Operational Resilience & Risk Appetite At Aramco Case Study Sample

Introduction to Operational Resilience & Risk Appetite: Aramco Case Study Sample

Current risks involving turbulent markets, serious cyber threats, and linked global networks have highlighted that traditional Business Continuity Management (BCM) typically depends too much on static plans and strict regulations. Facing challenges that are less easy to predict and manage, organisations have started looking at operational resilience as a better option. Unlike BCM, operational resilience is about remaining adaptable, acting quickly and keeping vital services during emergency situations. The essay discusses whether embracing operational resilience increases an organization’s appetite for business risk, due to its focus on maintaining stable operations in adverse situations. It also examines the pros and cons of operational resilience against traditional BCM by looking at real cases such as Saudi Aramco, to identify important lessons for handling risks in tough business situations.

Explore this Aramco case study sample examining operational resilience, risk appetite, cyber threats, and business continuity in uncertain environments. An Assignment writing helper can support students in understanding resilience strategies and effective risk management approaches.

Critically Evaluating Whether Operational Resilience Enables Greater Organisational Risk Appetite

Organisational risk appetite and operational resilience must be aligned as an organisation seeks to balance risk-seeking initiatives with protective measures, using its capacity to reduce operational risks. Operational resilience helps businesses withstand disruptions and may shift how they perceive risk (Bell, 2020, pp.69–71). Although Saudi Aramco demonstrates strong risk management and supports innovation in hydrogen and carbon capture technologies, bureaucratic inertia and geopolitical vulnerabilities limit its capacity to substantially redefine its risk thresholds. Resilience frameworks depend on cultural adaptability, robust governance, and attention to the socio-political dimensions of risk (Hopkin, 2018; Power, 2009).

Conventional risk management systems often inhibit innovation by prioritising problem prediction over agility. The IRM (2020b, p. 12) Risk Appetite Guidance highlights that the absence of clear standards, combined with rapid environmental changes, leads companies to adopt overly cautious postures and overlook strategic opportunities. Before 2019, Aramco’s rigid reserves strategy protected supply but exposed it to geopolitical shocks, evident when it restored production rapidly after the 2019 Houthi drone strikes on the Abqaiq facility. This also revealed Aramco’s reluctance to shift from fossil fuels to renewables, reflecting a cultural preference for the stability of traditional fuels over transformational risks (Mitroff et al., 1988, p. 89). Focusing solely on operational resilience can reinforce existing mindsets, contributing to what Smith and Elliott (2007, pp. 203-205) describe as “post-crisis complacency.” Thus, while resilience aids recovery, its effect on risk appetite remains limited without deeper governance reform or strategic realignment.

When resilience is paired with adaptive governance, as conceptualised in Taleb’s (2012) antifragility approach, it can increase risk appetite. Antifragile systems improve under volatile conditions. For example, Aramco’s Jafurah project applies AI for maintenance and decentralised protocols to oversee risks in shale reserves during exploration. This aligns with Hiles’ (2011) advice that decentralised governance improves decision-making. By tolerating failures, Aramco undertakes calculated risks to expand activities. Yet, progress remains inconsistent. IRM’s (2020a) COVID-19 survey shows that Aramco’s hierarchy slows decisions, particularly during large market shifts like the 2020 oil price collapse, creating what Drennan and McConnell (2007, p.89) term “procedural paralysis.” To overcome this, boards must regularly assess resilience risks—including reputational and strategic risks—using real-time market data, operational metrics, and stakeholder sentiment (CIMA, 2010, p.6). Resilience must become proactive and evidence-driven. Organisations need not only proper tools but also an open culture that tolerates uncertainty and failure as part of learning.

