Business Continuity

The Chinese use two brush strokes to write the word ‘crisis.’ One stroke represents danger while the other represents an opportunity. In a crisis, be aware of the danger, but always be cognizant of the opportunity.

Every crisis is an opportunity. Yes, “every crisis is an opportunity”. To be effective in mitigating a crisis, inspired leadership recognizes this reality.  A crisis is a stage. Your ‘audience’ are your employee family, your customers, their customers, your shareholders, your financial partners, your shareholders, the media, the regulatory and legislative communities, your neighbors and your family. There are also dozens of obvious and not-so-obvious ‘audiences. How you respond to a crisis presents multiple stages and the opportunity of multiple appearances allowing the face and voice of the brand to remind your key communities why they trust you or should.

Author Paul Brunton once said, “Every crisis successfully met is rewarded by some growth in intuitive knowledge, strengthening of character, or initiation into a higher consciousness.’  Brilliant and inspired strategies such as the successful management of the Johnson & Johnson Tylenol crises have these key learnings.5

"It is essential to have the right resources on the team who can manage a crisis. Having a complete crisis plan that has been socialized throughout the organization and is reviewed annually is as important as having insurance."6

CASE STUDY - GOOD PRACTICE GUIDELINE (GPG)

Based on: The Good Practice Guidelines (GPG) the independent body of knowledge for good Business Continuity practice worldwide. They represent current global thinking in good Business Continuity (BC) practice and now include terminology from ISO 22301:2012, the International Standard for Business Continuity management systems.
Contributed by: Avalution.com- Overview of GPG Professional Practice 1 (PP1) – Policy and Program Management, the first of the six professional practices, and discusses the importance and recommendations in establishing the foundation for a repeatable and scalable business continuity program.

When organizations decide to implement a business continuity program, many tend to jump straight into tactical program elements (such as conducting a business impact analysis and developing plans), thus ignoring the need to first set a strong program foundation on which to build those program elements. While tactical elements are often the most visible, there are multiple reasons why an organization should put in the effort to follow the guidance provided in PP1.

Consider the following case study that illustrates why organizations benefit from establishing a repeatable program and a policy before jumping straight to implementing tactical elements of the business continuity lifecycle.

Company X’s Board of Directors issued a directive for the organization to implement a business continuity program.  To comply with the directive, the organization charged an internal resource as the business continuity coordinator to begin this process.  After reading a number of web articles, the coordinator decided, to begin with performing the business impact analysis and writing business continuity plan documentation.  After plan documentation was finalized, the coordinator realized a few major concerns:

• She didn’t know if the organization could really meet management’s expectations if a disruptive incident were to actually occur
• She realized that her efforts were a point-in-time evaluation, and didn’t know how the efforts would continue after the initial effort
• She didn’t think the organization was actually in a much better position than it was before her efforts because it had not invested any resources into having actual recovery capabilities (e.g. alternate workspace or IT disaster recovery)
• The people that she originally wanted to participate in the efforts did not actually participate as they delegated down to lower levels of the organization

Due to these concerns, the business continuity coordinator began performing more research and talking to industry groups. This additional research made her realize that she did not establish a program before performing business continuity-specific activities.  Therefore, she did not gain the results she was hoping to accomplish. The coordinator then took a step back and implemented the following actions:

• Developed, presented, and received endorsement from top management for her business continuity policy, which was published and communicated to the organization
• Developed standard operating procedures, which outlined the process by which she implemented the business continuity activities in order to ensure the process would keep occurring on a recurring basis
• Chartered a steering committee who provided input on the program’s scope and downtime tolerances, reviewed and approved findings and investments, provided leadership, and ensured the ‘right’ level of participation and support

Following these actions, the coordinator found that the program was aligned to the organization’s strategic objectives, supported by the appropriate levels of the organization’s senior management, and could actually meet internal and external stakeholder expectations during an actual disruptive incident.

CONCLUSION

The guidance found in the BCI Good Practices assists practitioners in understanding and implementing the program while ensuring consistency with international standards found in ISO 22301.77-8

Planning Resources

Department of Health and Human Services (DHHS)

http://www.dhhs.gov/nvpo/pandemics/index.html 

Business Pandemic Influenza Planning Checklist (DHHS)

http://www.pandemicflu.gov/plan/pdf/businesschecklist.pdf 

Avian Flu Website (DOD)

Centers for Disease Control (CDC)

http://www.cdc.gov/flu/avian/index.htm 

World Health Organization (WHO)

WHO | World Health Organization

U.S. Department of Veterans Affairs (VA)

Department of Agriculture (USDA)

USDA

Department of Labor Occupational Safety and Health Administration (OSHA)

Disaster Recovery Assistance | U.S. Department of Labor (dol.gov)

Department of State

U.S. Agency for International Development (USAID)

Security and Prosperity Partnership of North America (The North America Plan for Avian & Pandemic Influenza)

Barbara Frumenti

About the author

Barbara Frumenti

VP Business Continuity Services