Scroll and you miss it: Is there a risk we are rolling back on resilience?

As Professor Ciaran Martin, former chief executive of the National Cyber Security Centre (NCSC), warned we are “likely” to see more of these events again unless governments and industry work together to “design out” technological flaws.

The Chancellor of the Duchy of Lancaster Pat McFadden recently announced that the government would lead a review of the country’s “national resilience against the range of risks that the UK faces.” The government has also set out plans to introduce a Cybersecurity and Resilience Bill to strengthen the cyber resilience of public bodies such as the Ministry of Defence and NHS.

Outside central government, other bodies are highlighting the need for action on resilience or taking steps to strengthen their approach. The final report by The London Climate Resilience Review suggests that London is ill-prepared for another major surface water flooding event, putting lives and livelihoods at risk. The Financial Conduct Authority published its review of preparations by larger firms to implement the new rules and guidance on operational resilience to “severe but plausible” scenarios. The National Resilience Centre of Excellence opened in July in Merseyside, to prepare firefighters for catastrophic events, using immersive training zones and realistic disaster simulations.

While these risks to the resilience of national infrastructure have been the subject of much debate, the World Economic Forum’s Global Risk Report 2024 ranked social polarisation and misinformation and disinformation as two of the top three risks in the global risk network, with social media presenting a credible risk to social stability. We have seen a clear illustration of this in the riots and unrest up and down the country, with far-right violence, increasing polarisation, and social disorder in the wake of the stabbings in Southport.

To improve the country’s response to all these potentially catastrophic risks, the previous Conservative government published the UK’s Resilience Framework (UKGFR), setting out how they would strengthen the underpinning systems and capabilities that support the nation’s collective resilience. This framework was underpinned by three main principles; a shared understanding of the risks we face; resilience as a “whole of society” endeavour and prevention rather than cure wherever possible. With the Framework currently setting out plans to 2030, the question is how the current government plans and accelerates the UK’s national resilience.

The scale of the challenge facing any government is huge. The National Risk Register published in 2023 lists 89 acute risks, defined as those that could have a substantial impact on the UK’s safety, security and/or critical systems at a national level. These risks cover threats from terrorism, cyber, accidents and systems failures, to natural and environmental hazards, human, animal and plant health, as well as conflict and instability. It also lists four risks it characterises at ‘chronic’, these are long-term challenges that could gradually impact our economy, community, way of life, and/or national security. These are climate change, anti-microbial resistance, serious and organised crime and AI systems and their capabilities.

The new government is well aware of these risks and its manifesto sets out the need to prepare for both current crises and those that could hit us in ways we cannot fully yet anticipate. It also highlighted the importance of financial resilience in the economy and households through its theme of ‘securonomics,’ and its focus on the need for strong supply chains. There were also references to climate resilience and tackling natural emergencies, particularly the risk the UK faces from flooding and coastal erosion. The approach it set out was to deal with these challenges through risk management and a joined-up approach across central government, local authorities, local communities and emergency services.

It will undoubtedly be hard for new ministers to avoid feeling daunted by the scale of the task. But we do have strategies, approaches, and frameworks to mitigate and prevent the harms these risks pose materialising. What is needed now is to translate the intention into action and implement strategies that will make an impact. That will require government to address a number of challenges.

The first challenge is to join the dots between policy and delivery. The government needs to facilitate the whole system delivery of resilience by engaging with all levels of the system from central government to local government, business and communities. The traditionally top-down approach needs to empower bottom-up activities to deliver their aspiration for whole of society resilience. Leaving these organisations out has too often led to a separation between those responsible for designing policy and those responsible for delivering it. When this happens, there is a risk that the policy overlooks the practical implications or the needs of specific communities.

The second challenge lies in shifting the culture from responsive to strategic. In the past, action has often been in response to issues as they come to a head, with those responsible for resilience spending their time firefighting issues and crises, and then lacking the resources or capacity to review the problem at a systems level. The underlying problems facing the nation and stresses they place on our society require that capacity and capability is dedicated to engaging with these existential risks and thinking strategically about how they can be addressed.

The third challenge is the lack of funding available in the public purse. Labour have set out clear spending restrictions both during and since their election, most recently with Rachel Reeves referring to a ‘black hole’ in the country’s finances. Resilience currently does not form part of the Treasury's Green Book Business Case and there will be strong competition for funding. That makes it critical that there is clear communication with government stakeholders and the public about the value of investing in resilience.

This may be helped by Labour’s commitment to providing greater financial security to local authorities by giving councils multi-year funding settlements. The manifesto pledges to provide capacity and support councils, giving them greater devolved responsibilities for decisions that affect their communities will also potentially support a focus on resilience.