Perpetuating structures can often limit how resilience can transform organisational dynamics. While more businesses are using resilience frameworks, AIRMIC & Cass Business School (2019, p. 8) observe that hierarchy as it stands usually maintains power over decision-making, thereby hindering the transition to decentralised networks and reducing organisational agility. According to Smith and Elliott (2007, p. 217), resilience adoption is sometimes just a form of superficial compliance. Although Aramco can predict risks in its rigs using AI, the larger strategic decisions are still managed from a central point (Aramco Sustainability Report, 2021, p.34). During the 2022 energy crisis, Aramco's internal deliberations delayed hydrogen exports, which enabled competitors such as Shell to gain first-mover advantage. While some may argue that centralised control reduces exposure to reputational risks, this case shows that it also creates missed opportunities. The Mann Gulch disaster exemplifies how following strict rules stopped the teams from improvising, based on Weick’s (1993) observations. Unless there is flexibility for fast decisions in operations, even the best-designed resilience frameworks may not promote true adaptability or a risk-tolerant culture. If a company wishes to have more risk appetite, it should incentivise improvisation and tolerate controlled failure. UK Government Finance Function (2020, p. 6) notes that a risk appetite statement should address both financial and non-financial risks, yet Aramco’s investment strategy suggests a misalignment between its resilience ambitions and risk thresholds.

“Resilience fatigue” is another overlooked inhibitor, arising when organisations face constant adaptation pressures. Rigid work structures may cause Aramco’s engineers to view resilience demands as destabilising. Surveys reveal that employees at resilient firms often experience burnout from frequent adjustments (IRM, 2020a, p. 8), although such data might reflect leadership perceptions more than operational realities (Drennan & McConnell, 2007, p. 92). This ambiguity in available data underlines a critical risk in resilience planning: overestimating institutional capacity without understanding the human dimensions of risk. At Aramco, this tension is clear as the company must sustain oil output while expanding renewable investments. Engineers often struggle with newer technologies such as carbon capture. This aligns with Smith and Elliott (2007), who argue resilience is often viewed as a “post-crisis narrative” that neglects the human dimensions of change. Without proper support for employees, resilience can reduce risk appetite. A critical improvement would be to integrate employee perspectives into risk planning, ensuring that psychological resilience complements technical resilience. True resilience requires employee empowerment, psychological well-being, and cross-functional skills that enable adaptive responses to emerging risks.

Moral hazard complicates resilience assessments, as seen when banks over-relied on liquidity before the 2008 crisis (Abkowitz, 2008, p. 147). Perceived security often leads to reckless risk-taking. Aramco’s continued emphasis on fossil fuels, despite ESG commitments, reflects this problem. The $1.5 billion Hawiyah gas plant investment diverts funds from renewables, favouring operational redundancy over transformation (Saudi Aramco, 2021, p. 33). Deloitte (2014) found that 51% of executives admit crisis unpreparedness, often mistaking continuity plans for genuine resilience. ACE Group (2013, p. 14) warns that this confusion stems from conflating operational continuity with reputational legitimacy. Without strong governance, perceived resilience can mask recklessness as boldness.

Social and political risks play a major role in shaping vulnerability. Kasperson and Kasperson (2005) emphasise that public perceptions of risk can magnify societal harm. While Aramco contained the technical impacts of the 2019 Abqaiq attacks, reputational risks intensified due to regional tensions. Despite Jafurah’s investments, Aramco maintains only a modest ESG rating. CIMA (2010) stresses that reputational risks should be embedded within resilience strategies, yet most models neglect stakeholder perspectives. Aramco’s slow public response to 2021 methane leaks shows that technical continuity does not guarantee reputational resilience. To expand risk appetite, resilience planning must align with stakeholder expectations and emphasise transparency. ESG accountability increasingly defines risk appetite boundaries.

Blending Business Continuity Management (BCM) with resilience provides a strategic pathway. Hiles (2011, p. 112) explains that BCM restores operations, while resilience transforms through disruption. Bell (2020, p. 70) warns hybrid models risk “strategic drift” if continuity outweighs innovation. The Marjan offshore project demonstrates successful integration, balancing AI safety protocols with exploratory ventures in tidal energy. This shows that integrated resilience-BCM strategies can balance operational stability with calculated risk-taking.

