In an environment defined by continuous disruption, traditional approaches to risk management are no longer enough. Our April 2026 submission (below) to the UK Parliamentary National Resilience Committee argued that risk and resilience can no longer operate as separate disciplines, but must be blended into a single, practical capability focused on maintaining what matters most when conditions change.

Improving understanding of preparedness and resilience is not primarily about more frameworks, more funding, or more technical detail. At its core, it is about how we think about risk itself, and how well that thinking translates into real decisions and behaviours.

Traditional approaches to risk management are no longer delivering what is needed. As set out in Brave’s recent publications, Enterprise Risk Management (ERM) in its current form is increasingly unfit for purpose in today’s environment. It was designed for a more stable world where risks could be identified, assessed, and managed in relative isolation. That is no longer the case.

Recent crises have not come from unknown “black swans”, but from familiar weaknesses such as fragile operations, misaligned decisions, and an inability to respond effectively under pressure. Risk frameworks did not fail because they lacked sophistication, but because they were not designed to support decisions in conditions of continuous disruption.

As a result, risk and resilience have become disconnected in practice. Risk is treated as something to identify and report. Resilience is treated as something to build or demonstrate. Neither, on its own, is sufficient.

This separation is part of the problem. In reality, understanding risk and being able to respond to it are part of the same challenge: maintaining what matters when conditions change.

This is where the concept of blending risk and resilience becomes important, that is bringing risk and resilience together into a single, practical capability, combining insight about what could disrupt outcomes (risks) with the ability to continue delivering them (resilience). It shifts the focus away from managing lists of risks, towards a more fundamental question: what do we need to keep doing, whatever happens?

 That shift is increasingly necessary. Disruption is no longer occasional but the baseline, and is often interconnected. At the same time, the institutions we have historically relied on to absorb shocks—governments, international systems, even financial markets—are more constrained and less predictable than they once were. The idea that resilience can be provided centrally, or applied when needed, is becoming less realistic.

In this context, preparedness cannot sit in a policy document or a contingency plan. It must become a practical, shared capability, embedded in how decisions are made at every level.

Start with the Individual

Talking about resilience in terms of systems – governments, organisations, infrastructure – is relatively straight forward. However, those systems are made up of individuals, and if they do not understand what resilience means in practice, it is practically impossible for the system as a whole to be resilient.

This means understanding not just the risks individuals face, but the outcomes they need to continue delivering in their roles, whether at work, at home, or in their communities.

As such, improving understanding starts with the individual.  What does disruption actually look like for someone day to day i.e. what outcomes may they be unable to deliver? What might they need to do differently? How confident are they in responding if something does go wrong?  Resilient individuals tend to be those who:

• Have a basic understanding of the risks around them
• Can make decisions under pressure
• Feel they have some agency, rather than relying entirely on others

From there, resilience can build outwards to teams, organisations and communities.

This is where employers and organisations have a real role to play.  Preparedness is not just about protecting operations; it is also about equipping people. In real terms, that might mean providing practical guidance, raising awareness, or simply creating a culture where people feel able to think and talk about disruption realistically.  If individuals do not feel prepared, it is unlikely that the institutions relying on those individuals will be either.

 Make Preparedness Part of Everyday Decisions

Preparedness only becomes real when it changes what people actually do. One of the key limitations of traditional ERM is that it often stops at risk identification, rather than influencing decisions. Blending risk and resilience together addresses this directly by embedding risk and resilience into the choices people are already making.

Currently, many risk and resilience activities sit as reports or frameworks that do not always connect to daily decisions. This makes it harder for individuals to see why it matters. A blended approach reframes preparedness as decision support.

It asks:

• How do we balance efficiency with having spare capacity?
• How robust does a supply chain need to be?
• What do we prioritise if resources are limited?
• What should we keep going if something disrupts normal operations?

These are not abstract questions, they are the types of trade-offs that are already being made; the difference is making resilience an explicit part of that thinking.  When people can see how preparedness affects real choices, it stops feeling theoretical and starts to feel relevant.

Use Language That Actually Connects

One of the biggest barriers to improving understanding is the way resilience is described.  The language can be technical, policy-heavy, and detached from everyday experience.  If the aim is to engage people, the language must change.

That means:

• Explaining things in clear terms
• Focusing on real-world impacts rather than frameworks
• Being clear about what actions people can take

This also helps move risk away from technical “list management” and into something people can relate to and act on.

Communication should also be more deliberate. Public campaigns in the past – such as those used during the Cold War – managed to take complex risks and translate them into simple, practical guidance that people could understand and act on. This same approach could be adopted today, using modern channels and tailored messaging.

