[OR] [BCPC] [C5] Culture as the Linchpin of Resilience

Chapter 5

Culture as the Linchpin of Resilience

Introduction

Organisations often invest heavily in frameworks, policies, and technologies to strengthen their resilience. These investments typically span multiple domains—Operational Risk Management (ORM), Business Continuity Management (BCM), Crisis Management (CM), and Third-Party Risk Management (TPRM). 

Each of these pillars is critical in its own right. However, without a unifying force, they often operate in silos, limiting their collective effectiveness.

That unifying force is organisational culture.

Culture acts as the connective tissue that binds these resilience components into a cohesive, functioning system. 

It ensures that strategies are not only defined but also executed; that plans are not only documented but also internalised; and that responses are not only coordinated but also effective under pressure. 

This chapter explores how culture serves as the linchpin of resilience and how organisations can move from documented capability to lived capability.

Purpose of the Chapter

The purpose of this chapter is to:

• Explain how culture integrates the key pillars of organisational resilience 

• Illustrate how culture influences decision-making, operations, and leadership behaviour 

• Highlight the transition from theoretical frameworks to practical execution 

• Provide a foundation for embedding resilience into everyday organisational practices 

By the end of this chapter, readers will understand why culture is not a supporting element, but the central enabler of resilience.

Culture as the Connector of Resilience Pillars

Resilience is often built upon four core pillars:

• Operational Risk Management (ORM)
• Business Continuity Management (BCM)
• Crisis Management (CM)
• Third-Party Risk Management (TPRM)

While each pillar addresses different aspects of risk and disruption, they must operate in an integrated manner to be effective. Culture is what enables this integration.

Operational Risk Management (ORM)

ORM focuses on identifying, assessing, and mitigating risks that could impact operations.

Role of culture

• Encourages proactive risk identification rather than reactive response
• Promotes transparency in reporting risks and near misses
• Supports informed decision-making under uncertainty

Without a strong risk-aware culture, ORM becomes a theoretical exercise, disconnected from daily operations.

Business Continuity Management (BCM)

BCM ensures that critical business services can continue operating or be restored during disruptions.

Role of culture

• Drives ownership of continuity plans at all organisational levels
• Ensures plans are understood, tested, and applied
• Reinforces preparedness as a shared responsibility

Without cultural alignment, BCM remains a compliance-driven function rather than an operational capability.

Crisis Management (CM)

CM focuses on leadership, coordination, and communication during major disruptions.

Role of culture

• Enables decisive leadership under pressure
• Encourages collaboration across functions
• Supports clear and consistent communication

In the absence of a strong culture, crisis management efforts may be hindered by hesitation, confusion, and a lack of coordination.

Third-Party Risk Management (TPRM)

TPRM addresses risks arising from dependencies on external vendors and partners.

Role of culture

• Promotes accountability for third-party relationships
• Encourages due diligence and continuous monitoring
• Supports collaboration with external stakeholders during disruptions

Without a resilience-oriented culture, third-party risks may be underestimated or poorly managed.

Embedding Resilience into:

Decision-Making

Decision-making is at the heart of organisational resilience. During disruptions, the speed and quality of decisions can significantly influence outcomes.

A resilience-driven culture ensures that:

• Risk considerations are integrated into everyday decisions
• Leaders and employees are empowered to act within defined boundaries
• Decisions are aligned with the organisation’s resilience objectives

Key Characteristics

• Clarity: Individuals understand priorities and trade-offs
• Confidence: Employees feel empowered to make decisions without excessive escalation
• Consistency: Decisions reflect organisational values and resilience goals

In contrast, weak cultural alignment leads to:

• Delayed decision-making
• Overreliance on hierarchical approvals
• Inconsistent responses across teams

Embedding Resilience into:

Daily Operations

Resilience cannot be activated only during crises—it must be embedded into daily operations.

A strong culture ensures that:

• BCM considerations are integrated into routine activities
• Employees remain aware of potential risks and dependencies
• Operational processes are designed with resilience in mind

Examples of Integration

• Incorporating continuity considerations into process design
• Embedding risk checks into operational workflows
• Ensuring that employees regularly engage with BCM practices

When resilience is part of daily operations:

• Disruptions are identified earlier
• Responses are more coordinated
• Recovery is faster and more effective

Embedding Resilience into:

Leadership Behaviours

Leadership behaviour is one of the most powerful drivers of organisational culture.

Leaders influence resilience by:

• Demonstrating commitment to BCM and resilience initiatives
• Participating actively in exercises and scenario testing
• Making timely and transparent decisions during disruptions
• Reinforcing accountability and learning

Leadership as a Cultural Catalyst

• Leaders model the behaviours expected across the organisation
• Their actions signal the importance of resilience
• Their decisions shape how teams respond under pressure

If leadership behaviour is inconsistent or disengaged:

• Employees may deprioritise BCM
• Cultural alignment weakens
• Resilience efforts lose momentum

From Documented Capability to Lived Capability

One of the most significant challenges in BCM is the transition from documented capability to lived capability.

Documented Capability

This refers to:

• Policies, plans, and procedures
• Governance structures
• Compliance with standards and regulations

While necessary, documented capability reflects only an organisation's theoretical readiness.

Lived Capability

Lived capability is demonstrated through:

• Real-time decision-making during disruptions
• Effective coordination across teams
• Confident execution of roles and responsibilities
• Continuous adaptation and learning

It reflects the organisation’s actual ability to respond and recover.

The Role of Culture in Bridging the Gap

Culture enables this transition by:

• Embedding resilience behaviours into everyday activities
• Reinforcing accountability and ownership
• Encouraging collaboration and communication
• Supporting continuous improvement

Without culture, documented capability remains static.  When culture is involved, it becomes dynamic and actionable.

Characteristics of a Culture-Driven Resilient Organisation

Organisations that successfully embed culture into resilience share several characteristics:

• Proactive: Risks are anticipated and addressed early
• Integrated: Resilience is embedded across functions and processes
• Adaptive: The organisation responds effectively to changing conditions
• Collaborative: Teams work together seamlessly during disruptions
• Accountable: Individuals take ownership of their roles in continuity

These characteristics reflect a shift from compliance to capability.

Building the Cultural Foundation for Resilience

To establish culture as the linchpin of resilience, organisations must:

• Align leadership, strategy, and operations around resilience objectives
• Integrate BCM into enterprise-wide frameworks
• Reinforce behaviours through training, exercises, and incentives
• Continuously measure and improve cultural alignment

This requires sustained commitment and a long-term perspective.

Resilience is not achieved through individual frameworks or isolated initiatives. It is the result of a cohesive system in which multiple components work together seamlessly. Culture is the force that enables this cohesion.

By connecting Operational Risk Management, Business Continuity Management, Crisis Management, and Third-Party Risk Management, culture transforms fragmented efforts into an integrated resilience capability.

More importantly, culture bridges the gap between what is documented and what is executed. It ensures that resilience is not just a concept, but a lived reality—embedded in decision-making, daily operations, and leadership behaviour.

As organisations continue to face an increasingly complex risk landscape, those that prioritise culture will be better positioned to move beyond compliance and achieve true, sustainable resilience.