It is essential to stress-test organisational resilience to uncover potential weaknesses. The Australian Government Department of Home Affairs (2020) promotes scenario planning for unforeseeable, high-impact “black swan” events. For Aramco, these could include cyber attacks on production facilities and the removal of energy subsidies, revealing its dependence on fossil fuels. However, AIRMIC and Cass Business School (2019, p. 21) found that many firms including Aramco over-rely on scenario planning, creating false confidence. This aligns with Drennan et al. (2014), who argue that adaptive governance is more effective in navigating complex risks than rigid procedural approaches. Additionally, Hopkin (2018, p. 167) maintains that achieving risk maturity requires stress-testing embedded within iterative feedback systems—a capability currently absent from Aramco’s organisational culture. Incorporating such systems would allow stress-testing to evolve from a theoretical exercise into a real-time driver of strategic agility.

In short, operational resilience can increase organisational risk appetite—but only if supported by specific conditions. Aramco can recover from shocks, but bold risk-taking faces obstacles such as bureaucracy, employee resistance, and geopolitical uncertainty. Transformation requires decentralising authority, prioritising ethical governance (CIMA, 2010), and integrating socio-political awareness (Kasperson & Kasperson, 2005). Resilience must move beyond technical solutions and become a cultural ethos that promotes experimentation, adaptability, and recognition of the complex interplay between perception, governance, and preparedness. Crucially, any claim that resilience automatically fosters risk appetite overlooks these necessary cultural and structural shifts As AIRMIC and Cass (2019, p. 33) warn, “resilience without reinvention” risks preserving outdated paradigms—a critical lesson for Aramco as it navigates the evolving energy sector.

Operational Resilience vs. Traditional Business Continuity Management: A Critical Evaluation of Paradigms in Modern Risk Governance

Fast-changing global risks, such as asymmetric cyber attacks and cascading climate disruptions, have significantly undermined the traditional approach to Business Continuity Management (BCM). The structured processes of BCM once provided companies with stable recovery pathways for localized disruptions, but organizations now face interrelated threats that occur simultaneously. Consequently, operational resilience has been recognized as having distinct significance, at times challenging conventional BCM practice and positioning resilience as a fundamental requirement. In Fundamentals of Risk Management (2018), Hopkin highlights that this distinction marks a shift from focusing solely on assured recovery to emphasizing continuous capacity-building—making it essential to critically assess which philosophy better supports today’s risk management practices. According to this analysis, even though resilience responds more effectively to emerging risks, its implementation is constrained by cultural, financial, and operational factors—limitations that BCM’s structured guidance can help address. Effective risk governance calls for tailoring approaches to the specific context, though this integration inevitably involves confronting significant governance paradoxes and organizational inertia (Hiles, 2011, p. 88).

In complex systems theory, operational resilience frameworks consider that in modern contexts, disruptions occur through interconnected systems rather than in isolation. Resilience is different from BCM because it helps organizations adapt dynamically and reconfigure their operations during disruption, allowing their operations to form in different ways (Hiles, 2011) as described by AIRMIC and Cranfield School of Management (2014). However, this adaptive flexibility may introduce challenges in maintaining consistency and control, raising questions about how organizations balance agility with stability. More specifically, this means resilience calls for “bouncing forward” rather than just “bouncing back” (as Bell, 2020 explains), which aligns with Taleb’s (2012) antifragility idea where systems get stronger by withstanding volatility. Saudi Aramco’s response to the 2012 Shamoon attack demonstrates this idea: after the company’s 30,000 workstations were incapacitated, the company transcended traditional risk management protocols by changing its whole approach to risk. Yet, this transformation also implies significant investment and cultural shifts that may not be feasible for all organizations, highlighting the importance of contextual factors in operationalizing resilience. Relying on Davidson Frame’s (2003) theory, Aramco invested substantially in a predictive AI threat monitoring function and moved into new hydrogen and carbon capture technologies, transforming energy transition risks into strategic opportunities by shifting toward lower-carbon revenue portfolios (AIRMIC & Cass Business School, 2019, p.28). While this strategic pivot illustrates resilience’s potential to create value from disruption, it also underscores the uncertainties and emerging risks in adopting innovative technologies and markets. This process demonstrates that strategic flexibility is more critical than relying on rigid, predefined protocols in this industry, although balancing flexibility and control remains an ongoing managerial challenge.

