Summary of the concept
Organizational resilience
Brief
Organizational resilience is an organization’s ability to anticipate, resist, adapt to, recover from, and develop through disruptions, crises, and changes. The concept is not just about ”surviving” difficult situations but about being able to continue delivering value, protecting people and operations, and learning from experiences to become stronger over time. In a world characterized by geopolitical uncertainty, cyber threats, supply chain disruptions, climate-related events, and rapid technological changes, organizational resilience has become a central management issue. Previously, many organizations focused primarily on efficiency and cost optimization. Today, the focus has expanded to include robustness, adaptability, and continuity. An organization that is extremely efficient but lacks resilience can become vulnerable when conditions change. The core of organizational resilience consists of several interconnected capabilities:
• Robustness: the ability to withstand interference without critical functions being disabled.
• Adaptability: the ability to change working methods when circumstances change.
• Recovery ability: how quickly and efficiently the business can return to normal or acceptable operation.
• Learning: the ability to draw conclusions from experiences and translate them into improvements.
• Situational awareness: to understand risks, dependencies and changes in the external environment.
Organizational resilience differs from traditional risk management. Risk management often focuses on identified risks and probabilities, while resilience also encompasses unexpected events and the unknown. The question is not just ”How do we prevent something from going wrong?” but also ”How do we function when something unexpected nevertheless occurs?”. The field is multidisciplinary and draws on ideas from, among others, organizational theory, leadership, systems theory, security, crisis management, and psychology. It is used in both the public sector and industry, healthcare, energy supply, finance, defense, and technology companies.
For leaders, resilience means creating structures that keep the organization stable without becoming sluggish. For employees, it means being able to act independently, collaborate effectively, and manage uncertainty. For the organization as a whole, it means balancing control and flexibility.
This review first addresses the area’s historical development, then how resilience is used in practice, which principles are most important to understand, and how the area interacts with adjacent disciplines. Finally, the advantages, limitations, and a number of questions are discussed that can help an organization assess its own maturity in the area.
History
The concept of resilience originates from the Latin resilire, which means to bounce back or return to its previous form. In physics, the term was used to describe the ability of materials to regain their shape after being subjected to stress. In the 1970s, resilience began to be used in ecology through the researcher C.S. Holling. He showed that ecosystems not only need stability but also the ability to adapt to changes without collapsing. This idea later had a major impact on organizational theory. In the 1980s and 1990s, researchers began studying how organizations in aviation, nuclear power, and healthcare managed complex and risky environments. The result was the development of theories about so-called High Reliability Organizations (HRO), organizations that succeed in maintaining high safety despite significant risks. After the terrorist attacks of September 11, 2001, the financial crisis of 2008, and the later COVID-19 pandemic, interest in organizational resilience increased sharply. Many organizations realized that traditional risk models were not sufficient to manage extensive and unpredictable disruptions. Today, resilience is increasingly viewed as a strategic capability rather than simply a security or crisis issue.
Application
Strategic management
Management teams use organizational resilience to ensure that operations can continue to function under changing circumstances. This may involve:
- identify critical business processes
- create alternative supply chains
- reduce dependence on individual systems or suppliers
- building organizational flexibility
Business continuity
A related area is Business Continuity Management (BCM). Here, plans are developed for how business-critical functions should be maintained in the event of disruptions. Examples:
- IT systems are down
- Power supply is interrupted
- An important supplier has production stops.
- Staff shortages occur during a pandemic.
Information and cyber security
Digitalization has made cyber resilience a central part of organizational resilience. It is not enough to try to stop all attacks. The organization must also be able to detect, isolate, and recover from incidents.
Supply chains
Global supply chains are often efficient but also vulnerable. Resilience can be built through:
- several suppliers
- geographic distribution
- security stock
- increased transparency in the supplier network
Human and cultural aspects
A resilient organization is built not only on processes and technology but also on culture. Employees need:
- feel psychological security
- dare to report problems
- being able to make decisions in the face of uncertainty
- Collaborate across organizational boundaries
Common misunderstandings
Resilience is not the same thing as risk management
Risk management often starts with identifying threats and probabilities. Resilience starts with the question: ”What do we do if something happens that we hadn’t anticipated?”. Therefore, resilience complements traditional risk management rather than replacing it.
Resilience is about systems
Organizations consist of people, processes, technology, suppliers, and customers. A problem in one part of the system can quickly affect other parts. Examples:
• A cyberattack affects IT systems.
