Who is Asking the Resilience Question at Your Board Table?

Here is a question for anyone sitting around a board table: if someone asked you right now how resilient your organisation is, what would you say?

Not how good your health and safety record is. Not whether the budget is tracking. Not whether your AI strategy is working. How resilient you are. How confident are you that your organisation could absorb a serious disruption and keep delivering the things that matter?

Many board members pause at this point. Not because they don’t care, but because nobody has ever put the question to them in those terms. Or at least not recently, post the Covid era.

Boards are generally pretty good at the things they can measure. Financial oversight has structure, rhythm, and professional support. Health and safety reporting has board focus, helped by legislation that carries consequences for governors of getting it wrong. Cyber security and AI, though harder to measure, are too significant to ignore.

But resilience? In many organisations, it sits somewhere between the risk register and the facilities manager’s inbox. It rarely appears on the board agenda, unless something has just gone wrong. And when it does appear, it tends to arrive as a reassuring line in a risk report: “business continuity plan in place”, but no independent evidence to support it.

This “green tick” on the risk register is doing a lot of heavy lifting. It tells the board a plan exists. It does not tell them whether anyone has read it, whether it reflects how the organisation actually operates today, whether the contact details in it still work or whether the people named know what they are supposed to do. It certainly does not tell them whether the plan has ever been tested under realistic conditions.

The uncomfortable truth is many boards have not asked the question about resilience and do not have independent validation about the state of it in their organisation.

In other domains of governance including financial, legal and regulatory, boards insist on independent assurance. In resilience, many take management’s word for it. And management, in most cases, is telling them what they genuinely believe to be true. The problem is that belief and evidence are not the same thing.

This matters because when something does go wrong and in New Zealand, the board will be asked what it knew, what it asked, and what assurance it had. “We were told a plan was in place” is not a strong answer.

None of this is about blame. Most boards are stretched and already dealing with a long list of competing priorities. Resilience has not traditionally been framed as a governance question. It has been framed as an operational one, something management handles.

And this is the problem. Because every other operational risk that can seriously damage an organisation has found its way onto the board agenda. Resilience has not yet made that journey in many organisations.

The good news is that it is not complicated to fix. An independent resilience assessment gives a board something it currently lacks: an honest, evidence-based picture of the organisation’s actual capability, scored against a structured framework, with a clear view of priority actions. Not a replacement for management’s judgement, but a check on it.

If you sit on a board and you have never seen an independent assessment of your organisation’s resilience, it might be worth asking why. And if the answer makes you uncomfortable, we are happy to have a conversation about what a practical next step looks like.