I must choose my words with care...

Ian Charters FBCI

English is a fascinating language with many more words in common usage than other European languages and many have multiple meanings where only the context can give a clue as to which meaning was intended.  Consider the newspaper headline “Bus on fire - passengers alight” ; do we know the outcome of that story?

When writing Standards it is vital to avoid this ambiguity, so the guidance to standards writers is to explain concepts using the commonly accepted meaning of words and to avoid technical terms (leaving the accompanying Guidance document to relate the concepts to the industry terms).  However, this can still lead to ambiguity when communicating outside the business continuity realm, so it is imperative to achieve clarity of meaning in discussions with your colleagues.

Business Continuity – not just for big companies and big events!

Lyndon Bird FBCI

The London Olympics is now over and we are still coming to terms with its success. Those who had predicted chaos and possibly carnage have been proven wrong.  Every few years an event or threat seems to emerge that gets everyone’s attention. Sometimes it is an esoteric threat that few understand like the millennium bug; sometimes it something that might harm us personally like a pandemic; sometimes it is a massive event that might go dramatically wrong in innumerable ways. The odd thing is that the predictions of doom and destruction thankfully never seem to manifest themselves.

Now this is not being complacent, in fact just the reverse. The positive message about this is that however complicated, large or frightening a threat seems to be it can usually be mitigated perfectly well by good planning, good organisation and plenty of practice. The Olympics did not just happen at random, the organisers knew the dates and schedules for years, they had the brainpower and expertise of leading experts from around the world to call on, and they had time to test and rehearse everything until it was perfect.

The problem most organisations face in dealing with Business Continuity, however, is precisely the reverse of such high profile threats. If something that is totally unpredictable happens at a random time and causes large losses of property, assets or even lives what can you do to protect yourself or your organisation? Unlike the millennium bug or the Olympics you have no idea what the real threat is or when it could show itself. Business Continuity Management (BCM) addresses this paradox by concentrating on impacts rather than causes. It is impossible to identify every threat faced by an organisation or the exact way in which even predictable threats like fire or flooding will affect different businesses or individuals.

However, it is possible to identify what products or services must be delivered in what timeframes, what resources need to be in place to allow that to happen and how an organisation needs to be ready to deal rapidly with any crisis regardless of cause. For example, those organisations that had planned for staff shortages during a possible pandemic already had the key components for their Olympic plan. The threat during a pandemic was that staff would be too ill to come to work; the threat during the Olympics was that they simply couldn’t get to work because of travel difficulties. However the BCM question was the same:  “how do we continue our critical activities with low staff levels in the office?” Concentrating on impacts, rather than threats is at the heart of BCM.

The UK Cabinet Office believes that this message is one that small and medium-sized enterprises (SME) need to hear and heed. They claim that SMEs account for 99.9% of all private sector enterprises, 59.4% of private sector employment and 50.1% of private sector turnover. Without a resilient SME sector the UK is unlikely to kick start the economy anytime soon. BCM will not achieve this on its own accord but it is a core component to security, longevity and success for any organisation.

The UK had a great Olympics by making the right decisions, plans and provisions well in advance. Just because you cannot predict the exact nature of a threat doesn’t mean you cannot do the same by concentrating on what is really important for you to accomplish - regardless of the external circumstances you find yourselves in.

Resilience in the Supply Chain - Tips for how to improve BCM

Deborah Higgins MBCI

Achieving resilience in the supply chain is something all organizations aspire to. We still have a long way to go, and it may be that increasing or improving resilience in the supply chain is a more realistic goal than achieving resilience.

According to the Business Continuity Institute's recent Horizon Scan Survey published in January of this year, among the top threats dominating the horizon scanning of BC professionals around the world are unplanned IT and telecom outages, data breaches, adverse weather and interruption to utility supply. Clearly such disruptions have far reaching consequences on an organization, but specifically in the supply chain, where effectively the impact is multiplied.

In a major disaster, employees are impacted personally and their family comes first, not the business.  

A recent report by Zurich Municipal puts supply chain failure as the third major incident risk faced today and yet found misplaced confidence in supply chain risks among public sector leaders. It cannot be exclusively a public sector leader problem.

Supply chain disruptions have led to a loss of productivity for almost half of businesses surveyed in the latest BCI Annual Supply Chain Resilience Survey. In a follow-up report on global supply chain resilience, based on interviews with organizations whose supply chains were disrupted by the Great East Japan and Christchurch, New Zealand earthquakes in 2011, the lessons learned have prompted significant changes in supply chain strategies. For one organization the key change was to engage with alternative suppliers. For another it was to undertake a much more detailed Business Impact Analysis to gain a better understanding of what impacts their supply chain, people being one of the greatest factors. In a major disaster, employees are impacted personally and their family comes first, not the business, and organizations have learned that this must be reflected in their business continuity arrangements.

