EBOOK

4 Steps to Build

Business
ResilienceBusinesses Are Complex –Disruptions Will Occur
Organizations everywhere have felt disruptive impacts from the global financial crisis, COVID-19,
supply chain interruptions, continued cyberattacks or others. Most have relied on traditional
business recovery to get back to business, but a confluence of threats has shown that disruption
can be prolonged and changing, so organizations must be adaptable. The paradigm has shiftedfrom not ‘if’ disruption will occur, but ‘when’.
Organizations are searching for answers to questions, such as: How do we proactively deal withthreats and risks to our company and extended ecosystem? Where do we start and what are thesteps needed to build resilience? How do we know when we’re resilient enough?
There are no quick or easy answers, but there are ways to build resilience. Read this eBook forsome ideas that can help your organization become more resilient.

Resilience is more than justthe ability to recover quickly.
In business, resilience means
dealing with adversity andshocks, and continuously
adapting for growth.
What is resilience? | McKinsey

4 Steps to Build Business Resilience | 2

In today’s continuously disrupted world, traditional approaches to recover after a disruption
are vital but they are not enough - organizations must become resilient. The evolution fromrecovery to resilience requires a cultural change starting at the top of the organizationand cannot only be the responsibility of a small team – it requires focus throughout theentire organization.
Building a resilient organization requires a shift from a reactive to proactive measures andresilience must be built throughout the organization—from its culture to it business modelto how the company operates both internally and across the extended ecosystem.
Resilience requires not only focusing on the recovery of internal processes and systems but
developing the ability of the organization to be able to continue to execute their strategic andoperational objectives, which especially includes providing products and services to theircustomers, regardless of the length or type of disruption.

• Focus on your highest priorities.

The average annual potential
losses from cyberattacks
could be close to 10% of abank’s net income.

• Know your risks and threats.

- International Monetary Fund

There are four key focus areas that should be considered in building your organization’s
business resiliency that are:

• Mitigation and Response.
• Measure and monitor.

On average, companies canexpect to lose half of a year’s
profits over a decade due tosupply chain disruption.
- McKinsey

4 Steps to Build Business Resilience | 3

Step 1:
Focus on Your
Highest Priorities

Building resilience starts with focusing on what’s most important – the products and services you
offer to your customers and the supporting interdependent processes, systems, people, data,locations, and third parties that all work together to make it happen.
The business impact analysis (BIA) is the first step. The BIA enables you to identify those products andservices, their importance to your business, your quantifiable and qualifiable tolerance to impacts
from disruptions, and business objectives that should, in turn, become your resiliency objectives.
The BIA is also instrumental to unravel the complex ecosystem of your internal business processes,
systems, data, people, locations and third parties so that you can organize your efforts to makethem resilient.
The BIA helps prioritize your efforts and resources to build resilience in where it matters most.

Step 2:
Know Your Risksand Threats

Building resilience is dependent on understanding and managing the impacts of risks and threats
to your organization. The events from the recent past have taught that anything can happen – andprobably will and the impacts are often unpredictable.
Many of today’s risks are interrelated and can have a ‘domino effect’ on complex organizations,so risk management must be approached in an integrated way. For example, a third-party breach
could impact your customer data, leaving your organization exposed to a compliance violation,
cyber threats, risk to your reputation and financial loss. Therefore, you must understand thepotentially disruptive “scenarios” and approach the risks and threats like they will likely occur.
You must plan ahead, mitigate the potential impacts and test your capabilities.

4 Steps to Build Business Resilience | 4Step 3:
Mitigate andRespond

Addressing threats and risks needs to occur on a regular basis - before, during and after the crisis.
Risk and threat identification, performing scenario analysis of what could occur, and addressing
gaps in resilience are proactive, mitigating steps that are vital to managing negative impacts tothe organization.
However, things can still go wrong. A supply chain disruption. A customer who falls on a slipperyfloor. A disgruntled employee on social media – are kinds of incidents that occur often enoughinside companies to merit standard procedures for handling them efficiently and effectively.
But what happens when an incident develops into a crisis? This ‘perfect storm’ brewing requires
the ability to manage the crisis from growing, respond in appropriate ways, recover disrupted
areas of the organization and deal effectively with the fallout. Preventive and organized steps arevital to managing the threats, risks and scenarios and reducing the impact to the organization.

Step 4:
Measure andMonitor

A critical step in building resiliency is establishing key metrics, especially impact tolerances,and measuring them to track your status and overall progress. Metrics that are most valuable
are those that are aligned with strategic and business objectives. Examples of a key impact
tolerance metric could include the amount of time or money that could be lost due to adisruption. Another key metric is residual risk of a threat compared to your risk appetite orrisk tolerance. Another very important metric to track are the number and age of unresolved
issues that need to be addressed.
Some key factors to consider are:
• Align your resiliency metrics with your business metrics. Don’t measure your resiliency		 status in a silo.
• Track and monitor your metrics regularly and take appropriate action on those outside		 your tolerance.
• Improve your metrics and measurement over time to hone your focus on the		 highest priorities.
4 Steps to Build Business Resilience | 5

How We Help
Building a resilient organization doesn’t happen overnight and it’s a long-term commitment. However,it can be done. It starts at the top with a change in mindset, and a focus on the right strategic priorities.
It’s founded on the commitment to understand your business, be prepared, become adaptable andalways improving.
Learn more at www.archerirm.com/business-resiliency

Discover More
Archer is a leading provider of integrated risk management (IRM) solutions that enable customers
to improve strategic decision-making and business resilience with a modern technology platform that
supports qualitative and quantitative analysis driven by both business and IT impacts. As true pioneers in GRC
software, Archer remains solely dedicated to helping customers manage risk and compliance domains, fromtraditional operational risk to emerging issues such as ESG. With over 20 years in the risk management
industry, the Archer customer base represents one of the largest pure risk management communities
globally, with more than 1,200 customers including more than 50% of the Fortune 500.
@ArcherIRM

Archer Integrated Risk Management©2023 Archer Technologies LLC. All rights reserved. Archer and the Archer logo are registered trademarks or trademarks of ArcherTechnologies LLC in the United States and other countries. All other trademarks are the property of their respective owners. Archerbelieves the information in this document is accurate. The information is subject to change without notice. 02/23 eBook.