What role does technology play in resilience? Kate Needham-Bennett from Fusion Risk Management joins PwC’s Dave Stainback to dig into the power of technology and data – and how they work together to create value.
What role does technology play in resilience? Kate Needham-Bennett from Fusion Risk Management joins PwC’s Dave Stainback to dig into the power of technology and data – and how they work together to create value.
Dave Stainback: Hello, everyone, and thanks so much for joining us today on this episode of Emerge Stronger Through Disruption. I'm Dave Stainback, co-leader of PwC’s Global Centre for Crisis and Resilience, or GCCR, coming to you today
from our PwC office in Atlanta, Georgia.
Recently, PwC launched our Global Crisis and Resilience Survey 2023, and in our last podcast episode, my GCCR co-leader Bobbie Ramsden-Knowles and I explored some of the survey results.
This episode, we're taking a deeper dive into the survey insights, focusing specifically on the topic of technology enablement and resilience. I'm very excited today to be joined by Kate Needham-Bennett, Senior Director for Resilience and Innovation at Fusion Risk Management, a leading technology provider for resilience management and business continuity software. Hi, Kate. It's great to have you here. Could you please introduce yourself, give us a quick overview of Fusion?
Kate Needham-Bennett: Hi, Dave. It's great to be here. Thank you very much for having us. As I say, I work at Fusion Risk Management and we're one of the leading platform providers for resilience teams worldwide, facilitating the aggregation of data across business continuity (BC), operational resilience (OpRes), crisis management, risk and third-party teams, and are really helping to improve our clients’ programmes. For the last few years, though, I sat on the other side of the table, building crisis management, OpRes programmes, predominantly in the FinServ space. So, I've definitely felt firsthand a lot of the pain and the challenges that teams are currently going through as various regulations come in and there's increased pressure in the industry.
I joined Fusion, though, with the intention of helping to solve some of these pain points and to improve the quality of best practice in the industry. So, when the Resilience Innovation Team was formed, I jumped at the chance to join and work on some of the forward-thinking projects, looking at the future needs of the industry and how we can best serve those requirements.
Dave Stainback: Thanks, Kate. Love it. And really, given your role with Fusion and your prior experience, as well, I think you're really well positioned to get into the topic of technology and resilience. So, to jump right in, one of the key insights that particularly struck me in our Global Crisis and Resilience Survey this year is that organisations are looking to technology as a driving enabler of their programmes.
We're seeing business leaders really begin to understand the need to underpin resilience strategies with technology that allows them to really mine actionable intelligence from data across a business. So, almost 60% of our respondents told us that the technology enablement of their programmes is one of their key priorities. Why do you think that's so important to business leaders right now?
Kate Needham-Bennett: Well, I think the days are gone where you could manage a resilience programme using just a few people doing BC plans. And the expectations of customers, shareholders, market participants, employees and regulators have just increased monumentally over the last decade or so.
They expect them to have robust resilience plans and programmes in place. They expect them to be preemptively testing their capabilities and remediating against their vulnerabilities. And in the event of a disruption to their services, they expect them to be able to respond really quickly and comprehensively.
And in today's world, you just can't meet that turnaround time without the use of technology. So, we have to be able to keep up with the speed of delivery created by the digital transformations of the sectors that we serve.
Dave Stainback: That’s an interesting point on tying it to the broader digital transformation that so many companies are undertaking. What do you think are some of the main reasons organisations are now investing in digitally enabling their resilience programme?
Kate Needham-Bennett: I think we can probably take it back to three core reasons why businesses invest in technology at all. And that's because it saves them time, it saves them money, or it improves the quality of delivery and makes it easier to deliver.
And the same is true of the reasons for investing in technology to underpin resilience programmes. There's really nothing different. They are looking to get a holistic view of their firm through a single pane of glass – so, one platform, and use that platform to aggregate the data from across multiple disciplines.
And this gives them an up-to-date view at any given point in time of where they're vulnerable, what issues they're exposed to, which risks they've accepted – even tacitly – and which scenarios they are or aren't resilient to. And the list goes on. But with those insights, they can understand which parts of the business are the least resilient, and then allocate resources and budget accordingly.
