We live in challenging times. Terrorist attacks in New York, Madrid and London, the Asian tsunami, wild hurricanes and cyclones have created a new challenge for organisations. Suddenly, the unthinkable is possible. These events are a warning. Organisations need to know not only how they will get through it but how they will bounce back. And that's a big ask.

Massachusetts Institute of Technology's Professor Yossi Sheffi argues that risk management is done in too fragmented a way, from business continuity, to IT to security.

Let's not kid ourselves. This kind of fragmentation is deadly. It can have a real and human cost. At a corporate level, it's a microscosm of the dysfunction that resulted in the US Government's disgraceful handling of hurricane katrina and the failure of security agencies highlighted in the 9/11 Commission Report.

Sheffi maintains that organisations need to integrate and pull it all together. Risk needs to be incorporated into strategy, and not kept as a separate add on that's left lying around in case something goes wrong.

He explains more in this provocative Q&A with the Booz Allen Hamilton journal Business+Strategy. Resilient companies, he says, have an in-built flexibility. They are also obsessive about communication and empowerment.

"Every Dell manager gets a production report of what's happening throughout the company every two hours," Sheffi says. "They get it on their PDA or pager - so they're always in the know.
"Another important principle of resilience is "Drive the power to make decisions down in the organization." Most people are familiar with the way Toyota empowers production-line employees to pull the andon cord and stop the line if they spot a quality problem. Zara and World - two retailers based in Spain and Japan, respectively - are unbelievably good at empowering line employees. In both companies, the store managers collect information every night, not only about what is selling and not selling, but about why it is not selling. They interview customers. "Why don't you buy this shirt?" "Can you please tell me what's wrong with this blouse?" They get all this information and report it every night to headquarters. Computers sift through this information and try to find out if there's a certain trend."

All this makes sense. A resilient company is by definition flexible because it's the flexibility that allows it to respond to challenges from the market place. Similarly, if everyone is empowered and in the loop, it means risk management becomes everyone's business.