Your goal is a mature, robust Business Continuity Management System – one of the key requirements for a more resilient organization. Significant amounts of time, effort, and energy have been invested, and the result is a program that aligns with ISO 22301 and meets organizational goals; one you may even view as perfect. But wait, nothing is ever perfectly perfect. Even the best Business Continuity Program cannot rest on its laurels. Things change quickly, and as with organizations and people, Business Continuity programs must continue to adapt, adjust, and mature to grow stronger, more robust.
To maintain an effective continuity capability takes ongoing thought, creativity, resourcefulness, and commitment. Once the initial roll-out of the program is complete, it can be tempting to avoid updates that go beyond meeting basic requirements. Your program must be a living process that allows rapid adjustment to change. True resilience requires identifying what can be done to ensure continual improvement – even beyond standards, regulations, and laws – and to continue the efforts to ensure that Business Continuity Management is an integral part of the organization’s culture and day-to-day operations.
Conduct an unbiased appraisal of your Business Continuity Management Program. Include the following four continuity essentials that contribute to program maturity and continual improvement: business continuity capability, external continuity planning, human factor considerations, and reviews and revisions.
Business Continuity Quality
Take a step back and assess the program: are continuity strategies at an optimum for your company, or were they selected because they were the first suggested? What has been done in the past? What another organization does, or what is the easiest to implement?
Honestly evaluate where your program stands today – not when it was first implemented or where you want it to be in the future. In addition to internal and external audits, has your program been reviewed by someone who is not involved in its development or ongoing management? A fresh set of eyes often sees previously overlooked things and new opportunities for improvement.
Does the program contribute to the organization’s resilience? Is there full coordination and collaboration among all plans throughout the organization? Has consideration been given to whether (and to what degree) your continuity strategies and plans coordinate with all other existing requirements, policies, plans, and processes? Identify disconnections and overlaps which need improvement.
External Continuity Planning
Avoid inheriting external risks. Take an in-depth look at your suppliers, outsourcing companies, shippers, and other business partners. Include Business Continuity capability, not just price and quality, when selecting contractors, vendors, or service providers or when renewing existing contracts.
Consider including business partners in the continuity planning process. Listen to their concerns; consider their suggestions. Working with your suppliers, service providers, and outsourcing companies is mutually beneficial and the most effective way to establish and strengthen working partnerships that benefit all stakeholders – before, during, and after a disaster or disruptive event.
Human Factor Considerations
Employees must be included in all aspects of Business Continuity planning. While the planning process addresses operations, technology, facilities, and security, it is just as important to give equal attention to employee preparedness. Has the organization adopted a policy that makes the company’s concern regarding staff welfare official? Has that policy been converted to action? Implement plans to keep employees informed in the event of a disaster, with information such as when and where to report and on the progress being made towards full restoration of operations.
Take steps to ensure that staffing for critical operations is available by providing cross-training. Develop succession plans for all key employees.
Reviews and Revisions
The world is not static, nor is your organization. Think about all the changes in your organization over the past three months, six months, a year. For most, this will result in a significant list. And the reality is that a great percentage of the items on the list may require some level of changes or additions to your continuity strategies, staffing, and plans. Frequent reviews and revisions to address changes in operations, supply chain links, regulatory requirements, facilities, and technology will ensure that your plans will serve your company well when the need arises. Assign responsibility for conducting and signing-off on not-less-than annual reviews with specific due dates
Testing the plan with regularly scheduled tests and exercises will also help identify required changes and enhancements. While carrying out a comprehensive plan of training, exercising, and testing is not easy, it is the make or break of success when a disruption or disaster occurs.
Is there a process in place to track near-misses and small disruptions to ensure that the valuable lessons these non-planned tests can provide are taken into consideration? These mini events provide great opportunities for training people and testing plans.
Next, a Look in the Mirror
Demands on Business Continuity professionals have never been greater, often leading to a failure to make time to devote to considering the bigger picture. Stop and remind yourself of the value of continuity and resilience to the organization and all its interested parties. Even those directly and indirectly concerned with continuity planning may deceive themselves into believing that the work is done and that the program is so good that it can simply be set on autopilot. This poses a danger to all organizations, whether they are seeking certification or recertification.