And with the information that they need to make decisions at their fingertips, firms can respond quicker to any disruptive events. They can move to mitigate any impacts in a more timely manner. And this, too, helps them to save money and time and ultimately deliver a better level of service.
Dave Stainback: That's great. So, I love examples. Any chance you could bring some examples to life in terms of how you've seen technology help businesses really become more resilient and agile?
Kate Needham-Bennett: Of course, yeah. One of the areas we see firms becoming more agile in is really during crisis response. And it's in their ability to see where the knock-on impacts could happen across the firm.
So, for example, we can use Fusion's visual relationship browser, and one of our major manufacturing clients could see, in the event of a cyberattack, exactly which servers could be hit, which processes were reliant on those servers, and, therefore, which services could be impacted. But they could also see which services relied on those services occurring.
So, the internal ones, and hence the knock-on aspects, so they can foresee the disruption down the line. And it’s vastly easier and quicker to see the impact of a crisis occurring through visual process mapping than searching for key terms that might not be consistently applied through business impact analysis (BIAs) in Word documents or Excel documents, trying to map the knock-on impacts from dependencies as you go.
The aspects of resilience that we've really seen help all of our clients, though, is in the retention of knowledge and insights – when staff turnover rates are as high as they currently are and have been for almost all firms post-COVID.
So much knowledge and programme development simply gets lost or isn't maintained each time someone moves on from company to company. And, in using the technology, you're not reliant on individuals’ availability or access to their inboxes or desktops or stored documents or audit trails, unsure whether what you're viewing is really the most up-to-date version.
Dave Stainback: That makes total sense. And I can actually speak to numerous times that we've helped clients respond to crisis events where they felt a number of those pain points that you just talked about – that stem from the traditional manual approach to resilience, business continuity, and even trying to leverage manual plans.
So, to one of your points, and really going back to our survey data, our respondents said that gathering appropriate information quickly and effectively was a significant challenge for them, and so was utilising appropriate technology and tools to enhance the efficiency of their response when responding to their most serious disruption.
So, I think what we're seeing is those that have faced significant disruptions really have felt that pain, and therefore they are recognising the value and the potential return on investment that technology provides in building a more robust and effective resilience programme and response capability.
So, let's shift the conversation a little bit to the broader technology ecosystem. Operational silos, distributed data systems, processes – all of those mean organisations really struggle to obtain that holistic, clear and reliable view of, really, their footprint and the resilience, as you talked about.
And they only identify gaps when disruption actually hits. So, I think technology plays a pivotal role in bringing all of these things together so that leaders are able to truly understand everything that's happening across the organisation. Kate, does that insight from the report resonate with you? And what have you heard from your clients and customers?
Kate Needham-Bennett: It absolutely resonates, yes. In today's market, I don't think we have a single client or prospect that comes to us without the requirement to connect their resilience data to the data being maintained or used by other teams elsewhere.
And technology can be that catalyst. A lot of firms need to break down the silos between disciplines, so you need that exchange of information and insights between the different departments.
Without technology connectors, that seems just not to happen, either because they aren't communicating effectively between teams or because it simply takes too long to share the information and any analysis of it in a meaningful manner – meaning that it's out of date by the time it's loaded into the system. And we see it even between OpResand BC teams, each working separately and not sharing insights.
But if we look at it on a wider scale, it's not uncommon for risk and resilience teams to be working independently of one another, or supply chain and comms teams to only be consulted in the event of a disruption.
So, from a change management perspective, this in turn means that reliable decisions can't be made prior to implementing change, and there is therefore every chance that it will lead to a disruption.
If you imagine, in the event of an actual crisis, all the data that you gather from a range of teams, all the questions you ask or the knowledge you seek – wouldn't it be far better to have access to that on an ongoing basis?
Dave Stainback: Yes, definitely. Yes. Could not agree with you more. And now I want to go a little bit beyond just the organisational data. As you talked about, I think we're seeing external data sources can also be extremely valuable in resilience strategy. How can the broader technology ecosystem be brought together to help bolster resilience and also meet compliance needs?
