In boardrooms across Ireland, resilience is a serious strategic concern. Risk registers are fuller than ever. Crisis playbooks are polished. Scenario plans are documented. Governance structures are in place and audits are clean. On paper, many organisations look well prepared for disruption.
And yet, when disruption actually hits, many still falter.
This challenge is only intensifying. The World Economic Forum’s Global Risks Report 2025 found that leaders are navigating a more fractured environment shaped by state-based conflict, extreme weather, misinformation and wider geopolitical instability.
In a recent IMI mini masterclass, strategy and resilience expert Professor David Denyer of Cranfield School of Management posed a difficult question: if risk and resilience toolkits are working, why do organisations keep being surprised?
It is an uncomfortable question because it points to an uncomfortable truth. Many organisations are not truly resilient. They are performing resilience. They have the appearance of preparedness without the underlying capability to respond when conditions turn ugly. We may call it resilience theatre: the production of plans, frameworks and artefacts that signal control but do not necessarily translate into coherent action under pressure.
Put simply, resilience theatre is what happens when an organisation is optimised for planning rather than responding.
Risk vs Resilience
Professor Denyer drew an important distinction between risk management and resilience. Risk management asks what could go wrong. It leads naturally to lists, controls and mitigations. Resilience asks a different question: what must go right?
That is a much harder and more demanding lens. It forces leaders to identify essential outcomes, protect critical capabilities and maintain coherence under stress.
When Plans Meet Reality
The issue is rarely a total absence of planning. More often, it is the failure to convert planning into coordinated action: decision-making slows, functions retreat into silos, leaders default to centralised control, and meetings multiply without delivering genuine clarity.
As with an earthquake, the most dangerous moment in a disruption is often not the initial shock itself but the coordination failure that follows. Risk registers can identify categories of threat, but they cannot guarantee that teams will align quickly on priorities, make explicit trade-offs under uncertainty or adapt execution as events evolve.
But this is also why resilience theatre is so seductive: it feels productive, satisfies governance expectations and gives boards something tangible to review.
Operating in a World of Tensions
Efficiency must coexist with adaptability. Compliance must coexist with innovation. Stability must coexist with change. Many organisations are designed to simplify, standardise and optimise — instincts that are often useful, but which can create brittleness when overextended. A company can become so optimised for efficiency that it loses room to manoeuvre, so committed to consistency that it cannot improvise, or so focused on governance that it mistakes oversight for capability.
As Professor Denyer argued, organisations can drift out of alignment with the environment around them, while also allowing practical workarounds and compromises to accumulate internally. This is the classic gap – identified by Dr Erik Hollnagel of Jönköping University – between “work as imagined” and “work as done”: the distance between what managers, procedures and audits assume will happen, and what people actually have to do in live conditions.
Recognising the Signs
The signs of resilience theatre are familiar: impressive documentation, weak execution; extensive risk registers, weak prioritisation under pressure; siloed preparation for cross-functional disruption; and too little learning between events.
That emphasis on practice is echoed by the UK’s National Cyber Security Centre, which says plans must be tested regularly and that crisis response rarely involves just one organisation, making cross-boundary exercising essential.
Strategic transformation adds another layer of complexity. The very changes organisations are pursuing to stay competitive, including GenAI, automation and increasingly integrated digital systems, are also creating new vulnerabilities. They increase interdependence. They accelerate the speed at which failures propagate. They expand cyber and operational risk surfaces. They make organisations more capable, but also more exposed.
This is backed up by recent guidance from NIST, which says generative AI introduces distinct risk-management challenges and should be governed as a trustworthiness and organisational risk issue, not just a technical deployment issue. The European Central Bank has similarly stressed that operational resilience is now inseparable from rising digital interdependencies and sector-wide collaboration.
This is why a traditional risk mindset is no longer enough. You cannot document your way out of complexity.
What Real Resilience Looks Like
If the first step is recognising resilience theatre, the second is building something more real.
Professor Denyer’s framing of resilience rests on three capabilities: anticipate, absorb and adapt.
