By Rick Cudworth, Board and Executive Director, Resilience First
The measurement of organisational resilience helps leaders understand how well their organisation can anticipate, absorb, and adapt to change. This piece focuses on three complementary approaches that are used to measure organisational resilience: Capacity‑based, Capability‑based and Maturity‑based.
Capacity measurement uses indicators to quantify resilience, such as financial reserves, stock holding, supply diversity, workforce turnover, or investor rating. These indicators, based on commonly available data within organisation, enable the resilience of an to absorb shocks to be measured and stress tested. An example of this in practice, is the use by regulators of liquidity ratio and capital adequacy combined with regular stress testing to assess and strengthen financial resilience across the sector. A similar approach is now being applied to assessing and strengthening operational resilience within the sector. This approach is codified within ISO/DIS 22316 Organizational resilience – Guidelines[1] and the Model for Organisational Resilience[2].
Capability measurement typically evaluates what the organisation can do with the plans and resources available to detect, respond and recover from a disruptive event. This is typically assessed through exercises. There are many forms of exercises, from live tests to desktop discussions. Exercises typically assess one or more capabilities such as the time to recover an asset, the adequacy of plans and processes for managing incidents, crisis or specific risks, or the ability of the organisation and its people to maintain control, coordinate and communicate in challenging circumstances. This approach is codified within ISO 22398: Guidelines for exercises and supported through training provided by the UK Resilience Academy.
Maturity measurement assesses how deeply resilience is embedded through an assessment of governance, culture, processes or the management of systems and within the value chain. Maturity assessments are typically used to gauge the current state of resilience in an organisation and measure progress over time. A maturity-based assessment for organisations is provided within BS 65000: Organizational resilience – Code of Practice for Organisational Resilience. An alternative is the Resilience Maturity Assessment (ReMA) tool[3] developed by the Corporate Chief Resilience Officers (CCRO) network under the auspices of the UNDRR.
A summary comparison table is provided below.
Comparison Table
| Capacity‑based | Capability‑based | Maturity‑based | ||
| Primary focus | Resources, buffers, redundancy | Functional abilities and response actions | Institutionalisation, governance, culture, continuous improvement | |
| Typical output | Quantitative indicators with targets and thresholds | Capability scores based on qualitative assessment
Capability domain assessments (e.g. H/M/L or RAG) |
Maturity levels based on qualitative assessment
Roadmap for progression |
|
| Time horizon | Short to medium term | Short to medium term | Medium to long term | |
| Best for | Executive/ board
Stress testing
Strategic decision making |
Operational readiness | Strategic alignment
Board reporting
Long‑term resilience improvement |
|
| Actionability | Strategic
(procure, allocate) |
Operational (train, exercise) |
Governance (policy, culture) |
How the three approaches complement each other
- Capacity answers what we have (resources and buffers).
- Capability answers what we can do with it (processes, people, coordination).
- Maturity answers how well resilience is embedded and sustained (governance, culture, integration).
An integrated approach will use capacity metrics to set thresholds, capability assessments to validate readiness, and maturity assessment to prioritise structural and cultural changes.
Integrated measurement in practice (logistics company)
Context: A mid‑sized logistics company faces climate‑related disruptions and supply chain volatility.
Step 1 — Capacity: Inventory critical assets and set thresholds: fuel reserves for 7 days, backup data centres with 24‑hour RTO, contingency cash equal to 45 days of payroll. Dashboards monitor thresholds in real time.
Step 2 — Capability: Run supplier coordination exercises and measure time to re‑route shipments. Score incident management capability before and after targeted training. Capability scores improve.
Step 3 — Maturity: Use ReMA mapped to BS 65000 to assess governance and value chain maturity. Findings lead to a three‑year roadmap to formalise supplier resilience clauses, embed resilience in procurement, and create a resilience governance forum. Annual reassessments show movement from Level 2 to Level 3 in value chain maturity.
Outcome: Average disruption recovery time reduces by 30% and investor confidence improves due to documented maturity progress.
if you would like to learn more about measuring organisational resilience, join us at the RWN Summit.
[1] ISO/DIS 22316 is due for publication November 2026
[2] Denyer, D., Cudworth, R., Sutliff, M., and Steinmann, F. (2024). Measuring and Managing Organisational Resilience. Cranfield University and Resilience First. https://resiliencefirst.org/what-we-do/organisational-resilience/
[3] ReMA https://www.undrr.org/resilience-maturity-assessment-tool
