How to build an effective Business Continuity strategy
Dr Sandra Bell, Head of Resilience Consulting, Sungard Availability Services discusses why businesses need to consider business continuity and how to plan a strategy for it.
In order to survive and prosper in today’s fast-moving business environment, organisations need to constantly change so that they remain optimised to their environment. And, if that wasn’t bad enough, the risk landscape is now characterised by uncertainty, complexity and risks with adversaries leading to an increase in both the number and severity of operational disruptions. For example, the UK Financial Conduct Authority recently revealed a 138% increase in that number of significant technology outages reported to them within a single year.
Workplace change and disruption are therefore unavoidable and, however well they are managed, change and disruption always create uncertainty. Unless employees are adequately supported, uncertainty can very quickly lead to stress, arguments about priorities, self-preservation behaviours and disjointed responses to disruptive incidents.
Therefore, if organisations wish to be resilient, defined by the International Organisation for Standardisation as “the ability of an organisation to absorb and adapt in a changing environment to enable it to deliver its objectives and to survive and prosper,” they must have a strong commitment to supporting employees to adapt to change and cope with emergency situations so that they pull together rather than pull the organisation apart.
Business Continuity: the unlikely personal development tool
A rather unlikely tool that is helping people to cope with change and disruption is the frequently misunderstood discipline of Business Continuity. Most of us think of Business Continuity as simply a tool that allows us to continue some element of operations in the face of disaster by means of manual workarounds etc. A common analogy of Business Continuity is that it is like putting a road traffic accident victim in a coma – you shut down everything apart from those functions that sustain life.
Therefore, how on earth can such a blunt operational tool, that doesn’t even look at everything the organisation does, help forge an understanding right throughout an organisation sufficient to get everyone working toward the corporate goal rather than their local goal either in times of crisis or when they are investing in measures to avert or absorb them?
The answer lies not in the plans and capability required to sustain the life of the organisation’s operations, but in the processes that were used to work out what was needed.
Agreement on the top–level priorities
Before a Business Continuity Manager can work out which operational functions need to be maintained to prevent an operational disruption escalating to a strategic crisis, they must first get the organisation to define and agree the top level priorities of the organisation when disrupted. The health and safety of people and the protection of assets and the environment are clearly primary. But, having agreement on the next three or four business-related priorities will mean that all measures to absorb or adapt that are put in place across the organisation can be implemented with those priorities in mind.
Appreciation of each other’s roles and responsibilities
The Business Continuity process involves identifying the business processes and related dependencies, such as IT applications, suppliers etc., that support the operational functions that need to be maintained to meet the high-level priorities and the impact that would ensue if they were lost. This allows the identification of appropriate Business Continuity strategies, such as replication, post incident acquisition or diversification of activity to be designed.
Whilst such information is useful to the Business Continuity Manager to make the business case for the purchase of capabilities such as alternative workplaces or IT Disaster Recovery, it also graphically illustrates how disparate roles and responsibilities in an organisation mesh together to create a common output. Such illustrations can be used extremely effectively to cut through corporate politics.
Developing cross-organisational supportive relationships
One of the biggest blockers to resilience at the organisational level is individual people, teams or departments just looking after themselves. For example, an IT Department that focusses solely on achieving uptime targets or an operational team concentrating on meeting their output targets when they know that the teams they are delivering to are struggling to keep pace. Business Continuity examines the internal relationships for priority activities in detail and can therefore provide a basis for greater understanding and empathy between people, teams and departments.
Nurturing innovation
Resilient organisations are those that are able to display innovation in the face of adversity. However, the innovation process requires people to have the confidence to innovate together with time to think and experiment. The Business Continuity process not only provides clarity on the priority organisational processes, a set of exemplar responses for anticipated scenarios, but, through training and exercise programmes, a safe environment to experiment and practice innovation under stress.
Therefore next time someone says you need to update your BIA or attend a table top exercise, don’t think of it as you wasting your time to help the Business Continuity Manager write a plan and tick a compliance box, but an opportunity to find out what the business continuity process can do for you.
