Ep. 32: Building Operational Resilience: The New Business Imperative

In our latest episode, our Global Centre for Crisis and Resilience co-leader Bobbie Ramsden-Knowles is joined by Mark Barboza and Moira Cronin to discuss building operational resilience — its benefits, key enablers, the value it creates for organisations.

Transcript

Bobbie Ramsden-Knowles: Hello everyone, and welcome to this episode of Emerge Stronger through Disruption. I'm Bobbie Ramsden-Knowles, a partner from PwC UK and I co-lead our Global Centre for Crisis and Resilience, or GCCR as we call it, with Dave Stainback. The aim of this podcast series is to explore the challenges facing businesses in this environment of constant crisis and change and discuss how successful business leaders can emerge stronger through disruption.

This is the third episode of the GCCR Summit Series in which we focus on major topics our crisis and resilience leaders from around the world discussed at our PwC Global Summit, and I'm absolutely thrilled to be hosting today's discussion on operational resilience or OpRes.

And joining me are two of my PwC colleagues and fellow resilience leaders, Moira Cronin and Mark Barboza. Moira, Mark, really great to have you both here with us today.

Moira Cronin: It's great to be here, Bobbie. Hello everyone. I'm Moira Cronin, a Digital Risk and Resilience partner here in PwC in Ireland, and I'm coming to you today from our offices in Dublin. Great to be here.

Mark Barboza: And I'm Mark Barboza, Operational Resilience partner, PwC Canada. I'm excited to be part of this discussion because I believe that building resilience today is really a strategic imperative for both withstanding disruption and guiding business decision making. Can't wait to get into the conversation.

Bobbie Ramsden-Knowles: Brilliant. Thank you both. Before we get started, I think let's just take a quick moment to level set and actually think about how we define where operational resilience really fits into our overall PwC Enterprise Resilience framework. So, we define OpRes as an organisation's ability to continue delivering critical services and functions during and after disruptive events, or your Minimum Viable Company.

What it means is having the ability though to adapt to all different types of disruption, whether that's a cyber attack or a natural disaster, or system failure, and having the agility in place to respond quickly and keep things running smoothly. We talk about it comprising several core capabilities, so breaking down the silos often in an organisation across crisis management, business continuity, supply chain and technology resilience and cyber recovery, and from a holistic enterprise view, for me, it's one of the three main pillars of organisation-wide enterprise resilience, along with strategic and financial resilience as well. So Moira, we can start with yourself. So, from your perspective, what are some of the key benefits of building operational resilience?

Moira Cronin: Yeah, Bobbie, I think on operational resilience, for me, it's grounded in having a focus on which business services are actually the most critical, and then understanding the technology, the third parties, the people, and the premises that are actually required to deliver these critical services.

So this mapping, which we call Critical Business Services mapping or CBS mapping, it's incredibly valuable on many fronts, right? Because it gives you a really good visibility into the risks that your organisation is actually exposed to, and it helps you manage those risks in the most efficient and effective way. If you can't see a risk, you can't manage it effectively. So, that's absolutely imperative for organisations to look at how they map that out.

Once you have that mapping done, it really helps your senior managers and your board to actually make more effective decisions because they've access to more information. And because of this increase in visibility and understanding, there's a real opportunity for organisations to emerge stronger from the effort.

Mark, love to get your perspective on that.

Mark Barboza: I think from my vantage point, resilience helps break down silos and surface hidden risks that would otherwise only present themselves when an actual incident occurs. It provides a high level of confidence, particularly at an executive and at a board level in an organisation's ability to navigate through disruption. And I think the key point here is that disruption is a case of when and not if.

It also provides confidence on the day of failure and for the business days thereafter until recovery is actually successful, protects the organisation reputationally, and it reduces the level of what I would describe as systemic harm that an organisation may cause if one of its critical services experiences disruption for a prolonged timeframe.

Moira Cronin: Yeah, that's really the point Mark, isn't it? Like we're not trying to stop disruption because disruption is inevitable. What we are actually trying to do is lessen the impact to make sure that we're constantly ready and preparing for a scenario that could cause intolerable harm to our customers.

Mark Barboza: Agreed. Here's a good example. You know, by taking a Critical Business Services view, one Canadian bank was able to surface gaps in its disaster recovery testing, and the quality of what they were testing. Those gaps were specifically in their recovery sequencing, and it existed simply because what the technology function understood was different to what the business actually prioritised.

It helped also surface a lack of what I would describe as documented manual workarounds, which would've enabled the business to remain resilient temporarily. The reality was that those workarounds were in people's heads as well, and not necessarily codified, and therefore scalable and repeatable too.

Moira Cronin: And that's what we're seeing, Mark, like at the end of the day, a lot of these organisations, particularly in the financial services sector, they see operational resilience as a box ticking exercise. But operational resilience is not just a nice to have anymore. It's actually a strategic imperative and it brings benefits well beyond compliance.

Bobbie Ramsden-Knowles: Agree, a hundred percent Moira. And I'm certainly seeing that in sectors outside financial services, for example, within the energy sector. And I think the other thing is it's about creating value when you build resilience, and we actually highlighted that back in our 2023 Global Crisis and Resilience Survey.

So I guess, what are some of the key enablers of operational resilience from your perspective, Mark?

Mark Barboza: Oh, resilience is exciting to me, Bobbie, because it's both a broad and a deep area and with what is happening around us in terms of scenarios and incidents, resilience changes every single day.

To a large extent, resilience enablers relate to the nature of an organisation's Critical Business Services. So if it's largely dependent on managed services, for example, resilience should be built into third-party risk management practices with monitoring, reporting, and ongoing testing of controls established to provide confidence around third-party resilience.

