Disruptive risks, reputation and business continuity: the new axis of organizational resilience

In an increasingly volatile, uncertain, complex and ambiguous (VUCA) environment, business continuity is no longer just about keeping operations running, but about preserving “trust”. In its article “Navigating disruptive risks. The executive leader’s perspective”, KPMG notes that disruptive risks “could threaten the basic assumptions underpinning a company’s strategy and business model”. In this context, this type of risk takes on special relevance because it is transforming the way organizations conceive of their resilience.

What is meant by disruptive risks?

Disruptive risks are events or trends that significantly alter the way organizations or
sectors operate. They are characterized by high uncertainty, speed of propagation and systemic impact. Clear examples include generative artificial intelligence and its potential to create disinformation, massive cyberattacks, sudden regulatory changes, or reputational crises triggered by a news story going viral. For years, continuity plans have focused on infrastructure, technology and critical processes. However, today’s disruptions, from cyberattacks and technology failures to reputational crises amplified by social media, show that organizational survival depends as much on credibility as on operational capacity.

Business continuity vs. operational continuity

Talking about continuity is not just about ensuring that servers work or that critical processes keep running. Business continuity means ensuring that the organization can keep delivering value to its customers, employees and stakeholders, even under adverse conditions. The ISO 22301 Business Continuity Management Systems standard emphasizes the need to plan continuity from a strategic perspective, integrating aspects such as communication, crisis management and reputation. Having a technical plan is not enough; a trust plan is needed. Hence the relevance of Crisis Management in business continuity processes.

Crisis management

In a context of disruption, crises are not limited to operational impact. An organization can recover its production capacity in days, but its credibility can take years to restore, if it can be restored at all.

If the organization responds with transparency, empathy and consistency, its reputation can work as a cushion. If, on the contrary, the response is late or deficient, public perception can worsen the loss of trust and prolong the financial and social impact.

Recent cases of companies that have faced data leaks, ethical complaints or environmental conflicts illustrate how poor communications management can worsen the crisis more than the event itself.

Modern continuity management must incorporate reputation as a “critical asset”.

Some essential practices include:

Assess disruptive risks with reputational potential. Not all operational events generate media crises, but all can escalate if they are not communicated properly.
Include crisis communication protocols. Communication must be part of the plan, not an improvised reaction. Spokespersons, key messages and official channels must be defined.
Train teams in reputational scenarios. Drills must go beyond interruptions that are only technical: they must include image crises, attacks on social media or information leaks.
Monitor perception. Analysis of media and social networks makes it possible to detect early signs of reputational erosion, before they materialize into crises.
Align continuity with organizational culture. Transparency, ethics and consistency in decision-making strengthen trust, even when the unexpected happens.

“Crisis management” and “Practical challenges in the Dominican context”

In many organizations in the country some challenges still remain for integrating these approaches:

Limited view of continuity: it is associated exclusively with IT or operational processes.
Lack of integration between areas: institutional communication and risk management tend to work separately.
Little practice with real drills: Organizations often avoid carrying out real drills out of fear of the reaction of public opinion or of not being able to recover fully from the test itself. This resistance means that most exercises are canned and tailor-made or are limited to the technical sphere only, leaving aside the management of scenarios linked to public perception or to reputational crises, which in practice can generate a greater impact than the operational event itself.
Disconnect between governance and communication: governing bodies sometimes do not consider reputation as part of strategic resilience.

Overcoming these challenges requires an integral view of resilience, where public perception, ethics and continuity are understood as three pillars of the same system.

Recommendations for leaders and risk managers

Recognize reputation as a strategic asset and and assign it resources and performance metrics.
Integrate multidisciplinary teams (risk, communications, legal, IT) to manage complex crises.
Design advance communication plans, that include spokespersons and messages aligned with institutional values.
Monitor disruptive trends, especially technological and social ones, that could escalate into issues of credibility or trust.
Assess organizational culture: resilience is built day by day, not only during the crisis.

In conclusion, true continuity is not measured by the speed with which systems are restored, but by the strength with which trust is maintained. In an increasingly uncertain global environment, organizations must evolve toward continuity management models that integrate reputation and disruptive risks as central pillars of their resilience.

Because in the end, “surviving is not just continuing to operate, but continuing to be credible.”

Author: Gabriela Sánchez

Member of the Business Continuity Committee of the Dominican Republic Risk Management Club (CGRRD).

She has experience in risk management, governance and organizational resilience, and actively promotes the integration of the reputational approach into continuity and crisis plans.

Sources of Information considered in the article:

Scenario Analysis Guide for “Disruptive Risks” (James Lam & Associates). September 2020.
Oliver Wyman – “Framing Disruption Risk”. August 2018.
Driving trust and business value through technology. NACD annual report. October 2024
Navigating disruptive risks The executive leader’s perspective. KPMG. December 2019.
ISO 22301 Standard, Business Continuity Management System