The COVID-19 pandemic crystallized resilience’s comparative advantages. Where lean supply chains failed to handle demand shocks, those following resilience principles continued without major disruption. Because Toyota implemented AIRMIC and Cranfield’s (2014) supply chain morphogenesis concept after Fukushima—mapping over 2,000 second-tier suppliers and pre-qualifying alternatives across Southeast Asia—its pandemic disruption impacts were reduced by 44% compared to General Motors’ model, which relied solely on BCM (CIMA, 2010). Likewise, McKinsey (2020) noted that agile UK businesses restored operational capacity faster due to scenario planning, prototyping, and cross-functional collaboration. This matches Chong et al. (2020) on dynamic capability loops, showing resilience allows companies to adjust quickly to new risks.

Conversely, resilience scholars argue important challenges may undermine its advantages. Smith and Elliott (2007) warn that using resilience generically without standardized metrics risks diluting accountability, since most organizations lack quantifiable resilience measures (IRM, 2012). In regulated industries, tensions arise between resilience strategies and safety requirements (Hiles, 2011; Hopkin, 2018), reflecting Weick’s (1993) “requisite rigidity” theory in high-risk environments. Moreover, recovery resource demands can be substantial, excluding smaller or resource-constrained organizations; thus, many rely on BCM despite its inadequacy for systemic risks (AIRMIC & Cranfield School of Management, 2014). This scalability challenge reveals a critical equity gap often overlooked by resilience advocates.

For contained, predictable disruptions, traditional BCM retains significant value. Aligned with Abkowitz’s (2008) engineering guidelines, BCM works well when risks are quantifiable, impacts localized, and historical data reliable. Its ISO-certified procedures support fast, cost-effective recovery from routine disruptions such as server failures or facility damage. Johnson & Johnson’s Credo-based BCM protocols enabled continued medication supply during Hurricane Sandy via redundant sites, something experimental resilience strategies cannot easily replicate (CIMA, 2010). BCM’s structured methods are essential where clear records and detailed procedures provide stakeholders with quantifiable assurance that resilience frameworks often lack.

However, BCM shows major limitations with novel or systemic threats. The Deepwater Horizon disaster illustrates this: BP’s blowout contingency plans ignored reputational damage and stakeholder dynamics, resulting in a $65 billion catastrophe (ACE Group, 2013). This highlights BCM’s flaw: focusing inward on restoring operations while ignoring external consequences, such as regulatory backlash and loss of public trust—what Kasperson and Kasperson (2005) call “risk amplification through institutional trust decay.” Smith and Elliott (2007) further critique BCM’s reliance on historical data, fostering “retrospective rationality” and vulnerability to unprecedented threats. This was evident in the COVID-19 crisis, when supply chains optimized solely for efficiency collapsed due to border closures, whereas resilience-oriented companies like Tesla used vertical integration to bypass semiconductor shortages (IRM, 2020a). Taleb (2008) argues BCM mistakes “known unknowns” for full risk coverage, failing to engage with deeper uncertainties of systemic crises.

The hybridization of BCM stability and the agility of resilience is also becoming more commonplace and indicates forces of organizational strains. The IRM (2012) Risk Management Standard facilitates both formal and flexible governance through the concept of so-called dual-track frameworks, where BCM focuses on addressing high-probability risks, and resilience serves to handle strategic uncertainties, as exemplified by the fact that, since 2012, Aramco has integrated its ISO 22301-certified response strategies with AI-based threat forecasting. This is what happened to British Airways in 2017, when a collapse in its IT operations demonstrated the risks of hybrids: its focus on the efficiency generated by BCM had led to the elimination of redundancies that show resilience. The power failure in a data centre led to subsequent blackouts dragging down flights world over. This occasion backs up the Bell (2020) menace of KPI schizophrenia the contrary motivation amongst BCM cost control and resilience requirement of adaptive capacity and investment on intelligent failure. Such complications are exacerbated by cultural resistance; the cultural resistance to BCM hierarchical structures rubs against the offered resistance-based distributed and real-time decision-making. This has been the case with Equifax, the data breach that occurred in 2017 that took several days before escalation deteriorated the reputational and operational loss. According to AIRMIC & Cass Business School (2011), one of the root causes of failures tends to be cultural complacency and silo-based risk management inhibits timely change. According to Drennan and McConnell, (2007) adaptive learning needs to have tolerance of iterative improvement, which is usually absent in compliance based environments.

