Resilience is everyone’s responsibility and therefore sometimes no one’s

27 October 2026

In a previous article, we discussed the idea that many risks to essential services often originate outside an organisation’s own boundaries. Suppliers, outsourced processes, energy providers, digital infrastructure and other partners throughout the value chain all play a crucial role in the delivery of vital services. For many organisations, this insight is not new. Critical processes, suppliers and dependencies have often already been identified. The question, however, is whether this insight actually translates into greater resilience.

Understanding dependencies Is not the same as managing them

Many organisations have analyses, risk registers and overviews of critical suppliers and processes in place. These provide valuable insight into the factors that are essential for the continuity of services. But what happens next with that information?

In practice, we regularly see that dependencies are well understood, yet concrete decisions remain absent. Is a supplier truly replaceable? Are contingency arrangements genuinely available? Which facilities can tolerate an outage of several hours and which cannot? And how much risk is an organisation actually willing to accept?

Resilience requires ownership

Almost every organisation has multiple functions that contribute to resilience. Procurement manages supplier relationships. IT oversees system availability. Risk Management monitors risks. Security focuses on threats and vulnerabilities. Business Continuity develops scenarios and recovery measures. In short, everyone contributes.

At the same time, this creates a challenge. When responsibilities are spread across multiple departments, it can become unclear who is ultimately in charge. Who makes the final trade-off between costs and resilience? Which measures receive priority? And who takes responsibility when the continuity of an essential service comes under pressure?

This is precisely why resilience is not only about risks and controls, but also about governance. Clear responsibilities, effective decision-making and explicit ownership are often just as important as the measures themselves.

From supplier management to supply chain resilience

Traditionally, organisations have focused heavily on managing individual suppliers. Contracts are reviewed, performance is monitored and agreements are documented. However, today’s challenges require a broader perspective.

Organisations operate within increasingly complex ecosystems where interdependencies continue to grow. Service continuity is determined not only by the relationship with a single supplier, but by the resilience of the entire network in which organisations operate.

As a result, the focus is shifting from supplier management to supply chain resilience. How well do organisations understand each other’s dependencies? How are disruptions managed collectively? And how do organisations collaborate when multiple parties are affected simultaneously by the same event?

What can critical sectors learn from each other?

Although sectors fulfil different societal responsibilities, they often face similar challenges. How do you establish ownership for resilience? How do you manage dependencies over which you have limited influence? And how do you ensure that risk assessments lead to tangible actions? This is precisely why looking beyond the boundaries of your own sector can be valuable.

Water utilities, energy providers, healthcare organisations and other essential service providers are all developing their own approaches. These approaches often contain lessons that are relevant to other sectors as well. Not because the risks are identical, but because the underlying dilemmas are remarkably similar.