Design and implementation of a business continuity management programme

The BCI World Conference and Exhibition is split into three streams - listen, learn and lead - and the idea behind the middle of these streams is to enable delegates to explore the full BCM Lifecycle training experience.

I will be doing this through presenting a selection of the material used in the Business Continuity Institute’s five day BCM course, highlighting the main elements of the process, and exploring some of the issues that need to be understood in the Design and Implementation stages of the process. The exploration will be through discussion and debate, into which I will provide the knowledge and experience that I have obtained over many years both teaching and practicing BCM in a wide variety of types of organisation.

In the Design session we will be exploring two issues which, in my experience, most people struggle with both in learning the theory of BCM and in practice when applying the theory to their own organisation:

• How close should the Recovery Time Objective be to the Maximum Tolerable Period of Disruption?
• What is a safe separation distance for recovery sites, alternative facilities, and backups?

In the Implementation session we will be exploring three issues, which although they are simpler than the two Design issues, still give rise to considerable debate:

• What is a Business Continuity Plan (BCP)?
• What are the common elements of all plans at all levels?
• What resources do you think are needed for a response team meeting room, and how do you think that space should be best utilised?

In each session I will take the delegates quickly through the main steps of the BCM process as they are taught in the BCI’s five day BCM course, pointing out some of the more important concepts and techniques that need to be learnt, and then, at the appropriate point, raise the issues that I have decided to explore. I will be asking the delegates for their views, encouraging debate on what the most appropriate solutions appear to be, and attempting to bring the discussion to a conclusion through explaining what the BCI’s Good Practice Guidelines (the GPG) recommends.

By attending the two sessions that I am presenting, you will get not only a flavour of what you’d learn on the BCI’s five day BCM course, but you will also get the opportunity to explore some of the Design and Implementation issues that you will need to know how to tackle if you are to help your organisation to successfully implement an effective BCM programme. It will also give you an opportunity to take part in a discussion and debate on some of the Design and Implementation issues that even experienced BCM professionals have difficulty with.

Mel Gosling MBCI has been an instructor for Continuity Shop on the BCI’s five day BCM course ever since it was first launched in 2008, when it was based on the 2008 version of the GPG, and has contributed to developing both the course and the GPG through the 2010 and 2013 versions. Throughout the past six years he has helped over 200 students achieve certification through passing the BCI’s exam, and has learnt how best to present the extensive and concentrated material in the GPG to enable students to both learn and understand the BCM process. Attending these two sessions will give you an insight into how Continuity Shop presents this course, and a taste of some of the issues that you will encounter.

Mel will be discussing design and implementation within the 'Learn' stream at the BCI World Conference on Thursday 6th November, starting at 10:30.

Seven deadly sins of business continuity plans

Recently I helped plan and deliver a workshop for the Scottish Continuity Group. The theme of the day was to give the delegates ideas of ways to improve their plans. Presentations were given on a number of aspects of planning - including short plans, using business continuity software, the army way of planning and different ways to set out your plans. I gave a talk at the beginning of the workshop to set the scene. It was entitled 'The Seven Deadly Sins of Business Continuity Plans' and I thought I would share the main points with you.

Sin 1 – Unnecessary information

Many Business Continuity Plans I see seem to be full of unnecessary information which is not needed on the day of the incident. They contain policy information, details of when the plan was last exercised and how business continuity is managed within the organisation. I believe that the plan should only contain information which you are going to use on the day of the incident. All the other information should be kept in a separate document.

Sin 2 - Samey

“When something remains consistent when one would expect there to be more variation”.

This is where the plan initially looks good, with lots of detail, and it appears that lots of thought has gone into it. You then read a number of plans within the organisation and you find that almost all the plans are exactly the same. The call centre plan looks exactly the same as the finance plan, except for the name on the front. This says to me that business continuity within the organisation is not taken seriously and the organisation is happy for its plans to be cut and pasted from one department to the next. Of course there will be some parts that need to be the same in all plans, such as the incident management hierarchy, but make sure that your plan is properly tailored to your part of the organisation.