These case studies expose the transformative potential of resilience and the limitations of it. Aramco developed this threat response focusing on the theory of crisis portfolio created by Mitroff et al. (1988) in which the threats of cyber, market, and policy are viewed as the systemic challenges. Using AI surveillance, Aramco managed to achieve a high rate of operational capacity 95 per cent when competitors struggled with the pandemic (AIRMIC & Cass Business School, 2019). This did however imply a rebuilding of decades worth of BCM-conditioned silos between operations teams and IT departments which turned out to be a five year cultural transformation resisted by engineers who saw resilience protocols as a betrayal of their safety assurances. On the other hand, the Deepwater Horizon crisis by BP would demonstrate the incompetence of BCM in new emergencies. Though BP had vast safety plans that had been endorsed by the regulatory bodies, it failed in abiding by Honey (2012) principles of reputation capital which revolved around technical recovery yet disregarding media, community and government dynamics-this partly led to damage in its brand which was irreversible in many financial penalties.

Operational resilience and BCM do not contradict but complement, and they are most functional when used in contexts. Companies undergoing dynamic and interconnected industries such as energy and technology require the flexibility of resilience to a new form of threat as is the case with Aramco, a diversified approach. At the same time, the capability of BCM to deliver reliable, process-based solutions is incredibly important to the market of regulated industries that deal with well-known risks. Hybrid models are useful, however, only when organizations can address those obstacles: maintain control of costs against the freedom to invest using concrete risk appetite models (IRM, 2020b; UK Government Finance Function, 2020); breach the cultural divide with cross-department training in simulation to develop the skills needed (Drennan et al., 2014); and build common ground with resilience measurements that drive practical results (Smith and Elliott, 2007). Hopkin (2018) explains that this evolution brings business continuity to a mature level of an adaptive assurance system that covers anticipated disturbances and the complicated crises. The achievement of this potential involves governance reforms aimed at resolving the resource and compliance gaps that the SMEs face.

Conclusion

Operational resilience offers a different but complementary way to traditional BCM for managing risks. This essay has shown how resilience can help organisations take on more risk by becoming more flexible and adaptable. However, this potential depends on factors like the industry environment, how open the company culture is, and the governance structures in place. To make the most of resilience, organisations need to invest properly, give teams the authority to make decisions, and build a culture that learns from disruptions. Instead of replacing BCM, resilience usually works best when it is combined with existing continuity plans and processes. By blending BCM’s steady procedures with resilience’s ability to adapt quickly, organisations can find a balanced approach that allows them to innovate while still protecting essential operations in uncertain times.

