Analysis | The Resilience Industrial Complex Strays from Reality

One of the UK government’s last acts before Christmas was to announce a UK Resilience Academy, as a part of new 64-page strategy document on, yes, national resilience. The Resilience Framework includes a new Head of Resilience, an annual statement to parliament on risk and resilience performance, expert advisory groups, local resilience forums and public surveys to make sure the perception reflects the effort. The goal is to “anticipate, assess, prevent, mitigate, respond to, and recover from known, unknown, direct indirect and emerging civil contingency risks.”

It would be churlish to dismiss these efforts as either performative or futile in a world with bigger risks than sabre-tooths. You want your company’s cyber defenses to withstand the latest ransomware attack. You want pilots trained to deal with wild weather and kids who aren’t so sheltered from failure that they crumble at the first sign of a B grade. You want your government ready for flooding, wars and cataclysm.

But the problem with the Resilience Industrial Complex is that like a lot of buzz words (“sustainability” is another that comes to mind), it has become a label that can be attached to almost anything. Resilience is not about bolt-ons but real tradeoffs that are too often obscured.

On paper, the UK is next-level when it comes to resilience planning. It has a Net Zero Strategy and an Energy Security Strategy. There’s a Supply Chain Resilience Framework and a National Security Risk Assessment (NSRA) tool. A National Exercise Programme (NEP) exists to test emergency procedures. The Treasury maintains an Orange Book to help the government manage technological, economic, legal and other risks. There’s an Integrated Review to address state threats in an interconnected world. Scotland has its own resilience hub. For those wanting to geek out on resilience planning, the government keeps a National Risks Register that plots the probability of a risk happening relative to its likely damage.

Attentive observers will note that even with such wall-to-wall resilience strategies in place, there have been misses. Industrial action and volcanic eruptions were considered more likely than a pandemic in the 2020 risk register. There was indeed a pandemic plan: Four years before Covid-19 arrived, the UK government was advised to stockpile personal protective equipment and set up a contact-tracing system to activate in the event of a coronavirus outbreak. But the plan envisaged a flu-like bug, not something deadlier, and the government decided those resources were better spent elsewhere.

Mispricing risk happens more than we think. The 2021 Integrated Review of defence and foreign policy, with its “Indo-Pacific tilt” is now being rewritten in light of Vladimir Putin’s invasion of Ukraine. And even with foresight, governments don’t always act. A committee in the House of Lords — another arrow in the UK’s resilience quiver — warned eight months before the withdrawal from Afghanistan that the US policy would lead to disastrous consequences for the country.

The most resilient companies have the leadership and financial health to pivot if necessary. If they have resilience strategies (and all big companies do), there are also regular audits of the plans. Of course, there’s a whole industry to tell CEOs exactly how to do that. McKinsey’s output on the subject is itself a resilience test. Sure, high performers adopt “agile” processes and practice “deliberate calm.” But they mainly do the day-to-day stuff very well. Governments should too. 

The ultimate planners are the Swiss, with their nuclear bunkers complete with composting toilets. (That somehow seems less eccentric these days.) But resilience planning in government is above all a political choice. It involves the allocation of precious resources, including attention. Unfortunately, the political rewards of averting a potential crisis are often negligible, so that attention is often missing. Without high-level responsibility and regular audits, politics or bureaucratic inertia tends to trump such plans.

The new UK framework suggests an earnest effort but not necessarily a sense of urgency. Government will make communications on risk “more relevant and easily accessible” by — wait for it — 2030. No senior cabinet official has been put in charge. Only by 2025 will government “clarify rules and responsibility” for each risk and “introduce an annual statement to parliament,” the document says. If Prime Minister Rishi Sunak wants to own the strategy, he should put his imprimatur on it. 

Real resilience, though, comes from getting the basics right. South Africa’s daily blackouts aren’t a lack of resilience planning; they are the result of appalling levels of mismanagement. The crisis in Britain’s emergency services stems in part from a failure to fix its poorly funded social care system. 

Similarly, the biggest threats facing Britain are in plain sight: anemic economic growth, low rates of savings and investment, unreliable public services, and regional inequities that feed resentments. It’s sensible to plan for future emergencies. But a grand strategy can too often provide a false sense of security and the mistaken impression that the biggest threats are far away. 

More From Bloomberg Opinion:

• Why I’d Pick the UK Pension Over France’s: Merryn Somerset Webb

• Burberry and Cartier Need Chinese Shoppers to Start Spending: Andrea Felsted

• Jacinda Ardern Gives the World a Lesson in Humility: Andreea Papuc

This column does not necessarily reflect the opinion of the editorial board or Bloomberg LP and its owners.

Therese Raphael is a columnist for Bloomberg Opinion covering health care and British politics. Previously, she was editorial page editor of the Wall Street Journal Europe.

More stories like this are available on bloomberg.com/opinion