Sin 3 – Connection to the BIA

Many organisations have a large and elaborate Business Impact Analysis (BIA), which capture vast amounts of information. When you come to looking at the plan there is nothing in it recognisable in the BIA. The BIA has a vital part in informing the recovery strategy and key information such as the system recovery order, how many seats the department needs over a timeframe and most importantly what are the Recovery Time Objectives (RTO) of the different activities carried out by the department. Make sure you iron out the essential details which you need during an incident.

Sin 4 – Scope

With many plans I see it is not clear what the scope of the plan is. Is it just the Glasgow call centre or all three call centres across the United Kingdom? Perhaps the author knows the scope of the plans but has not put it into the document. I am never sure whether this is the case or if they have not really thought through the scope of their plan. I think within the plan there should be a very clear scope and the parts of the organisation which are outside of the scope should also be identified.

Sin 5 – No strategy

Many plans you have to read four or five times to actually work out what their strategy is and how they are going to recover their operation. Sometimes it is impossible to work out what they are going to do! There may be tables listing the number of staff to be recovered but no actual location where they are to be recovered to. Sometimes I worry that the organisation doesn’t really know what they are going to do and will make it up on the day, hence they have no strategy to actually write down. Within the plan, I believe, it should be very clear what the recovery strategy of the organisation is. Within my plans I write a paragraph describing the recovery strategy which makes it clear how the organisation will implement its plans.

Sin 6 – The Team

According to the Business Continuity Institute’s Good Practice Guidelines every plan must have a team to implement it. This seems to be missing from many plans and it is not clear who will implement the plan. Even if the plan will be implemented by a team detailed in another document, there should be reference to this within the plan.

Sin – 7 Medium to long term recovery

Many plans I see concentrate on the immediate response to an incident and recovery of the first activities to their designated RTO. After this they run out of steam and are vague on how to recover beyond that. I was guilty of this when I was responsible for planning for a large office of 1,600 people. I had a good robust plan involving a work area for 300 of the key staff but had no plan in place for the recovery of the remaining 1,300 people. Finding space and recovering a small amount for immediate activities is easy; what is more difficult is finding space for the remaining large amounts of people. The same amount of thought and planning should go into your medium and long term planning, especially if it involves large numbers of staff. Once you know how to recover the remaining large numbers of staff then this should be included within your plan.
Charlie Maclean-Bristol is a Director at PlanB Consulting in Scotland.

Identifying your organization's business continuity requirements

Kuniyuki Tashiro
InterRisk Research Institute and Consulting

When I started to learn about business continuity management 10 years ago when I worked for a manufacturing company, one of my biggest questions was how to perform a business impact analysis (BIA) in our company. I could not find enough information to improve my understanding of the methodology behind BIA at that time. Nowadays we can access a lot of information about BCM through many books, standards, guidelines, seminars, or websites. But despite the situation getting better, many people still say that BIA methodology is unclear.

I think that one of the biggest reasons is that there are various methods used for BIA at different levels or for different purposes. Furthermore, the methods should be customized for each organization and developed with an understanding of the organization's context.

However, the latest version of the Good Practice Guidelines (GPG) has great potential to help deepen our understanding of BIA because the explanation of what it involves has been substantially expanded. In the 'Analysis' section of the guidelines, the methodology for BIA is explained with four different stages - Initial BIA / Strategic BIA / Tactical BIA / Operational BIA. This does not mean you have to divide your BIA process into four stages, but that understanding the four stages of BIA with each outcome would be a strong starting point for planning BIA in your organization, and customizing/developing BIA methodology. The guidelines also provide a practical knowledge for risk assessment in BCM by discussing the benefit of a 'Threat Analysis' to identify unacceptable concentration of risk or single points of failure.

In my session - 'Analysis' on the first day of the conference - I will discuss how to apply the methodologies described in GPG to the organization by using case studies so that attendees can obtain a practical knowledge.

Kuniyuki will be discussing this within the 'BCM Lifecycle' stream at the BCM World Conference on Wednesday 6th November, starting at 15:20.

