The Age of Persistent Disruption
Disruption used to behave like the weather: bad spells came in, the business battened down, and the spell passed. That assumption has been challenged by a succession of interconnected geopolitical and economic events, and the environment most organisations operate in has been upended.
A New Operating Reality
Three things have changed about how disruption arrives.
The first is its frequency: where boards once expected two or three significant shocks in a strategic cycle, they now see them in months.
The second is its persistence. COVID did not really end; it left behind labour-market shifts and supply patterns that businesses are still managing.
The third change is that disruption no longer obeys borders. A regional conflict in the Gulf reshapes shipping insurance in Singapore. A cyber incident at a single supplier reaches hundreds of customer balance sheets at once.
The implication for boards is significant. The metric that was used to define a good crisis response, speed of return to a previous state, has been displaced. That previous state no longer exists by the time the response is over. What matters now is the ability to keep delivering while conditions are still in motion.
What readiness really means
Part of the current challenge is that readiness and resilience are used interchangeably, but they are very different things. Readiness is the work an organisation does before a disruption arrives: mapping where it is exposed, deciding what has to be protected first, and agreeing who makes which call. It can be entirely conceptual, written down in a policy document, and untested. Resilience is what happens when that work meets the disruption. It is observable, measurable and, for most businesses, the thing boards, investors and regulators are scoring.
Readiness is only valuable to the extent that it survives contact with the operating environment. A continuity plan that has never been moved through end-to-end is a planning document, not a capability. An exposure map updated once a year is a snapshot, not an instrument, which is why embedding readiness into the way the business runs day-to-day is what closes the distance between the two.
Lessons learned from recent crises
Resilience itself has been significantly challenged over the last five years, and nowhere more visibly than in the Middle East. The businesses that came through recent disruptions in reasonable shape were those that had treated readiness as an operating discipline well before the disruption arrived. The businesses that struggled had treated it as a document, held in reserve for the day it was needed.
Where Readiness Breaks Down
The failure that most boards encounter is the unknown risk: the scenario nobody modelled. In practice, that is rarely what catches an organisation out - it is the distance between the disruption it had planned for and the version that arrives. A supply chain contingency plan built around alternate suppliers fails when all those suppliers are affected by the same regional disruption. A cyber response plan written for ransomware does not transfer cleanly to a state-aligned attack that destroys the same backups it would otherwise restore from. Of course, the exposures on paper were the right ones, but the shape of the event was different.
Those mismatches sit at the seam between three workstreams: operations, finance, and risk. Operations has assumed a recovery time that the insurance was not written to support. Finance has modelled a loss profile that it does not cover. The programme itself has been sized against last year’s loss patterns, when the patterns that are now in play are different. Closing that triangle, before the next disruption, is the work that converts readiness on paper into resilience in practice.
The Role of Risk and Insurance
Looking at the role of insurance, the conventional model of corporate insurance has often been procurement-led: cover is sized once a year against the previous year’s loss profile and largely left alone until renewal. That model has stopped fitting the environment. Cover, the scenario library and the operating plan are interdependent instruments, updated together as the picture changes. Continuous exposure mapping, scenario rehearsal and structured insurance solutions support decisions in real time, well before any claim is crystallised. Clyde & Co’s recent note on Middle East operational resilience (opens a new window) makes the same point from the legal side: IT, data governance, third-party contracts and business continuity belong in a single integrated review.
How to Pressure Test
Volatility is no longer the exception in the operating environment; it is the environment. Readiness enables resilience. Resilience protects performance. Together, they create an advantage. The organisations that bake those capabilities into the way they run (instead of treating them as a parallel governance exercise) will grow through the next phase of disruption.
An insurance broker and risk consultant's role is to pressure-test where an organisation sits across each capability, identify the exposures the external environment has created, align the cover, and prepare an operating plan against the disruption most likely to come next.