The first is the capacity to anticipate. That means looking beyond the obvious or already documented, scanning for emerging threats, identifying weak signals and understanding what is truly critical before it breaks.
The second is the capacity to absorb. This is about holding the line, maintaining essential outcomes and continuing to function under stress. Resilience is not only about bouncing back, but about being able to move forward when disruption forces a re-think of how the organisation creates value.
The third is the capacity to adapt. This is where resilience moves beyond endurance and becomes transformative: reconfiguring structures, processes or decisions in response to changing conditions rather than clinging to yesterday’s model.
These capabilities are not built through paperwork alone. They are developed through practice, coordination, leadership behaviour and repeated exposure to realistic conditions.
From Risk Registers to “What Must Go Right”
A practical place to start is to shift the conversation from risks to essential outcomes. Instead of asking only what might fail, leaders should ask what must continue. What must always be delivered to customers? Which organisational capabilities are genuinely non-negotiable? Which dependencies across systems, suppliers or teams must hold if the business is to function under strain? If everything were disrupted tomorrow, what would be protected first?
Many organisations cannot answer these questions clearly. That is a sign that resilience is still being treated as a reporting category rather than a strategic capability.
Leadership Under Pressure
Leadership sits at the centre of this. One of the most important takeaways from the session was that resilience is not primarily a technical problem. It is a leadership discipline. Leaders shape where attention goes, how trade-offs are made, whether tensions are surfaced or suppressed and how teams behave under pressure. The leader’s profile, in many respects, becomes the organisation’s profile.
That is why resilience can fail even in well-intentioned organisations. Over-index on consistency and you create brittleness. Over-index on flexibility and you risk chaos. Over-index on optimisation and you drift into stagnation. Over-index on adaptation and people burn out. The challenge is not to choose one mode permanently. It is to know when to move between modes deliberately and intelligently.
A Tale of Two Responses
Consider a mid-sized Irish company hit by a significant cyber incident. On paper, it has a response plan, defined roles and named external partners. But in the first hours of the event, IT isolates systems while operations remains unclear on what is still functioning. Communications hesitates because legal, leadership and PR are misaligned. Senior meetings increase, but decisions slow. Customers receive inconsistent messages.
The problem is not that no plan existed. The problem is that coordinated, adaptive execution did not.
Now compare that with a genuinely resilient organisation facing the same disruption. It aligns rapidly on priorities: contain, communicate, stabilise. It delegates authority clearly. It establishes a shared operating picture across functions. It keeps messaging transparent and consistent. The disruption is still serious, but the response is coherent.
Same event, different capability.
Rethinking the Questions We Ask
This is why boards and executive teams need to change the questions they ask. “Do we have a plan?” is too limited. More useful questions are harder. Have we tested how we actually respond? Can we make fast, aligned decisions under pressure? Where does coordination break down? What are the essential outcomes we must protect? Are we building capability, or merely documenting intent?
Those questions move resilience out of the theatre and into reality.
The organisations that will outperform over the next decade are unlikely to be the ones with the longest risk registers or the most elaborate crisis binders. They will be the ones that build adaptive capacity, practise cross-functional coordination and treat disruption as a source of learning rather than a temporary interruption to normality. They will understand that resilience is not a static asset to be owned, but a living capability to be exercised.
Because when disruption hits, and it will, resilience is not what you wrote down.
It is what your organisation can actually do.
FAQ
1. What is “resilience theatre” in organisations?
Resilience theatre refers to the appearance of preparedness without the underlying capability to respond. Organisations may have detailed risk registers, crisis plans and governance structures, but still struggle to act coherently when disruption actually occurs.
2. Why do crisis plans often fail in practice?
Crisis plans fail because they are built around assumptions rather than real conditions. When disruption hits, decision-making slows, teams operate in silos and priorities become unclear. The issue is not the absence of plans, but the inability to coordinate and adapt under pressure.
3. What actually makes an organisation resilient?
Resilient organisations focus less on documentation and more on capability. They develop the ability to anticipate emerging risks, absorb disruption while maintaining essential operations and adapt quickly as conditions change. These capabilities are built through practice, leadership and cross-functional coordination—not just planning.