It is also critical to express the value of action to build resilience in financial terms and highlighting the role resilience plays in delivering economic growth. Whilst the National Risk Register and Framework is a powerful tool, it can at times feel abstract to decision makers. Identifying where departments’ priority policy commitments are impacted by resilience considerations can begin to demonstrate why investment is important. For example, cyber-attacks and the disruption these cause results in negative impacts to economic growth, with the mistake that caused the IT outage a few weeks ago predicted to have had a $1 billion impact on the global economy. Moreover, highlighting that investment of this kind increases stability and certainty signals its importance to the private sector, another measure of its strategic value.

PA Consulting’s “Six Dividends of Resilience” model is one way to quantify the “total value” of investing in resilience by taking into account all types of value including economic, social and environment. This model helps capture the value the investment creates immediately as well as if a crisis occurs. It considers the benefits of investing in risk reduction measures, but also the acknowledges the benefits of investing in tackling chronic risks (stresses) that exacerbate the impact of crises but which are also often the main day-to-day concerns facing citizens. For example, investing in a green flood defence would provide job creation, as well as health benefits associated with more green space and social benefits of community outdoor space. This translates into economic benefits and productivity benefits that can be measured now along with the long term benefits of reduced damage and displacement cause by the flood itself. This routinely demonstrates a 5-10 fold increase in the benefit of investing in resilience.

Additionally, we quantify the benefit in investing in “adaptive capacity” – the ability to adapt to change. During a crisis this manifests in good leadership, alignment, collaboration, and decision making but also the ability to learn afterwards, innovate and problem solve to continually improve. This culminates in reducing the potential impact of an emergency by anticipating, adapting and acting quickly and resourcefully and acting upon lessons learned to build back better next time. This benefit can be quantified in the reduced impact of a crisis. In normal times, the benefit can be measured through increased opportunities, less friction and positive investment in the community due to this improved leadership, cohesion and better management of resources. Armed with this information, a compelling business case for public spending is easier to make by showing the benefits that resilience can deliver to support thriving communities including improved wellbeing and improved economic outcomes.

Labour's stated approach to doing government will also lend itself to the whole system approach that is required to tackle this challenge. The idea of a 'mission led' government, which focuses on long-term issues measured by their goals rather than the means through which they are achieved, can support work on resilience. In particular the commitment to tackling challenges not through a single individual or department or authority, but collectively by agencies across government and society, is central to building resilience. To do this effectively will need a joined-up whole-system approach that breaks down silos. This should connect government, business and communities around a common shared vision and facilitate cross-sector dialogue to help deliver this. The question will be what infrastructure and resources will be dedicated to connecting central government, local authorities, communities, regulators, and the emergency services; what actions will they take to join existing top-down and bottom-up approaches to resilience?

This whole system approach can deliver the aspiration of “whole society resilience” provided resilient leadership is fostered at all levels of the system; and extends beyond Whitehall, to leaders within other government agencies, local authorities, the private sector, and local communities. Empowering and informing leaders across the nation is crucial, something that was recognised in the UKGFR when it called for expansion of the roles of Local Resilience Forums (LRFS) with the appointment of a Chief Resilience Officer (CRO) for each region.

To carry out these crucial roles successfully, CROs must be equipped with the right skills and capabilities. These are broader than those needed for traditional crisis response. To tackle resilience issues productively, leaders must act proactively and have the ability to empower those who lead within their communities and act as the crucial coordinator between LRF and local community resilience building initiatives. The ability to build trust, credibility, consensus, and capacity across a wide variety of systems and with a diverse range of individuals and communities is vital. Leaders themselves must be resilient, be able to lead in adverse circumstances, and adept at adapting to change and challenge.

These leaders need to develop practical strategies that communities can understand and want to engage in. Traditionally, communication tends to be top-down - telling people about the national risks, but this is not compelling until individuals experience the impact. Developing a shared understanding of resilience and its benefits should focus on the needs, issues and opportunities of each community. In Rochdale, Greater Manchester community leaders are organising themselves to help each other. For example, a local allotment was developed on an unused site where residents are encouraged to come together and meet others, enjoy nature and “grow a row” for themselves and to “give a row” to local food banks – delivering resilience on so many levels that is not typically measured. This community passion needs to be harnessed. When asked, Rochdale community leaders talked about the need to provide “scaffolding” not “bureaucracy”, to harness local knowledge and understanding, to devolve central funding to communities to “democratise power” and to develop local “resilient leaders” that can empower others.

Whilst there must be plans to build resilience to specific risks, resilience is also about being prepared for the unexpected; being able to adapt to uncertainty, embrace complexity and being comfortable dealing with the increasing volatility and ambiguity of our interconnected world, so whilst it is tempting to focus on the national risk register, equal attention should be spent to delivering our collective “adaptive capacity” and talking to the role resilience plays in delivering our strategic goals of growth and productivity.

The full picture of the actions the new government will take to tackle resilience is still emerging. But what is clear is that there are intentions and structures that can be harnessed to drive effective change. By employing a whole system view, articulating the total value that resilience delivers and providing the leadership to empower everyone to play their part, we could see a significant improvement in our national resilience and national growth.

This article was first published in Crisis Response Journal.