaches are no longer effective. Boards and management teams are shifting towards building resilience to handle dynamic and interrelated crises. This involves adopting a systematized crisis management approach aligned with risk management, recognizing a broad spectrum of potential crises, readying the organization with trained resources, responding appropriately, and learning from past experiences. Boards are evolving their approaches to resilience by defining risk appetite, reconsidering risk oversight assignment, pursuing diversity of thought, and supporting permanent crisis management resources.

About this article

Authors
Cigdem Oktem

EY US Central Region Center for Board Matters Leader

Agile and future-focused leader. Cross-discipline, multicultural connector and innovator. Storyteller. Artist.

Kris Pederson

EY Americas Center for Board Matters Leader

Boardroom champion. Corporate director. Strategy leader. Long-term value architect. Purpose-focused professional. Enjoys skiing, running and golfing with her family in the mountains of Boulder, CO.

Jeffrey Sallet

Investigations & Compliance, Forensic & Integrity Services, Crisis Management Leader

Former federal investigator. C-suite leader. CPA. Boston native. 5x Boston Marathon finisher. Devoted to family.