Supply chain disruptions. Cyberattacks. Extreme weather. Geopolitical uncertainty. Regulatory upheaval.
Organizations are spending millions to prepare for these threats, yet many leaders find disruptions just as hard to navigate as before if not harder. The problem isn't how much is being spent, but where.
David Fairnie, Principal Consultant specializing in supply chain security, puts it plainly: “Organizations are making mistakes by funding solutions before they've identified the critical business impacts or services and the dependencies. It's not necessarily spending too little. It's spending without a clear line of sight to what you're trying to achieve from a business point of view.”
The result is a resilience gap: rising investment without a matching gain in agility.
Why resilience spending misses the mark
Many budgets are built around the last crisis. A supplier fails, so monitoring tools are purchased. A new regulation lands, so compliance spending rises. A storm disrupts operations, so investment targets that one scenario.
These responses can be valuable, but they leave organizations prepared for yesterday's problems. “Too often, organizations budget in response to the last disruption rather than preparing themselves for the future,” says Fairnie. Meanwhile, the dependencies that made them vulnerable go unaddressed, and success is still measured by costs avoided rather than value protected.
Start with mapping, but don't stop there
Fairnie argues that supply chain mapping deserves a dedicated share of the budget. “Allocate a proportion of budget for mapping purposes without a doubt because that gives visibility, and it allows leadership to make decisions, particularly around budget.”
As supply chains grow more complex, leaders need a clear picture of suppliers, logistics networks, technology systems, data dependencies, and critical services. Without it, decisions rest on assumptions rather than operational reality. But visibility is a means, not the goal. The real objective is to understand exposure.
The ROI executives should be measuring
Resilience leaders often struggle to prove return on investment (ROI). Unlike revenue-generating projects, resilience spending is seen as insurance or a cost center, which makes funding hard to secure.
Fairnie recommends a different framework: “I would approach it around measuring financial exposure as well as operational risk and capability together.” Instead of focusing only on cost, organizations should evaluate:
- Revenue protected.
- Service delivery protected.
- Reduction in disruption exposure.
- Speed of detection and decision-making.
- Recovery performance.
- Operational continuity.
“What you're talking about is combined loss avoidance—how much revenue and service is protected,” he explains. This reframes resilience from a defensive expense into a business-performance conversation, which executives find easier to support.
The 2027 risk: Compounding disruption
Looking ahead, Fairnie believes the most underestimated risk is not any single geopolitical event, cyberattack, or weather incident, but the interaction between them. “A triggering event might be small, but it's interconnected, and it can make a systemic impact across an organization.”
Traditional risk models assume disruptions occur independently, and today's environment shows otherwise. Leaders need to plan for interconnected events with second- and third-order consequences, not isolated incidents.
The question is no longer which region is risky
Organizations also tend to focus too heavily on geography, which Fairnie suggests should be repositioned to “Where do we have concentrated exposure, particularly if we don’t have an alternative?”
Whether the concern is maritime routes, semiconductors, critical minerals, batteries, or strategic suppliers, the issue is rarely location alone but concentration without alternatives. “It's where we concentrate as an organization, where our exposure is concentrated, and from a mitigation point of view, what alternatives should we be building into that?”
The 2027 playbook: Map, test, invest
Fairnie's framework is simple. “Map all those critical dependencies and then test them, particularly around compounding scenarios.” Those tests should model simultaneous events, such as extreme weather, supply interruptions, technology failures, and operational impacts hitting at once.
Only then should budget follow, he says. “Define the criticality to continue business and build resilience. Invest accordingly.”
For organizations building their 2027 budgets, Fairnie suggests understanding your dependencies, identifying concentrated exposures, preparing for compounding disruption, and investing with purpose. Resilience can no longer sit within a single function.
Are your resilience investments reducing risk or simply increasing visibility?
BSI Consulting helps organizations identify critical dependencies, assess resilience maturity, test disruption scenarios, and build integrated resilience programs that strengthen supply chains, operations, technology, and business continuity. Contact our experts to learn more.
