By Paul Bogan, Middle East Partner at +impact, Serco’s advisory business
In an era defined by volatility, from extreme weather and power outages to cyberattacks and cascading supply chain disruptions, business resilience is no longer a nice to have; it’s an imperative.
According to the U.S. National Oceanic and Atmospheric Administration (NOAA), 2022 alone saw 18 weather events each causing damages exceeding USD 1 billion (SAR 3.75 billion). Total losses for the year reached SAR 1.5 trillion. Meanwhile, the World Economic Forum ranks extreme weather, economic fragmentation and natural resource crises among the top global threats to business continuity.
While this paints a sobering global picture, localised pressures in regions such as the GCC are also intensifying. In Saudi Arabia, the cost of energy is rising, reflecting global trends where prices increased by 29% in the U.S., 71% in the EU, and 54% in the UK, according to the International Energy Agency. If these cost pressures are not addressed at the early stages of infrastructure and urban development they risk becoming long-term operational burdens.
The need for crisis preparedness
Despite widespread awareness of these threats, many crisis plans falter at the point of implementation. A study by the Ponemon Institute found that large enterprises lose an average of USD 300,000 (SAR 1,125,000) for every hour of operational downtime. Yet 96% of IT leaders surveyed by LogicMonitor reported experiencing at least one outage over a three-year period - often with minimal testing of their response frameworks.
All too often, crisis preparedness fails not because plans don’t exist, but because they are theoretical or too complex to translate into implementation. Crisis simulations remain underused or lack realism. They fail to capture the intensity, confusion and rapid decision-making required in real-life emergencies. High-fidelity simulations that integrate emotional pressure, stakeholder dynamics and evolving environmental variables yield insights that traditional tabletop exercises cannot.
These challenges are compounded by the interconnected nature of today’s risks. Research by Marsh McLennan shows 84% of business leaders believe risks are more complex and interlinked than ever before. A single failure, whether a power outage, cyber incident or weather event, can ripple across departments, partners and customer ecosystems. The recent widespread power outage affecting parts of Spain and Portugal, caused by a fault in the high-voltage transmission network, is a stark reminder of how swiftly such events can disrupt multiple systems and National Infrastructure
Beyond operational disruption, poorly managed crises undermine trust. According to PwC, 30% of consumers will switch providers following a crisis if they feel the response lacked transparency or care. Customers now assess not just what an organisation delivers, but how it behaves when systems fail. Transparent communication, real-time updates and visible action are no longer optional, they are expected.
The case for workforce preparedness
This principle applies equally to employees, who are often overlooked in resilience strategies. Yet workforce preparedness is essential. Studies by Gallup and Deloitte show that employee engagement, clear roles and access to psychological support significantly improve both crisis response and recovery. Cross-functional training, live drills and post-crisis aftercare are not ‘nice to haves’, they are core to business continuity.
In infrastructure and venue development, particularly in the GCC, where giga-projects are redefining the urban landscape, resilience must be embedded from the outset. Designing buildings and public spaces without planning for crowd surges, extreme weather or critical systems failure reflects short-term thinking. Design-stage questions such as: “How would a full-capacity evacuation work?”, “What if the transport network fails mid-event?”, or “How does this space adapt across a 60-year lifecycle?” must become routine.
Managing large scale events
The same approach must be applied to large-scale public events in the Middle East. Incidents such as the 2023 Jeddah floods and the 2015 Mina Hajj crowd crush demonstrate how crises can escalate - not necessarily due to rare or extreme threats, but because critical systems were not adequately stress-tested. Breakdowns in coordination, crowd safety, communication, and mobility often overlap, amplifying overall risk.
Measuring readiness through Resilience KPIs offers a clear way forward. Metrics such as recovery time objectives, incident response times, recovery test success rates, and staff training completion help shift organisations from reactive to prepared. Crucially, these indicators should be reviewed consistently and tied to senior leadership accountability.
Legacy planning also demands attention. Just as airports are designed to evolve over decades, so too should stadiums, transport hubs, and high-footfall public venues. This requires a pivot from short-term project delivery to operational-first strategies, where capex decisions are grounded in the realities of long-term function.
Ultimately, resilience is a mindset. It means investing in what may seem invisible until it becomes essential. It’s about building systems, cultures and environments that not only endure stress, but adapt and grow stronger in the face of it.
This article is based on the contents of +impact’s white paper ‘How Resilient is your Business’, published in May 2025 and available to download here.