For example:

• Schools could introduce age-appropriate resilience awareness and practical skills
• Workplaces could link preparedness to employee wellbeing
• Sector specific campaigns could focus on the realities different industries face
• General public broadcasts could address family and society preparedness
• Local communities could use trusted networks to reinforce the messages

People are more likely to engage with messages that feel relevant to their lives and which are expressed in terms they understand.

Recognise That Risk and Resilience are Shared

Preparedness is often still seen as something that sits primarily with government or emergency services. While those roles are critical, they only form part of the picture.  Modern systems are interconnected.  Disruption in one area, whether energy, finance, logistics or technology, can quickly affect others.  This means resilience does not sit in any one place, it depends on how different parts of the system work together.

In practice, that includes:

• Businesses keeping operations and supply chains running
• Infrastructure providers maintaining essential services
• Financial institutions supporting access to credit and liquidity
• Communities supporting each other locally
• Individuals making informed decisions

This reflects a broader shift highlighted in Brave’s earlier publications: resilience is no longer something that can be “owned” by a single function or institution; it emerges from how systems operate as a whole under stress.

Understanding improves when these roles and interdependencies are made clearer.  People are more likely to act when they can see where they fit, and how their actions contribute to the bigger picture.

Make Resilience More Visible

A further challenge is that resilience can be hard to ‘see’ until something goes wrong.  Many traditional approaches focus on listing risks, which is not always helpful for people to understand what this means in practice. A blended approach shifts the focus to capability:

• Can we keep critical services running if something goes wrong?
• What are the essential outcomes we have to deliver and is there an alternative way to ensure this?
• How long would it take to recover?
• Where are the weak points?

A related challenge is understanding what “enough” resilience looks like in practice. Unlike traditional risk management, where completeness can be implied through coverage of risks, resilience is not about eliminating disruption but about defining what level of impact is acceptable and manageable.

This comes back to clarity on essential outcomes (as noted in point 22 above) and the level of disruption that can be tolerated without those outcomes failing. This can be supported through the use of resilience indicators—for example, how long a service can be unavailable, how quickly operations can recover, or how much disruption can be absorbed before wider system effects occur.

Judging success, therefore, is not about preventing all incidents, but about whether organisations and systems are able to continue delivering what matters within defined thresholds, even under stress. This provides a more practical and measurable way of understanding resilience, measuring not by the absence of disruption, but by the ability to operate through it. This also helps move the conversation from abstract ambition to informed trade-offs.

Approaches such as scenario planning, stress testing and simple resilience indicators can help bring this to life by making it easier to understand where pressure points may be, and more importantly, what needs to be changed.

Continuous Learning – and Being Honest About Challenges

In an environment of continuous disruption, static plans quickly become outdated. There is therefore a need for ongoing testing, learning, and adaptation. This means building on regular opportunities to test and learn:

• Running exercises and simulations
• Learning from near misses, not just major incidents
• Sharing insights across organisations and sectors

However, to do this requires a level of honesty, including being open about:

• The likelihood of disruptions
• The limits of existing systems
• The trade-offs involved in preparing for different scenarios

People are more likely to engage when they feel they are being treated as informed participants, rather than being shielded from reality.

Align Leadership and Behaviour

Finally, preparedness depends heavily on behaviour, particularly at the leadership level.  In many cases behaviour is not driven by a lack of information, but by other competing priorities that take precedence. Many of the most significant failures are not due to unknown risks, but to decisions that did not hold under pressure.

 Risks are also regularly discounted because they have not happened recently, or there is insufficient evidence presented to make the risk-reward trade-off feel justifiable.

Embedding a blended risk and resilience approach means:

• Leaders consistently signalling that it matters
• Governance processes that bring it into key decisions
• Incentives that do not reward short-term gains at the expense of longer-term stability

It also means recognising common biases, such as assuming events will continue as they have, or underestimating low probability, high impact events.

Organisations and governments reflect the decisions of the people within them. Strengthening preparedness means sharing those decisions in a more deliberate way.

Conclusion: Making Preparedness Real

Improving preparedness and resilience is not about adding more layers of policy or complexity. It is about making a fundamental shift in how risk and resilience are understood and applied in practice.

Traditional risk management approaches, focused on identification, assessment, and reporting, are no longer sufficient in an environment defined by continuous disruption and interdependence. What is needed instead is a more resilience integrated, decision-focused capability.

To achieve this means starting with individuals, using language that connects, embedding resilience into decisions, recognising shared responsibility, making capability visible, encouraging continuous learning, and having more open conversations about the realities involved.  When this happens, preparedness stops being an abstract idea or a distant responsibility and becomes part of how people think and act, whether at home, at work or across society, which is what ultimately makes it achievable in practice.