Equally, there are several critical services which depend on high availability architecture and scalable systems and so forth. In that instance, a key enabler to unlock the potential of resilience is through the cloud and through the resilience capabilities that exist within the cloud, and its underlying observability, monitoring, and logging as well.

Moira Cronin: Yeah, Mark, this is very true. Also, some other enablers such as tech and artificial intelligence. They're really, really important for driving resilience for any critical business.

If your view into how CBSs are being delivered is on a charter in someone's drawer, then it's outdated the second that you sign it off, right? At the rate that we're moving at now and the pace of change, you don't have enough time to go and find something manually. We need to get to a point where our business processes and the supporting IT systems are actually recorded and live on a technology-enabled solution. Everything needs to be real time and automated on a system ready to roll out rather than in a drawer somewhere.

There's also, I suppose, a growing number of examples of organisations using AI from a resilience perspective. I know that the use of both tech and AI for resilience are covered in depth in another episode of the series. But suffice to say that AI is an operational resilience enabler, that'll only become more powerful as its capabilities proliferate.

Mark Barboza: Yeah. I'd also add on by saying another emerging enabler that I alluded to before is this point around observability.

So typically, most organisations have logging and observability over different aspects of their technology stack, but it's really useful to take a CBS view and understand what aspects of your processes are being measured, monitored, and observed. And equally, what aspects of those third-party relationships are being measured, monitored, and observed, and how it all comes together into a single view from a Critical Business Service perspective.

Moira Cronin: Yeah, that's a really good point, Mark. And just to add my final one and my personal favorite is tone at the top. It's one thing to comply with a regulation and move on, like it's another thing to really build true operational resilience and gain the benefits that we've just spoken about.

And that takes leaders who can drive that message and the goal is to protect the business, make the business stronger, and create value rather than just ticking a box. Often this tone at the top, and this culture, doesn't shine through until there's actually been an incident, which is too late. Right?

And once a company I know, they simulated an incident which drove their leaders to effect change. The senior executives in that moment realised actually how unprepared they were and the stress and the personal embarrassment was actually very visible. But as a result, they kicked off their resilience journey with strong messaging from the top, and a goal of preempting the possibility of being in this actual position in the future.

Bobbie Ramsden-Knowles: I can’t agree more Moira, and I think the more crises, particularly some of the recent cyber crises that organisations have faced, are raising important questions at the executive and board level of many organisations, so that tone at the top is incredibly important.

So we talked a lot about the benefits of building operational resilience and what the key things are needed to do that, to build it and sustain resilience. Let's close by going just a little bit deeper on value creation through operational resilience and how organisations can see, manage, and take risks more proactively and strategically as a result of that investment.

What are some examples that you've perhaps seen of this playing out for organisations?

Mark Barboza: One innovative organisation is working on a return on resilience investment metric, which is actually twofold. Number one, it's, you know, raising the questions as to what is the opportunity through investing in Critical Business Services from a cost optimisation perspective? Asking the questions around where is risk management spending occurring outside of a CBS, and then could that spending be redeployed to a CBS?

And then the second part of that involves looking at cost out possibilities. So, the Critical Business Service view, I think, has enabled this organisation to identify duplication in various testing practices throughout the organisation. So the work is starting to drive conversations around automation, simplification, and consolidation of work where processes occur in very similar ways, but in different parts of the organisation.

Moira Cronin: So from a risk identification perspective, an organisation that I am working with identified a significant concentration risk when they were mapping out their third parties, and this was an area where they actually thought they had diversified. As they followed down the subcontracting chain from each of their providers, they actually converged back to one in the end.

The information that is gathered as part of this mapping process can actually drive strategic decision making by raising questions such as, why do I have five different providers across my network doing the same thing, charging me different prices in five different locations?

You see duplication, as Mark has already highlighted, but if you haven't mapped it out, you can't see it and you've no way of actually deriving value from it. So maintaining a focus on what's really, really important and understanding the organisation end-to-end as it relates to those Critical Business Services actually provides you with a lot of power for strategic decision making.

Most organisations are definitely not there yet with proper mapping and end-to-end understanding, and it can be really difficult to do. But our listeners should really bear in mind that resilience is an iterative process. You need to prepare, adapt, respond, recover, learn, and then start again.

Mark Barboza: Yeah. I'd also add that regulations are proliferating really quickly in this area and boards, rightfully so, are starting to ask how and when they will see a return. I think more boards will be asking questions and wanting tangible reporting on resilience of their critical services. And what that means then is that leaders will need to show that not only are they resilient as an organisation, but that the information they harvest in the process is providing value creation in many forms.

Bobbie Ramsden-Knowles: I think that is a really great place to wrap this up. Moira and Mark, thank you both for what has been a really interesting discussion. I'm so pleased we could do a deeper dive into operational resilience as I know this is a major focus for many of our clients and for our GCCR network as we're helping our organisations guide them through their resilience journey.

To our listeners, thank you so much for joining our GCCR Summit Series and really hope you enjoyed this next installment. I will continue to delve deeper into the hot topics such as tech and AI and technology enablement in resilience and also resilience regulations, providing practical advice and strategies in our future episodes.

As always, you can find more insights and resource on our PwC GCCR website, and please do connect with me, Moira and Mark on LinkedIn, and of course, subscribe to Emerge Stronger through Disruption wherever you get your podcasts. Until next time, stay resilient and prepared for whatever challenges come your way.

VO: Copyright 2025 PwC. All rights reserved. PwC refers to the PwC network and or one or more of its member firms, each of which is a separate legal entity. Please see www.PwC.com/structure for further details. This content is for general information purposes only, and should not be used as a substitute for consultation with professional advisors.