• The IT outage affects production.
• Production problems affect deliveries.
• Delivery problems affect customers and the economy.
Resilient organizations analyze the entire chain of dependencies.
Overoptimism can create vulnerability
Many organizations strive for maximum efficiency. But every unused spare capacity can reduce resilience. Examples:
• Minimum stock levels lead to lower costs but greater vulnerability.
• Fewer specialists result in lower personnel costs but increase the risk of sick leave.
• A single supplier can provide a lower purchase price but a higher level of dependency.
This illustrates the fundamental balance between efficiency and resilience.
Culture is as important as technology
Organizations with strong resilience are often characterized by:
• open communication,
• continuous learning,
• quick information sharing,
• trust between management and employees.
Many organizations fail not because of a lack of information, but because the information does not reach the right people or is not translated into action.
Adaptability is a competitive advantage
In the past, stability was considered the most important organizational characteristic. Today, adaptability is often seen as being at least as important.
Organizations that can quickly change processes, business models, and priorities often have better conditions to manage uncertainty.
Ecosystem
Organizational resilience interacts with several related areas.
Risk management – Identifies, analyzes, and prioritizes risks.
Kri punishment – Focuses on leadership and decision-making during the ongoing crisis.
Business Continuity Management – Ensures that critical functions can continue to function.
Information security – Protects information, systems and data.
Cybersecurity – Protects organizations against digital attacks and technical disruptions.
Leadership – Effective leadership directly affects the organization’s ability to act under pressure.
Organizational culture – It affects how people react in situations of uncertainty and change.
Quality management – Many principles in quality development, such as continuous improvement and learning, are also central to resilience.
Standards and frameworks Common frameworks include:
• ISO 22301 (Business Continuity Management)
• ISO 31000 (Risk Management)
• ISO 27001 (Information Security)
• ISO 22316 (Organizational Resilience)
Practical examples
Example 1: Industrial companies and the supplier crisis. An industrial company uses a single supplier for a critical component. The supplier suffers a fire. A traditional efficient operation may need to stop production. A resilient operation has:
• alternative suppliers,
• safety stock,
• pre-determined contingency plans.
Production can therefore continue with limited impact.
Example 2: Cyberattack against energy companies. An energy company is hit by ransomware. An organization with low resilience loses access to its central systems for several weeks. An organization with high resilience has:
• backup system,
• incident management plans,
• trained crisis management teams,
• clear communication procedures.
The disruption is limited and recovery occurs significantly faster.
Summary
Organizational resilience is the ability to handle disruptions, adapt to changes, and continue creating value in uncertainty. The field has evolved from studies of robust systems to a broad management perspective that encompasses people, technology, processes, and culture. The key insights are that:
• all organizations are subject to disruptions,
• all disturbances cannot be predicted,
• recovery is as important as preventive work,
• flexibility and learning are key competitive advantages,
• culture and leadership are crucial for long-term resilience.
A resilient organization does not try to eliminate all uncertainty. Instead, it builds the ability to function well even when uncertainty arises.
Advantages
• Higher resilience against crises and disruptions.
• Faster recovery after incidents.
• Reduced economic consequences in the event of disruptions.
• Increased trust from customers, owners and authorities.
• Improved ability to handle change and innovation.
• Stronger collaboration and organizational learning.
Disadvantages, risks and limitations
• Costs for redundancy and preparedness.
• It is difficult to measure resilience objectively.
• Risk of overinvestment in unlikely scenarios.
• Balance problems between efficiency and robustness.
• Can create organizational complexity if measures are introduced without a holistic perspective.
• Resilience does not guarantee success in extreme or prolonged crises.
Five readiness questions
- Do we know which business processes are critical for our organization's survival?
- Have we identified our most important dependencies on technology, people, and external suppliers?
- Can we continue to deliver our most important services if a major disruption occurs today?
- Have management and employees trained on realistic crisis scenarios over the past year?
- Do we have established mechanisms for learning from incidents and putting the lessons into practice?
Recommendation for the next step
For those who want to deepen their knowledge, it is advisable to study ISO 22316 (Organizational Resilience), Business Continuity Management, High Reliability Organizations, and research on resilient leadership and complex adaptive systems. Together, these areas provide a strong foundation for understanding how modern organizations build long-term resilience.