Kate Needham-Bennett: So, as you say, they are indeed extremely valuable, and we have application programming interfaces (APIs) and connectors with a really wide range of them – including emergency notification service providers, third-party financial risk monitoring, compliance and control frameworks, configuration management databases (CMDB) hosts, and process mappers through to open-source resources on geographic or environmental hazards. And they're all being instrumental in helping firms shift from a reactive to a very proactive approach.
They provide the situational intelligence layered over the resilience programme data to give it meaning – to bring it to life, so that you can identify early on where disruption might occur.
If we look at it solely from a compliance-driven perspective, this insight can help you to meet the requirement to communicate with customers for more markets in a timely and transparent fashion and take action to mitigate the impacts.
From a business perspective, it can help you maintain your reputation. So, everyone accepts that crises happen – in particular, in this day and age, data breaches. But your preemptive measures, speed of response and transparency of actions make the difference in attracting new customers post-incident.
You can minimise financial, legal or regulatory impacts, say, for example, by engaging with those in your supply chain early to reduce the chances of disruption, whether that be failing over to alternates or maybe just helping them out.
From an operational standpoint, your business will run smoother if you can identify potential causes of disruption before they can escalate into full-blown crises. And this helps minimise the knock-on chances of things like a burnt-out workforce, difficulties and recruiting further down the line – the list goes on.
Dave Stainback: That's great stuff. OK, so before we wrap up this episode, I do want to dig into the strategic value of resilience technology. So, for the first time in our survey, our respondents reported that the leading driver for their investment in resilience at all was now strategic – seeking competitive advantage.
So, 48%, in fact, told us that this was the case – and that was the first time that that number has eclipsed either fear or regulatory compliance as their primary reason, which I think is really telling.
But for those of us that live and breathe this resilience industry and footprint, given that exciting development, the move towards really investing in resilience from a strategic standpoint, it feels like it's finally moving beyond that compliance exercise for a rainy-day insurance policy. And business leaders are starting to see that resilience can actually create value and competitive advantage. Can you talk about the role of technology in enabling companies to meet that strategic objective?
Kate Needham-Bennett: It is indeed an incredibly exciting time, isn't it, to be working in this sector? It's interesting to see the transition of seeing resilience as a cost-making function to a value-adding one. Even just the other day I was listening to the radio and a UK energy company were advertising their services – with the lead reason being that the latest survey by Which?, an independent review organisation here in the UK, they were found to be the most resilient. And it just occurred to me that, “Since when was that the key reason for buying anything, let alone energy? Reliable maybe, but resilient?”
It was really interesting to see. But I think if you have a good understanding of your business, you can focus on the most important areas and then you can invest there and make sure your areas of priority are the most resilient to disruption. So, if you're available when others aren't available, especially in crises requiring use of finite resources, then your market share goes up.
If data is being aggregated across teams and any resulting reports, dashboards, conflicts and insights are being shared out to them, the company as a whole can make improvements to their wider ecosystem, and they can really focus their time on growth initiatives. Both those factors should be grabbing the attention of strategic decision-makers as they provide a competitive advantage.
If not, then the regulators are there helping to push the agenda through, and they can do that through pressure on boards to understand their cyber resilience statuses and make improvements accordingly. And it's really encouraging to see that it's even got to the point where there is a role for exactly this at the C-suite level, and that's the Chief Resilience Officer.
Dave Stainback: That’s fantastic. And I actually think that that is a great place to wrap up. I know Bobbie and I are looking forward to covering the topic of Chief Resilience Officer on a future podcast. So, Kate, thank you so much for being here.
This has been a really enlightening discussion and thank you for sharing all of your insights around how organisations can and should be digitally enabling their resilience programme and the value that that brings.
Kate Needham-Bennett: Thank you very much, Dave, for having us. I genuinely do believe that technology can only enhance resilience programmes as we go forward, and it's a really exciting area to be collaborating with those in the industry on and seeing where it can take us.
Dave Stainback: Wonderful. We hope our listeners will take a look at the report at pwc.com and let us know what you think. Please connect with both Bobbie and me on LinkedIn – and don't forget to subscribe to Emerge Stronger Through Disruption wherever you get your podcasts. Until next time, thanks for listening.