References

• Abkowitz, M. (2008) Operational Risk Management: A Practical Approach. New York: Wiley.
• ACE Group (2013) Reputation at Risk. Available at: https://www.yumpu.com/en/document/read/51716579/reputation-at-risk-ace-group
• AIRMIC & Cass Business School (2011) Roads to Ruin. Available at: https://www.airmic.com/sites/default/files/technical-documents/Roads-to-Ruin-the-analysis.pdf
• AIRMIC & Cass Business School (2019) Risk Leadership: The Next Frontier. Available at: https://www.airmic.com/sites/default/files/Risk-Leadership-Report.pdf
• AIRMIC & Cranfield School of Management (2014) Roads to Resilience. Available at: https://www.airmic.com/sites/default/files/technical-documents/Roads-to-Resilience-executive-summary.pdf
• Australian Government Department of Home Affairs (2020) Critical Infrastructure Resilience Strategy. Available at: https://www.homeaffairs.gov.au/critical-infrastructure-resilience
• Bell, G. (2020) The Organizational Resilience Handbook. Available at: https://www.google.com.qa/books/edition/The_Organizational_Resilience_Handbook/cBn0DwAAQBAJ
• Chong, E., Handscomb, C., Williams, O., Hall, R. & Rooney, M. (2020). Agile Resilience in the UK: Lessons from COVID-19 for the ‘Next Normal’. Available at: www.mckinsey.com/business-functions/organization/our-insights/agile-resilience-in-the-uk-lessons-from-covid-19-for-the-next-normal
• CIMA (2010) Risk Appetite and Tolerance. Available at: https://www.cimaglobal.com/Documents/risk-appetite-and-tolerance.pdf
• Davidson Frame, J. (2003) Managing Risk in Organisations. San Francisco: Jossey-Bass.
• Deloitte (2014) Global Reputational Risk Management Survey. Available at: https://www2.deloitte.com/global-reputational-risk-survey
• Drennan, L. and McConnell, A. (2007) Risk and Crisis Management in the Public Sector (1st ed.). Abingdon: Routledge. Available at: https://books.google.com.qa/books/about/Risk_and_Crisis_Management_in_the_Public.html?id=kDJUapQ8QsEC&redir_esc=y
• Drennan, L., McConnell, A. and Stark, A. (2014). Risk and Crisis Management in the Public Sector (2nd ed.). Abingdon: Routledge. DOI: 10.4324/9781315816456
• Hiles, A. (2011) The Definitive Handbook of Business Continuity Management (3rd ed.). Chichester: Wiley. DOI: 10.1002/9781119201652 (Chapter 8)
• Honey, P. (2012) Reputation Capital: Building Trust in the Digital Age. Berlin: Springer.
• Hopkin, P. (2018) Fundamentals of Risk Management (5th ed.). London: Kogan Page.
• Institute of Risk Management (IRM) (2012) Risk Management Standard. Available at: https://www.theirm.org/media/4709/arms_2002_irm.pdf
• Institute of Risk Management (IRM) (2020a) COVID-19 Response Survey. Available at: https://www.theirm.org/media/4641/irm-covid-19-report.pdf
• Institute of Risk Management (IRM) (2020b) Risk Appetite and Tolerance: Guidance for Practitioners. Available at: https://www.theirm.org/media/7239/64355_riskapp_a4_web.pdf
• Kasperson, R.E. and Kasperson, J.X. (2005) The Social Contours of Risk. London: Earthscan.
• Mitroff, I.I., Pearson, C.M. and Harrington, L.K. (1988) The Crisis Portfolio: Strategic Management of Business Crises. New York: Wiley.
• Power, M. (2009). The risk management of nothing. Accounting, Organizations and Society, 34(6-7), 849–855. Available at: https://doi.org/10.1016/j.aos.2009.06.001
• Saudi Aramco (2021) Sustainability Report 2021. Available at: https://www.aramco.com/-/media/downloads/sustainability-report/saudi-aramco-sustainability-report-2021-en.pdf (Accessed: 10 June 2023).
• Smith, D. and Elliott, D. (2007) Key Readings in Crisis Management. London: Routledge.
• Taleb, N.N. (2008) The Black Swan. New York: Random House.
• Taleb, N.N. (2012) Antifragile: Things That Gain from Disorder. New York: Random House.
• UK Government Finance Function (2020) Risk Appetite Guidance for the Public Sector. Available at: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/929385/Risk_Appetite_Guidance_Note_v1.0_FINAL.pdf
• Weick, K.E. (1993) ‘The Collapse of Sensemaking in Organizations: The Mann Gulch Disaster’, Administrative Science Quarterly, 38(4), pp. 628–652. DOI: https://doi.org/10.2307/2393339

Read Our Last Sample: https://www.newassignmenthelp.co.uk/digital-health-leadership-assignment-sample-53243