The Resilient Company: Withstanding Crises Before They Happen

Pandemic, broken supply chains, an energy crisis, cyberattacks, large-scale power outages: the crises of the past five years have shown that stability is not a state a company reaches once and then keeps. In my book "Organizational Resilience in Action" (Springer 2025; first published in German as "Das resiliente Unternehmen," Springer 2022), I make a simple argument: whether a company withstands a crisis is decided not during the crisis but before it. This article explains what distinguishes resilience from mere robustness, how the Winning Wheel organizes the fields of action, how to recognize resilient organizations, and how a resilience dashboard keeps leadership capable of acting.

Crises have become the normal case

When I wrote the book, the COVID-19 pandemic was in the foreground; the six-day blockage of the Suez Canal by a single container ship in March 2021 had just shown how vulnerable global supply chains are. Since then, the list of events has grown longer without a single entry being removed from it: in February 2022, the war of aggression against Ukraine began, and with it an energy crisis that upended production planning across Europe. On July 19, 2024, a faulty update to a security software product took down around 8.5 million Windows devices worldwide, according to figures published by Microsoft on July 20, 2024; airports, hospitals, and banks came to a standstill without anyone having attacked them. On April 28, 2025, the Iberian Peninsula lost power for hours.

These events have little in common except one thing: they came as a surprise to most of those affected, although none of them was unthinkable. That is precisely the point. The question is no longer whether a company will be hit by a crisis, but when, by which one, and how well prepared it is. Legislators have already adopted this insight: the financial sector has been subject to Regulation (EU) 2022/2554 on digital operational resilience (DORA) since January 17, 2025, and the NIS 2 Directive (EU) 2022/2555 extends comparable risk management obligations for network and information systems to many other industries, even though its transposition into German law is still pending. For many companies, resilience is thus no longer just a leadership question but also an obligation to provide evidence.

Resilience is more than the ability to withstand

The term is often equated with robustness: thick walls, high inventories, a second data center. That is part of the answer, but only part. A robust company withstands a known load; a resilient company also copes with loads it did not foresee and emerges from them stronger. In the book, I therefore describe resilience as the interplay of four capabilities that build on one another:

• Anticipate. Recognize early indicators, think through scenarios, and assess risks before they turn into a crisis.
• Withstand. Structures, processes, and systems that keep working under pressure, with redundancy wherever failure would be critical.
• Adapt. Fast decisions, a flexible organization, and a software base that carries change instead of blocking it.
• Learn. Evaluate every crisis systematically and feed the lessons back into strategy, organization, and technology.

The order is no accident. Those who do not anticipate cannot withstand in a targeted way; those who do not withstand have no time to adapt; those who do not adapt have nothing to learn from. And those who do not learn start from scratch at the next crisis.

Resilience is not decided in the crisis but before it. Those who build the right structures today will master the crises of tomorrow.

The reason is practical, not philosophical. During a crisis, the room for maneuver is at its smallest: information is patchy, time is short, and every decision draws on what was built beforehand. A company that knows its dependencies on suppliers, vendors, and individual knowledge holders can change course within hours. A company that discovers these dependencies only in an emergency spends the first days of the crisis understanding its own business.

The Winning Wheel: resilience as part of corporate management

Resilience cannot be delegated to a department. In the book, I therefore position corporate resilience as part of the Winning Wheel, an organizing framework for corporate management; the book's first case study shows how it can be used to evaluate interviews with executives. Within it, resilience is not a department of its own but a cross-cutting concern that runs through all fields of action. Four of these fields are decisive for building resilience, and the four capabilities apply in each of them:

• Strategy. Which events can hit the business model, and which answers are prepared? Resilient companies run scenarios not as an exercise in the strategy workshop but as part of their planning.
• Organization and culture. Who decides when the regular hierarchy is too slow? Clear responsibility, short decision paths, and a culture that treats change as the normal case make a company agile in everyday business and capable of acting in a crisis.
• Processes. Which workflows must keep running under all circumstances, and is there a proven fallback for them? Not every process needs an emergency mode, but the critical ones need one that has been tested.
• Software base. Core systems, interfaces, and dependencies on vendors and service providers decide whether a company stays capable of acting when it matters. A transparent, well-governed software base is the prerequisite for responding quickly.

