“We ran a Microsimulation where Microsoft went down. That weekend, Microsoft actually went down. We were prepared.” This isn’t luck. It’s the new standard of resilience at ESR.
In a recent product masterclass, we had the opportunity to speak with Sue Chapman about her journey and the impact of her work in capability buiding. As the Resilience Manager at ESR (Institute of Environmental Science and Research), New Zealand’s Crown Research Organisation, Sue has led a remarkable shift from traditional, resource-intensive tabletop exercises to a Microsimulation program that has revolutionised ESR’s resilience capabilities.
The Gamechangers in Resilience series highlights visionary leaders who are redefining resilience by sharing their innovative strategies, impactful experiences, and practical insights to inspire and empower others in the field.
Q: Could you tell us about your background and current role?
I’m originally from the UK, but New Zealand is where I’ve chosen to call home for the last decade or so. For the last five years, I have been working for ESR, the Institute of Environmental Science and Research. We’re the Crown Research Organisation that specialises in science for the New Zealand government. We do a lot of work for the National Public Health Service, were heavily involved with the national response to COVID, and do a lot of work with the New Zealand police with our forensic science.
Q: What was the resilience culture like when you first started at ESR?
New Zealand does have a very big culture of ‘She’ll be right, mate.’ We’ve moved on from that and we now have full engagement, full commitment from the CEO and our executive team. When I started, plans were being written and left on the shelf to gather dust. Now each of the five business groups has a business continuity lead, and they have dedicated incident management teams.
Q: What did your scenario training program look like before you implemented changes?
It would be similar to most organisations where we would typically run one session a year, either a full day or a half day. In New Zealand, we are on the fault line, and you’d guarantee the scenario would be around an earthquake. We’d have to fly people in from all over the country into one site. It would take months of advanced planning just to run the session.
Q: What were the downsides to that traditional approach?
We would usually bring an external company in to run that session for us. They would typically give recommendations, but people would tend to ignore them and then just wait for the next year. We actually did little pre-planning to support the teams going into them sessions. It’d just be sink or swim, let’s see who can perform. We were just setting our teams up for failure doing it that way.
Q: What inspired you to change this approach?
2024 was certainly an interesting year to get people over the line and out of that mentality that we’re going to bring everybody together for a half day, full day, or two days. That I’m actually only wanting 30 minutes of their time was just a big shift in people’s perception. We got away from ‘let’s have another earthquake’ to really getting into a range of different scenarios.
Q: What results have you seen from implementing the Microsimulation program?
We ran 26 Microsimulations in 2024. 130 different members of staff engaged with the platform to be a part of one or more scenarios. We had a massive 90% plus attendance rate, largely because of the dedication that our leadership team had shown up front. And a massive 95% of the objectives that we raised up front were met. The feedback that we received, was second to none.
Q: How have the teams responded to this new approach?
Our biggest success with Microsimulations has definitely been with our IT team. Our chief information officer would usually come to me and say, ‘Please don’t run a cyber attack. Please don’t run your data center that’s had a big disruption because it’s always got a security lens over it.’ Now they’re just embracing them, and it’s kind of like, “Whatever’s on our business continuity risk register or our organisational risk register, I can work with it”.
Q: How have these Microsimulations translated to real-world situations?
We ran a Microsimulation with our IT team where we had Microsoft taken out. That weekend, Microsoft went down. We had the plan in place because we’d done this before. Then we ran the same one with our finance team where we had our payroll system went down. And then it was literally within days the payroll system went down. And because we were all thinking in that mode, we were prepared.
Q: How has the leadership’s perception changed?
I actually met with our chief executive earlier this week. We were talking about a scenario that I ran this week, and he’s like, ‘How are you going to run an earthquake in a couple of hours or 90 minutes?’ I was like, ‘How we’re going to run it in a full day if we brought everybody in for a day’. We’re just doing it at speed. The feedback I got, because it was the chief exec’s first time involved, he was just like, ‘That was absolutely phenomenal.’ This was the director general of health through COVID saying, “I’ve never seen one run so smoothly.”
Q: What’s been the most valuable aspect of the Microsimulation program?
The learning loops for us have been absolutely invaluable. The instant feedback that you get at the end of Microsimulation has been amazing. I can send that report almost instantaneously to the BCP lead or whoever’s co-facilitated it with me. And we’re able to create action plans and close any gaps within half an hour. Some of the gaps I can even close instantly.
Q: How has this changed your reporting to leadership?
Up until 12 months ago, I never had to do any reporting to the board. It stopped at that executive level and maybe two or three times a year, I would do a report to our executive leadership team. I actually did a report to our board in November/December of last year. First time that we’ve had to report the resilience program and they were just absolutely blown away at the level of different Microsimulations that we’re looking at.
Q: What’s your vision for the future of this program?
I’m going to run 100 micro simulations in 2025. Even at the beginning of the year when I started, I was like, ‘Oh, that’s eight a month. Is that possible?’ And now because of the QR code we’ve implemented, I’m like, ‘We can easily do that.’ This month already we’ve had 85 different people attend a Microsimulation. The board are pushing us for even harder reporting and harder scenarios.
Q: What’s been your proudest achievement in this transformation?
Our biggest achievement has definitely been that they don’t rely on me. Now I say, if I’m doing my job well enough, people will put me out of a job and make me redundant because they can do it themselves. They’re just getting to where they are really embracing just doing this by themselves, and I can now sit back and just have an overview or look at some of the more complicated ones.
Q: Would you ever go back to the traditional approach?
Hand on heart, I don’t think I would ever go back to a full desktop scenario when we can just run these so quickly every month. I would never go back.
Q: How do you know your work is making a difference beyond ESR?
I was talking to our chief information officer just yesterday. She sits on a group of our Crown Research Institutes, and they were talking about rating your business continuity and resilience testing on a scale of 1 to 10. All the other Crown Research Institutes were like, ‘Oh, one, two, we don’t really get time to test it.’ And our chief of information was like, ’10. If it happened, we’ve got the systems, we’ve got the team, we know the plans, and we’re all trained.’ It made me have that little, ‘Oh, it’s working’ moment.
Conclusion
Sue Chapman has transformed resilience training at ESR by shifting from resource-intensive annual exercises to regular, focused Microsimulations. Her innovative approach has created a resilience program that is more engaging, more effective, and better suited to today’s dynamic threat landscape. The results speak for themselves, with teams now confidently prepared for real-world disruptions and leadership fully engaged in the process. Sue’s journey demonstrates how one person can truly be a gamechanger in organisational resilience.
Missed the replay? You can watch it on-demand here.