As a beginning, check to see if these steps are fully incorporated in your Business Continuity Program and carried out as planned:
- Keep your executives and board members informed about the Business Continuity Program.
- Educate all employees on the importance of continuity planning and their role and responsibilities, no matter how small. Do they know what the organization expects from them and what they can expect from the organization when a disaster occurs?
- Involve representatives from all key business units in the planning process. Recognize and address their challenges and fully consider their ideas and suggestions.
- Continue to scan the horizon to identify and address new threats to operations, both internal and external.
Make a renewed commitment to initiate and follow through with ongoing maintenance and continual improvement of your organization’s Business Continuity Management Program. Avoid complacency – be proactive and step out of the box. Identify opportunities to continually improve your company’s continuity capability rather than coasting. Seek new ways to further embed continuity in the company culture. Revamp initial continuity training to make it more relevant to all employees.
Take a hard, unbiased look at the program, the team, and yourself.
- Take a hard, unbiased look at the program, the team, and yourself.
- Is your organization’s Business Continuity Program continually improving, maintaining the status quo, or falling behind?
- Has there been measurable progress and improvement within the past year?
- Do you consistently look for ways to develop and improve yourself, your role, and your fellow team members, as well as the Business Continuity and Resilience Capability of your organization?
- Do team members avoid simply checking boxes to meet an ISO standard, set of guidelines, or regulatory and legal requirements?
- Are you compliant with the requirements of your job description or committed to the objectives of the Business Continuity Program and to building a more resilient organization?
- Do you plan for program improvements and enhancements for at least a year ahead (and even better, three years)?
- Do you focus on a resilient Business Continuity Program? One that not only includes guidance for what to do when a disruption or disaster occurs, but seeks to improve your organization’s capability to address how to successfully manage risks and their impact on the organization’s future?
- Is your organization’s Business Continuity Program continually improving, maintaining the status quo, or falling behind?
- Has there been measurable progress and improvement within the past year?
- Do you consistently look for ways to develop and improve yourself, your role, and your fellow team members, as well as the Business Continuity and Resilience Capability of your organization?
- Do team members avoid simply checking boxes to meet an ISO standard, set of guidelines, or regulatory and legal requirements?
- Are you compliant with the requirements of your job description or committed to the objectives of the Business Continuity Program and to building a more resilient organization?
- Do you plan for program improvements and enhancements for at least a year ahead (and even better, three years)?
- Do you focus on a resilient Business Continuity Program? One that not only includes guidance for what to do when a disruption or disaster occurs, but seeks to improve your organization’s capability to address how to successfully manage risks and their impact on the organization’s future?
Moving Toward Greater Resilience
- Keep in mind what Business Continuity was at its inception and what it is today, how it has steadily evolved and matured – and must continue to do so to fulfill its purpose.
- Commit to a more resilient Business Continuity Program – a key component of a resilient organization.
- Be creative, thoughtful; avoid “the way we have always done this.”
- Take proactive steps to evolve, grow, and improve as a Business Continuity professional and encourage your colleagues to do the same.
- Be fully aware of where your continuity program stands today.
- Determine the direction it needs to go.
- Develop a plan for getting there.
- Get the right people involved.
- Accept that there will be changes, challenges and setbacks along the way. Adapt, be resilient while building resilience.
Continuity and Resilience Share Mutual Goals
While this article focuses on Business Continuity, any discussion of Business Continuity today must include resilience and the relationship between the two. This is my take on this: If a resilient organization is one that is capable of functioning at the highest levels in all aspects of its operation and continue to meet its goals come what may; one whose operations and employees are flexible and prepared to manage disruptions; and one able to achieve its mission in spite of any type of disruption, or large or small disaster, then Business Continuity is a requisite for a resilient organization
On the other hand, if a Business Continuity Program requires the proactive management of new risks and threats; includes all areas of the enterprise and coordinates with related programs; remains open to consideration of new approaches, strategies, and technology, and always considers the best current and future interests of the organization, then resilience is a requisite for Business Continuity capability.
More importantly, it would seem to follow that the goal is cooperative collaboration between the two. After all, both continuity and resilience have a shared focus: protecting people, the organization’s assets, reputation and the interests of stakeholders by developing and maintaining the ability to quickly adapt to disruptions to ensure maintaining continuous operations.
