After the September 11, 2001, terrorist attacks, the U.S. government closed the country’s borders and shut down all incoming and outgoing flights. The impact on many supply lines was immediate. Ford Motor Co. had to idle several assembly lines intermittently as trucks loaded with components were delayed coming in from Canada and Mexico. Ford’s fourth-quarter output in 2001 was down 13% compared with its production plan.1 And Toyota Motors Corp., also adhering to just-in-time inventory discipline, came within hours of halting production at its plant in Indiana as it held out for assemblies from a key supplier awaiting steering sensors that usually came by air from Germany.2

Managers experience risk on many levels, but its primary source is uncertainty in the demand for products — uncertainty that has increased dramatically in recent years due to several interdependent trends such as increased customer expectations, more global competition, longer and more complex supply chains and greater product variety with shorter product life cycles. In addition, managers still must cope with the conventional disruptions of supply variability, capacity constraints, parts quality problems and manufacturing yields. Now, on top of all that, they have to cope with the ongoing unease resulting from the war on terror and the likelihood of further attacks following the March 11, 2004, train bombings in Madrid and the two July 2005 bombings of London’s transportation system.

The problem is that many companies leave risk management and business continuity to security professionals, business continuity planners or insurance professionals. However, building a resilient enterprise should be astrategicinitiative that changes the way a company operates and that increases its competitiveness. Reducing vulnerability means reducing the likelihood of a disruption and increasing resilience — the ability to bounce back from a disruption. Resilience, in turn, can be achieved by either creating redundancy or increasing flexibility. While some redundancy is part of every resiliency strategy, it represents sheer cost with limited benefit unless it is needed due to a disruption. Flexibility, on the other hand, can create a competitive advantage in day-to-day operations. Investments in flexibility thus can be justified on the basis of normal business results without even taking into account the benefits of risk mitigation and cost avoidance. (See “About the Research.”)

Stages of Disruption

Any significant disruption will have a typical profile in terms of its effect on company performance, whether that performance is measured by sales, production level, profits,