Business Resiliency: ‘A Plan is Not a Strategy’

I saw this video when it first came out several months ago, and I think that it has some valuable insights that can be applied not only to business overall, but also to the management of Business Resiliency programs.

As a short recap, Roger Martin is Professor Emeritus at the University of Toronto’s Rotman School of Management.  (He’s also been named among the 50 most influential business thinkers in the world multiple times.) This video talks about some of the pitfalls that companies might encounter if they should happen to confuse strategic planning with having an overall strategy to their business operations. It also talks about why leaders focus on planning instead of making a strategy, gives an excellent example of strategy beating planning in the marketplace, and gives some tips for how to avoid the “planning trap” of being too focused on planning and not focused enough on building a strategy.

The Problems of Creating a Plan and Not a Strategy

In relation to Business Resiliency however, nearly every company I have worked with encounters these types of problems when they are trying to establish and build a resiliency program. Outside forces often pressure companies to start Resiliency Programs, and satisfying those outside forces usually involves developing resiliency plans to demonstrate that they have a program in place — regulators and insurers are both keen to make companies generate response or recovery plans as proof that they have made efforts to build a program.

The problem companies run into, however, is that they often become fixated on creating plans and miss out on the larger picture. If a company charges in and starts creating recovery plans without doing a Business Impact Analysis (BIA) or putting appropriate governance in place, they may find themselves a year or two down the road without having matured their program much at all. They may find (or worse yet, may not find) that the business processes they’ve developed plans for are not the most vital ones for the survival of their company. They may also find that for all their efforts, their company is still inadequately prepared for many types of business interruptions.  They might have gaps in their response capabilities and might find out too late that they can’t communicate during a crisis.  These pitfalls can all be avoided by taking a more holistic and strategic approach from the beginning.

How Does Strategy Differ From Planning in the Context of Managing a Business Resiliency Program?

Roger Martin defines strategy as “An integrative set of choices that positions you on a playing field of your choice in a way that you win” and I feel this is a definition that lends itself well to Business Resiliency program management. By taking a holistic approach to creating and managing your Business Resiliency program, you begin to make those key choices that put your program in a position to win when you find yourself facing a crisis. That is the start of an excellent strategy for building a Business Resiliency program.

“A strategic theory must be coherent and doable.” 

Roger Martin

One of the problems that most companies face in trying to create a strategy is they don’t know what that end goal looks like, so their strategy isn’t very coherent. Most companies have at least some idea of their current state of preparedness, but far fewer can show you a roadmap of where they would like to be five years hence. A large part of that is because many companies starting their journey towards building a resilience program simply don’t have exposure to best practices. However, working with an outside firm that can objectively look at your current state and help you compare it against established best practices, will help you create a strategy.  A firm that can help you prioritize your efforts and establish metrics for tracking program development can push you that much further towards developing a cohesive program strategy. That will make the strategies that you develop both coherent and doable and will help your company be far more capable of responding to business interruptions in the long run. 

On the other hand, plan creation is more of a process of examining what you have and what you know, and then creating a set of actions based on that examination. Plan creation is a comfortable process, because it’s something that all companies do for budgeting and goalsetting — it’s familiar and expected. Developing a resiliency strategy is unfamiliar and involves trying to anticipate the unexpected. It’s a much less “comfortable” process. There’s also some anxiety built into the process because when you start developing a strategy, you will not be able to prove that the strategy will succeed.  To avoid the “planning trap”, businesses need to push past that anxiety and start building a strategy around their overall goals. 

I’m not saying that plans are not important, because they absolutely are. Recovery plans and communication plans are a necessary part of preparing your company for responding to business interruptions.  You just don’t want to make the misstep of focusing on plans and not doing anything else. It’s easy to get trapped into the idea of just making plans and developing a false sense of security in the process.

One of the most satisfying things about building a mature Business Resiliency program is that you can see if the strategy is working.  Once you create your strategy and start aligning your program with best practices, you’re going to start testing the plans you have made. You’re going to test your ability to communicate during a crisis, and you’re going to test how well your work arounds really function. You’re going to sit your people down and talk through how they will handle the crisis during tabletop exercises, and you’re going to make sure that you can recover your IT systems in a timely manner when you test your Disaster Recovery.  All those tests can be used to validate your strategy, and help you refine it over time so that the needs of your business (and the parties that depend on it) can truly be met during a crisis.

If all that sounds like a scary step out into the unknown, Sayers is here to help. Our Business Resiliency team has tools to help you see where your company stands in relation to best practices, and can help you create strategies to better protect your business from interruptions.