These are the questions Boards, CEOs and finance leaders ask most often about institutional resilience: what it means, how to see fragility early, and what to do first. Each answer is taken from The Resilient Institution (2nd edition), and points to the section of the book that goes deeper.
The book is free. You can read it online or download the complete edition free from Gumroad.
The questions
- What does institutional resilience really mean?
- How do we know whether our institution is genuinely resilient?
- What are the early warning signs of institutional fragility?
- Can strong financial performance coexist with weak institutional resilience?
- What should a Board monitor beyond financial statements?
- How much financial resilience is enough?
- How should Enterprise Risk Management move beyond a risk register?
- How can an institution protect donor confidence?
- How should Boards address leadership dependency and succession risk?
- What should leaders do first if they want to strengthen institutional resilience?
- How prepared are we for a cyber incident or data breach?
- How should the Board assess its own effectiveness?
1. What does institutional resilience really mean?
Institutional resilience is the capacity to continue the mission responsibly when conditions change. It is not the absence of disruption; it is the ability to absorb uncertainty, make sound decisions under pressure, preserve stakeholder trust, and adapt without losing institutional integrity.
The book treats resilience as a system rather than a single financial measure. Governance, financial sustainability, risk visibility, leadership depth, operational continuity, technology, compliance, stakeholder trust, and strategic adaptability reinforce one another. A resilient institution builds these capabilities before it needs them.
Ask your leadership team: Which parts of our institution would remain strong if funding, leadership, regulation or operating conditions changed suddenly?
Read more in The Resilient Institution, section 1.10 Board Governance as Strategic Infrastructure: free download or read online.
2. How do we know whether our institution is genuinely resilient?
Start by looking beyond whether policies exist. Examine whether the institution has evidence that governance and management systems actually work: forward-looking financial visibility, clear risk ownership, diversified funding, tested continuity arrangements, effective Board oversight, leadership succession, reliable data, and transparent stakeholder communication.
A useful test is to examine how the organisation behaves under stress. Can leaders identify emerging risks early? Can the Board see the implications before a crisis? Can the institution continue critical operations and maintain trust while responding? Resilience is demonstrated through preparedness, not optimism.
Ask your leadership team: If a major disruption occurred tomorrow, what would fail first—and what evidence do we have that we could respond?
Read more in The Resilient Institution, section 1.1 Board Evolution Journey and 1.2 Governance Maturity Model: free download or read online. To check your own organisation, use the Institutional Governance Maturity Assessment Toolkit.
3. What are the early warning signs of institutional fragility?
Fragility often appears in small signals before it becomes a visible crisis. Examples include increasing dependence on a small number of donors, weak documentation, declining liquidity visibility, unresolved audit or compliance issues, excessive dependence on key individuals, poor cyber hygiene, delayed reporting, weak succession planning, or growing gaps between programme ambition and financial capacity.
The leadership task is to identify patterns and understand how apparently manageable issues may compound. This is why the book emphasises dashboards, risk intelligence, scenario planning and early-warning indicators.
Ask your leadership team: Which three indicators could deteriorate quietly for several months before appearing in our headline performance numbers?
Read more in The Resilient Institution, section 2.2 Invisible Risks Often Become the Most Dangerous Risks: free download or read online. To check your own organisation, use the free Governance Quick Assessment (about 15 minutes).
4. Can strong financial performance coexist with weak institutional resilience?
Yes. A healthy current financial position does not automatically mean that the institution is resilient. An organisation may report a surplus while remaining highly dependent on one donor, one leader, one funding model, or one operational system. Similarly, clean historical accounts do not by themselves provide forward visibility.
Financial strength is one component of resilience. Leadership should therefore examine the quality, predictability and flexibility of financial resources alongside governance, risk, operations and stakeholder trust. The relevant question is not simply whether the institution is financially healthy today, but whether it can sustain the mission when assumptions change.
Ask your leadership team: Which of our current strengths are genuinely structural, and which depend on conditions that may not continue?
Read more in The Resilient Institution, section 1.5 From Historical Reporting to Forward Visibility: free download or read online.
5. What should a Board monitor beyond financial statements?
Boards increasingly need a forward-looking view. Alongside financial performance, they should have visibility into liquidity, funding concentration, strategic risks, operational resilience, compliance, cybersecurity, data protection, leadership succession, reputational exposure, programme performance, and stakeholder trust.
The purpose is not to turn the Board into management. It is to ensure that directors receive timely information that enables informed oversight and challenge. A concise resilience dashboard can help the Board see trends, thresholds, exceptions and emerging issues without becoming buried in operational detail.
Ask your leadership team: Does our Board reporting tell us mainly what happened, or does it also show what may happen next?
Read more in The Resilient Institution, section 1.4 The Expanding Responsibility of Boards: free download or read online. To check your own organisation, use the Institutional Governance Maturity Assessment Toolkit.
6. How much financial resilience is enough?
There is no single reserve level that is appropriate for every mission-driven institution. Financial resilience depends on the organisation's funding model, contractual commitments, cost structure, liquidity profile, donor concentration, operating volatility and ability to adjust expenditure.
