Culture, Capability & Organisational Resilience
Build resilience into the way the institution works.
Technology and controls alone cannot create a resilient university.
Sustainable resilience depends on people understanding their responsibilities, leaders having clear accountability, information and services having effective ownership, and institutional teams having the capability to operate securely and respond effectively when things change or go wrong.
Expede helps universities strengthen the governance, culture, skills and organisational capabilities required to make resilience part of everyday institutional operation.
The Challenge
Resilience is a shared institutional responsibility.
Digital risk rarely sits neatly within one team.
Critical services cross organisational boundaries. Information is created and used across faculties and professional services. Technology decisions involve multiple owners and suppliers. Cyber incidents require coordinated institutional responses. Transformation changes processes, roles and behaviours as well as technology.
Yet accountability can be fragmented, responsibilities unclear and capability unevenly distributed.
This creates familiar questions:
Who owns the risk?
Who is accountable for the service or information?
Who makes the decision when priorities conflict?
Do people understand what is expected of them?
Does the institution have the capability to operate what it has implemented?
Expede helps universities turn those questions into clearer governance, stronger ownership and sustainable operating capability.
Governance, Accountability & Capability
Make responsibility clear and actionable.
Effective resilience begins with clear accountability.
We work with institutional leaders and specialist teams to define how digital resilience, cyber security, information governance and critical-service responsibilities should operate across the institution.
This can include:
- governance and decision-making structures;
- executive and board accountability;
- roles and responsibilities;
- risk and control ownership;
- critical-service ownership;
- information asset governance;
- policy and standards frameworks;
- assurance and reporting;
- capability and skills assessment; and
- target operating models.
The objective is not to add bureaucracy.
It is to ensure that the right people understand what they own, what decisions they are expected to make and what evidence they need to demonstrate effective control.
Culture, Change & Adoption
Turn new controls and processes into normal ways of working.
A new policy, technology or operating model only creates value when people understand it and use it effectively.
Expede helps institutions build the organisational change required to embed new resilience capabilities into day-to-day operation.
Our work can include:
- stakeholder analysis and engagement;
- organisational change planning;
- communications and adoption;
- security culture and awareness;
- role-based capability development;
- leadership engagement;
- process and policy implementation;
- knowledge transfer;
- operating-model transition; and
- measurement of adoption and effectiveness.
We work alongside institutional teams so that change is understood, owned and sustained rather than remaining dependent on external consultancy.
Information Asset Governance
Give important information clear ownership.
Universities hold information of significant academic, operational, commercial and personal value.
Research data, intellectual property, student and staff information, commercially sensitive material and institutional records all need appropriate ownership, risk management and protection.
Expede helps institutions establish or strengthen Information Asset Governance so that important information is identified, owned and managed according to its value, sensitivity and institutional importance.
Information Asset Ownership
Define information assets, accountable owners and supporting roles, with clear expectations for classification, access, risk, lifecycle and assurance.
Depending on the institution's governance model, this can include SIRO, Information Asset Owner (IAO), Information Asset Administrator (IAA) or equivalent roles.
Information Asset Risk Management
Connect information ownership to practical risk management - maintaining appropriate registers, identifying material exposure, assigning controls and creating evidence for governance and assurance.
The aim is to move information governance from a compliance exercise to an active part of institutional resilience.
CASE-STUDY
Portfolio Showcase
Organisational Change in Practice
Kingston University London wanted to improve its ability to understand student engagement and direct institutional support to students who needed it most.
Expede supported an institution-wide programme that required technology, information, people and business processes to work together.
The engagement included:
analysis of institutional strategic aims and objectives;
identification and validation of relevant data sources;
development of a model representing levels of engagement;
definition of different engagement and support scenarios;
creation of intervention plans mapped to responsible institutional roles;
solution requirements, procurement and deployment; and
embedding the associated business-process change.
While the programme addressed student engagement rather than digital resilience, it demonstrates an important principle underpinning Expede's work: technology-led change only succeeds when ownership, information, processes and people are designed to work together.
That same principle applies to building sustainable organisational resilience.
Underpinned by the Unified Digital Resilience Framework
People, governance and organisational capability are integral components of digital resilience.
The Expede Unified Digital Resilience Framework (UDRF) connects institutional obligations and risk to the capabilities, controls, responsibilities and evidence required to manage them.
This means organisational issues can be assessed alongside technology and security rather than treated as separate cultural concerns.
Weak accountability, unclear ownership, capability gaps or ineffective information governance can therefore be identified, prioritised and improved as part of the same institutional resilience model.
Organisational resilience capabilities we help strengthen
Governance & Accountability
Establish clear structures for decision-making, escalation, ownership and assurance across digital resilience and cyber security.
Executive & Board Engagement
Give senior leaders the information, governance mechanisms and confidence required to understand material digital risk and oversee improvement.
Information Asset Governance
Identify important information assets, assign appropriate ownership and supporting roles, and embed effective governance throughout their lifecycle.
Information Asset Risk Management
Maintain meaningful information-asset registers, understand exposure, assign controls and provide evidence that material information risks are being managed.
Roles, Responsibilities & Operating Models
Clarify who is responsible for critical services, controls, risks and operational activities and ensure responsibilities work in practice.
Security Culture & Behaviour
Develop a culture in which people understand digital risk, recognise their responsibilities and make better-informed security decisions.
Skills & Capability Development
Identify capability gaps and build the knowledge, skills and confidence required to operate and sustain resilience improvements.
Organisational Change & Adoption
Ensure new technology, processes, policies and operating models are understood, accepted and embedded into everyday working practices.
Policy & Standards Adoption
Translate institutional policy into practical requirements, ownership, implementation and evidence rather than documents that exist only for compliance.
Knowledge Transfer & Sustainability
Build internal capability throughout delivery so that improvements continue after Expede's engagement has ended.
Satisfying 1 of EDUCAUSE’s Top 10 IT Issues
Expede Consulting’s Student Engagement services satisfy the following Educause requirements