Managing supply chain continuity

David Window
Continuity 22301 Ltd

As a member of three institutes - Institute of Risk Management, Business Continuity Institute and the Chartered Institute of Purchasing and Supply - I hope to explain why as business continuity professionals, we struggle to engage with my alter ego - the procurement professional.

Over the last two years I have been debating this topic with a colleague who is an accomplished procurement professional and we have challenged each other considerably in our efforts to justify the question, “why bother doing business continuity in supply chain”. We have also interviewed other procurement professionals to gauge our opinions against theirs.

The short answer we believe is that procurement professionals, especially those who use category management techniques, are incentivised to make savings. Resilience comes at a cost and this cost erodes savings.

Yet how many times during the period of a contract do businesses suffer minor disruptions, delays to a service or product delivery, how much additional cost do they incur which is not captured and quantified but still erodes the original savings?

Category Managers deal with strategic sourcing and that very name should ring alarm bells with business continuity professionals. When they are sourcing goods and services of strategic importance, potentially time critical, urgent goods and services, which the business depends upon, then they need to consider business continuity for continuity of supply.

So the business continuity professional encourages them to seek assurances on their supplier’s business continuity preparedness. The hard part is convincing them of the value of doing so for a future event that they can’t perceive of. This is because their minds naturally move into the area of probability. How often do we, as business continuity professionals, hear the words “what are the chances of that happening?”

Whatever your opinion is of risk management and the concept of estimating probability, I would suggest that it is a natural instinctive thought process that we as humans undertake daily even as we cross a busy road; we evaluate the risks and the probabilities.

So as business continuity professionals we need to speak the language of risk too and we need to understand the concepts of total cost of ownership and the drivers for procurement professionals, before we stand a chance of successfully engaging with them.

Consider that there may be something called the risk assessed total cost of ownership, whereby through modelling your supply chain you can assess the inherent risks within it before entering into a contract. Suppose through that analysis you can understand when it is appropriate to use risk mitigation strategy and when to use business continuity strategy and tactics cost effectively.

Now suppose that you could do that in a way that enthuses procurement professionals and top management alike by offering a potential estimate of quantifiable impacts caused by any minor or major supply chain failure.

If, as a result of this analysis, procurement professionals made more informed decisions when strategic sourcing, having an insight into the inherent risks and knowing when to incur costs on risk mitigation strategies, continuity strategies and tactics. Does that sound better than simply asking for a tick box questionnaire to prequalify your potential strategic partners who deliver time critical goods and services to your business?

The Good Practice Guidelines 2013 advocate both multiple suppliers and buffer stocks, but these carry a cost in the eyes of the procurement manager. Where these alternative suppliers are based and where you hold that contingency stock falls more into a risk assessment model, knowing your supplier is in a geopolitical area that carries a risk of a supply disruption may be sufficient for you to source elsewhere.

A risk assessed approach to establishing the total cost of ownership by procurement professionals may lead to exposing known risks and therefore require an amendment to the sourcing strategy. In circumstances where you discover that the options for supply are limited by a variety of imperatives such as cost, location, availability or uniqueness, a risk mitigation strategy may have limited benefit for these supply lines so you must delve deeper into your supplier’s resilience. Most importantly you must understand the costs involved.

As with all things business continuity, it is those business elements that are time critical or urgent, and therefore within the scope of business continuity, that need to be given scrutiny, not all your supply chains.

It is important to justify the need for business continuity to procurement professionals and to top management, by talking their language, commercial drivers, and cost of impacts for time critical supply chains need to be part of the assessment prior to committing a business in a purchase contract.

Finally, ask yourselves the following questions, is it sufficient and productive to ask suppliers to complete questionnaires when you prequalify them in order to be a part of a competitive tender? Does this add value to your procurement process? If you ask for a copy of their plans are you really competent to assess its efficacy? I would suggest the answers to all of these questions is no.

David, along with Brian Leigh of QiPS Consulting Ltd, will be discussing this issue further in his Practitioner Presentation at the BCM World Conference and Exhibition. The Practitioner Presentations are part of the seminar programme at the free exhibition.