The image of the wheel is deliberate. A wheel bears weight only when all its spokes do; one weak spoke makes the whole wheel wobble. And a wheel does not stand still: the capabilities to anticipate, withstand, adapt, and learn form a cycle that starts again after every disruption. Resilience is therefore not a project with an end date but a leadership routine.

From my consulting practice, I know which field of action is most often underestimated: the software base. Strategies are revised, crisis teams are appointed, suppliers are diversified. At the same time, central workflows depend on systems that no one fully understands anymore, on interfaces that only a single employee knows, and on vendors whose roadmap the company cannot influence. The outage of July 2024 showed how short the path is from a supplier's update to the standstill of entire industries. Those who do not know their software base do not know their vulnerability.

How to recognize resilient organizations

The book devotes a chapter of its own to the indicators of resilient organizations; from them, it derives the measures that build resilience and the resilience testing procedure for assessing where a company stands. The second case study applies it to a financial service provider, an industry that is by now also obliged by regulation to be resilient. Conversations with boards, managing directors, and IT leaders that I have had since the book was published have brought out six hallmarks that are particularly telling and that distinguish resilient organizations from those that keep resilience only in their mission statement. They can be read as a checklist:

1. They know their vulnerability. They know which events can hit their business model, which suppliers, systems, and people cannot be replaced, and where a single failure triggers a chain reaction.
2. They have answers ready before they are needed. For the most important scenarios, measures are in place that do not have to be invented during the crisis.
3. They decide quickly and traceably. It is clear who decides in an emergency, with which information and within what time frame, and this path has been rehearsed.
4. They govern their software base. Core systems are documented, interfaces and dependencies are known, and the company can change its systems without relying on a single vendor or a single person.
5. They treat change as the normal case. Adaptation is not an exception that requires a crisis team but part of everyday business.
6. They learn in an institutionalized way. Every disruption is evaluated, and the lessons flow back into strategy, organization, and technology, with owners and deadlines.

Strikingly, none of these hallmarks requires money first. Inventories and redundancies cost; transparency, clear responsibility, and learning routines cost above all the attention of leadership. That is good news for mid-sized companies that cannot afford a second factory but can very well afford the discipline of knowing their dependencies.

The resilience dashboard: leadership needs visibility

What is not measured is not managed. That is why I propose a resilience dashboard in the book and show in the third case study how it can be implemented with standard software: a compact view for leadership that shows, for each field of action, where the company stands, where it is improving, and where it is slipping. The dashboard does not replace risk analysis or business continuity management; it makes their results visible and comparable for the leadership team.

Three principles have proven themselves. First: leading indicators before lagging indicators. The number of outages last year says little about how well the company is prepared for the next one; the number of critical processes with a tested emergency mode says a lot. Second: a few metrics with clear ownership rather than a hundred metrics no one reads. Third: the dashboard belongs in the regular leadership routine, not in the annual report. Examples of guiding questions and indicators as we develop them with our clients:

The value lies less in the individual figures than in the regularity. A leadership team that looks at the same indicators every quarter notices gradual deterioration before it becomes an event: the interface that no one has maintained since a colleague left; the supplier that has quietly become the only one; the emergency plan that has not been rehearsed for three years.

Resilience and the self-driving company

Resilience does not stand alone. In his book "The Self-Driving Company" (Springer 2023; German original "Das selbstfahrende Unternehmen," Springer Gabler 2021), Florian Schnitzhofer introduces it as one of four dimensions alongside autonomy, sustainability, and humanity. My book takes this target picture as its starting point: when decisions are increasingly made by software algorithms rather than by people, the question is whether we can trust such companies, and the answer depends on their resilience. The connection is close: a company that increasingly leaves its workflows to software is exactly as resilient as that software. Real-time data and simulations help with anticipating, automated workflows with withstanding; at the same time, the software base itself becomes the greatest risk if it is not transparent and well governed. The four capabilities of the resilient company are therefore not a preliminary stage on the way to the self-driving company but its precondition.

At ReqPOOL, we analyze neutrally and independently of vendors how crisis-proof a company's strategy, organization, and software base are, and we accompany the path to a resilient, self-driving organization. The English edition, "Organizational Resilience in Action" (Springer 2025), was published this spring; the questions in it have not changed since 2022, but the urgency has.

The next step

You will find an overview of the book, its dimensions, and the collaboration model on the page About the book. If you would like to know where your company stands in the Winning Wheel and which field of action needs attention first, book an expert meeting: we will go through the hallmarks together and sketch a first resilience dashboard for your leadership team.