The more useful approach is to define the level of liquidity and reserves needed to withstand plausible stress scenarios. Scenario planning can test funding delays, donor loss, unexpected expenditure, regulatory disruption or other shocks. The resulting reserve policy should be understood by the Board and linked to the institution's risk appetite and sustainability objectives.
Ask your leadership team: What period of critical operations could we sustain if a major expected funding inflow were delayed?
Read more in The Resilient Institution, section 1.8 Governance During Uncertainty: free download or read online. To check your own organisation, use the Donor Concentration and Reserves Early-Warning Sheet ($29).
7. How should Enterprise Risk Management move beyond a risk register?
A risk register is useful, but it is not the risk management system itself. Effective Enterprise Risk Management connects risks to strategy, ownership, financial planning, resource allocation, decision-making and Board oversight. It should help leadership identify emerging risks, test assumptions and understand what could threaten mission continuity.
Risk culture is equally important. Teams need to be willing to surface uncomfortable realities early, escalate issues and learn from incidents. Scenario planning and stress testing then turn risk information into preparedness. The objective is not to eliminate uncertainty; it is to improve the institution's ability to respond intelligently.
Ask your leadership team: Which risks in our register are actually changing decisions, budgets, priorities or behaviour?
Read more in The Resilient Institution, section 2.3 ERM as an Early-Warning System: free download or read online. To check your own organisation, use the Enterprise Risk Management Assessment Toolkit.
8. How can an institution protect donor confidence?
Donor confidence is built through consistent evidence of governance, transparency, financial stewardship, credible reporting and delivery against commitments. It is also protected by communicating risks early rather than allowing surprises to emerge through external channels.
The book treats donor financial stewardship as part of institutional credibility. Grant financial monitoring, documentation, compliance, reporting quality, funding concentration and communication should therefore be connected rather than managed as separate administrative activities. Trust becomes an institutional asset when it is supported by reliable systems and behaviour.
Ask your leadership team: If a donor conducted a deeper due-diligence review tomorrow, where would we expect questions—and are we ready with evidence?
Read more in The Resilient Institution, section 1.10 Board Governance as Strategic Infrastructure: free download or read online. To check your own organisation, use the Donor Concentration and Reserves Early-Warning Sheet ($29).
9. How should Boards address leadership dependency and succession risk?
Institutions become vulnerable when critical knowledge, relationships or decisions reside with a small number of individuals. Leadership succession is therefore not simply an HR process. It is a governance and continuity issue.
Institutional memory should be captured through documented decisions, financial architecture, governance records, key relationships, policies, processes and lessons learned. Boards should also understand the capabilities required for future leadership rather than waiting for a transition to occur. The objective is continuity of mission and institutional knowledge, not dependence on individual personalities.
Ask your leadership team: If our CEO, Board Chair and key leaders left within six months, what knowledge and relationships would be difficult to replace?
Read more in The Resilient Institution, section 11.2 The Leadership Concentration Risk: free download or read online.
10. What should leaders do first if they want to strengthen institutional resilience?
Begin with visibility. Leadership cannot strengthen what it cannot see. Establish a concise view of financial sustainability, liquidity, funding concentration, strategic and operational risks, compliance, leadership dependency, technology and stakeholder trust. Then identify the few vulnerabilities that could most threaten mission continuity.
From there, build a practical improvement sequence: clarify accountability, strengthen critical controls, improve forward-looking reporting, test scenarios, address capability gaps and monitor progress through a small number of meaningful indicators. Institutional strengthening is usually more effective when it is continuous and prioritised rather than launched as a large theoretical transformation programme.
Ask your leadership team: What are the three institutional weaknesses we would most regret leaving unaddressed for another twelve months?
Read more in The Resilient Institution, section 10.5 Institutional Resilience Is Strategic: free download or read online. To check your own organisation, use the free Governance Quick Assessment (about 15 minutes).
11. How prepared are we for a cyber incident or data breach?
Digital exposure grows as institutions digitise donor, beneficiary and financial data. A breach is a governance and trust event, not only a technical one: it can affect beneficiaries, funders, legal obligations and reputation at the same time.
Boards should know where sensitive data sits, who can access it, how incidents are detected and escalated, and whether the response plan has been tested. Reliable backups, regular access reviews and a rehearsed incident plan matter more than the number of tools in use.
Ask your leadership team: If our donor or beneficiary data were exposed tonight, who would decide what to do, and how quickly?
Read more in The Resilient Institution, section 9.4 Board Responsibility in Cyber Governance: free download or read online. To check your own organisation, use the Enterprise Risk Management Assessment Toolkit.
12. How should the Board assess its own effectiveness?
Boards oversee everyone else's performance but rarely review their own. Yet the quality of Board composition, information, challenge and follow-through shapes institutional resilience more than almost any other factor.
Hold a structured annual self-assessment covering the range of expertise, the quality of information received, time spent on strategy rather than routine approvals, committee effectiveness and follow-up of decisions. Act on the gaps, including through Board renewal and development.
Ask your leadership team: When did our Board last change a significant management proposal because of its own challenge?
Read more in The Resilient Institution, section 1.9 Characteristics of High-Performing Boards: free download or read online. To check your own organisation, use the Institutional Governance Maturity Assessment Toolkit.
General guidance for governance and education, drawn from the book. Adapt it to your organisation's size, funding and regulatory setting.