Resilience in Action: Understanding the Critical Pathways
Performing under pressure while maintaining critical services is what separates organisations that emerge stronger from a crisis from those that simply emerge. The work is operational, financial and human in equal measure - and almost always done before the crisis begins.
The international standard for organisational resilience, ISO 22316, defines a resilient organisation as having the ability to absorb and adapt in a changing environment. The definition is deliberately broad – but the practice is not. When looking at best practice, resilient organisations do five things consistently, and they do them as a connected cycle.
First, they anticipate, through horizon scanning and a working understanding of emerging and evolving risks. They then assess, prioritising the exposures that matter most and directing controls and resources accordingly. They also prevent, through controls, governance and appropriately structured insurance. And they prepare, through business continuity management and scenario planning - activities that are rehearsed often enough to be remembered under pressure. Additionally, they respond and recover, with practised response teams and pre-thought recovery strategies for worst-case scenarios. The five do not (and should not) work in isolation.
Why some organisations stall, and others maintain momentum
The single most reliable predictor of how an organisation performs through a crisis is the alignment it has built before the crisis arrives. Misalignment exacerbates a crisis: each function works to its own picture of what is happening, decisions are slowed by reconciliation, and the organisation finds itself negotiating with itself while it is meant to be responding to the event. Organisations that maintain momentum are aligned internally and externally throughout, and that alignment is the product of work done in calmer conditions.
The financial signature of that alignment is visible in market data. The widely cited study of fifteen major corporate catastrophes by Knight and Pretty found that affected firms divided into two distinct groups. One group absorbed an initial loss of shareholder value of around 5% but then went on to trade at around 5% above its pre-event value by the 50th day of trading after the event. The other absorbed an initial loss of around 11% and was still carrying a cumulative shortfall approaching 15% a year on. The same event, two outcomes, and the difference traced back to how the organisations were run before it happened.
Three factors do most of the work. The first is committed leadership: a small group of senior people, used to working together, willing to commit early and adjust as the picture clarifies. The second is cross-business alignment: a single, shared map of who decides what, on what timeline, on whose information, so that operations, finance, risk and communications are reading the same event. The third is the right people in the room: technical, financial, regulatory and operational expertise close enough to the decision-making to inform it in real time.
Decision making under pressure
A crisis compresses decision-making. Organisations have to commit on limited or incomplete information, often before the shape of the event is fully understood, and the cost of waiting for clean data is usually higher than the cost of deciding under uncertainty. This is the operational reason alignment matters so much. An aligned team can absorb the missing information, draw on the experience already in the room, and move; an unaligned team spends the same minutes establishing whose view is correct.
The companion article in this series, on the age of persistent disruption, sets out why the environment now produces these compressed conditions more often: events arrive in months rather than years, they overlap, and they no longer obey borders. Decision-making capability is therefore not a once-a-cycle test. It is an operating discipline, and like any discipline, it is built through repetition. Tabletop exercises, rehearsed escalation routes, clear delegated authorities and an established rhythm of cross-functional review are how it is kept active between events.
Operational resilience and maintaining critical services
Understanding exposures is the starting point: identifying the potential disruptions, the channels through which they would reach the business, and the appropriate mitigations. Some of those mitigations are insurance; many of them are not. Operational redesign, supplier diversification, contractual protections, system architecture, governance changes and workforce planning typically carry more weight in the resilience story than the cover itself.
Critical service identification is the discipline that holds it together. A Business Impact Analysis is the structured exercise an organisation uses to work out which product and services have to keep running, in what minimum form, over what time horizon, and what they depend on to do so. The exercise considers all aspects of the operation, including people, systems, equipment, buildings and other physical assets and the third-party providers whose own continuity is a precondition for the organisation’s. It is then reviewed at a cadence that matches how quickly the environment changes, which today is more often than it used to be.
Plans built on that analysis need built-in flexibility and redundancy. Historic crises consistently show that even the best documented plans cannot account for every scenario; the value of the plan is in the discipline and the relationships it creates, more than in the script. Strong, coordinated leadership and the agility to depart from the script when the event requires it are what convert the planning work into a continuous service through the disruption.
A multifaceted approach
Resilience is operational, financial, human, technological and reputational, and the organisations that perform through pressure are the ones that have built those dimensions into a single connected discipline rather than five separate ones. Subsequent articles in this series examine how that discipline is built across the lines that matter most in the current environment: operational, financial, and people. Each is a chapter of the same story, and each is the work of getting ready before the next disruption arrives.
© 2026 Lockton Companies. All rights reserved.
Disclaimer
The steps, considerations, and recommendations outlined in this guidance are provided for general information purposes only and reflect Lockton’s observations and professional views based on current market conditions. They are not guaranteed to be effective in preventing, mitigating, or managing risks, nor are they intended to replace an organisation’s own risk management frameworks, crisis‑management processes, internal controls, contingency planning, or independent professional advice tailored to its specific circumstances.
These recommendations and this guidance do not represent, imply, or create any requirement or assurance that insurers will accept coverage, honor claims, or provide any particular claim outcome. Insurance policy responses depend on the specific facts of each event, the terms and conditions of the relevant policy, and insurers’ independent assessment and decision making. Nothing in this guidance should be interpreted as guaranteeing coverage, confirming policy responses, or ensuring that any claim will be paid.