Increasingly complex supply chains and dependencies on ICT, leaner management processes, sole/multi-source suppliers and just-in-time delivery methods can make the goal of supply chain resilience seem impossible to achieve. Whether we are dependent on a supply chain or part of a supply chain, we are all vulnerable to disruptions beyond our control.

Hints and Tips

What can we do to work towards achieving our supply chain resilience? Here are some tips:

1. Think strategically about managing risk within the supply chain and across partners. Having business continuity management at board level will ensure that a comprehensive approach is taken to business resilience. BCM provides the link between the organization's objectives, the risks it agrees to take and the measures needed to manage the resulting vulnerabilities.
2. Understand our organization by carrying out a Business Impact Analysis to ensure that we identify those key suppliers that deliver our products and services. Using BCM techniques will identify key suppliers by the part they play in our organization's critical processes, activities, our assets and resources.
3. Prioritize our key suppliers (typically between 1 and 5%) and base this prioritization on the information collected through the Business Impact Analysis rather than how much is spent with them or who the main threats are.
4. Understand the immediate impact of a disruption and the longer term consequences to stakeholder confidence and reputation arising from a supply chain failure. The media and stakeholders will have little sympathy for our situation if we did not plan for the consequences of a supply chain failure. We may not be able to do anything about the failure of a supplier, but we can plan for the consequences of it.
5. Have an incident management plan in place to respond to the immediate impact of a supply chain disruption as part of our BCM arrangements. Ensure the incident management team is well rehearsed.
6. Test and exercise our BCM arrangements to include supply chain failure scenarios. Involve all parts of the business to ensure all potentially impacted areas are considered.
7. Seek adequate assurance from our suppliers, not just asking if they have a BC plan. Examine whether it is fit for purpose and consider how and if it fits with our own organization's recovery objectives.
8. Collaborate with and build good relationships with key suppliers and support each other through the BCM process, including planning activities and exercises to improve resilience.

It is when BCM techniques are applied to managing the supply chain that a better understanding of the risks, and how we can mitigate these risks, makes the goal of achieving resilience in the supply chain a more realistic one.

If you are interested in taking part in The BCI's 4th annual Supply Chain Resilience Survey supported by the Chartered Institute of Purchasing & Supply (CIPS), Zurich and DHL Supply Chain, we would greatly welcome your input.

Also if you are interested in reading the Zurich Municipal report referred to in this blog or the BCI's Horizon Scan 2012 report, please visit our website: www.thebci.org.

BCM World Conference and Exhibition – why this is the ‘must attend’ event for BCM practitioners

Deborah Higgins MBCI

Life as a BCM practitioner in any organisation can sometimes feel lonely and like an uphill struggle, a never-ending battle with no imminent victory in sight. 

We need to be a ‘jack of all trades’ starting from knowing how to make BCM relevant and of interest to all areas of the organisation, to being a master of persuasion to convince sceptical stakeholders, to having to have an eye for detail to carry out an effective BIA as well as being highly organised to maintain the BC Plan and be skilled facilitators to run our exercises!

The constant battle as we BC practitioners strive to embed BCM into our organisation’s culture is taxing to say the least and just when we feel like giving up as our energy levels ebb into the distance, along comes the BCM World Conference to revitalise the parts other events cannot reach and to fill us with inspiration and renewed enthusiasm for our one true ‘professional’ passion.

BCM World Conference is the place where  we can be with our allies, where we stand together with the ‘already convinced’ and the ‘converted’, where we are part of a global, united force and where we can find temporary release  from our ivory towers

For me the Conference is a place I go to immerse myself in the world of BCM. As a delegate I can find out what’s new, what other practitioners from a wide range of organisations are doing and how are they doing it. I can listen to professionals from all over the world talk about common problems we all face and become part of the conversation about what we can do about it. I can learn from the wealth of experience and knowledge from experienced leaders in their fields, share my own experience and best of all I can take this away with me back to my place of work.

I can find out what tools are out there to help me do my job by visiting the exhibition. I can see anything from software providers, salvage companies and consultants all who know exactly what I do and why I am there. I have listened to some fascinating stories in presentations given on the exhibition floor. I have been inspired to attend workshops and training courses and I can find out how to continue with my professional development.

I have been fortunate to be in a position to go to BCM World and take the opportunity to learn, to network and make new friends and I can’t imagine not attending the conference in the future.

This year I am lucky enough to work for the Business Continuity Institute and so I don’t need to make a business case to my employers to fund my attendance! But I do know that there is no better place for anyone with any interest in Business Continuity to be.

If, like me, you leave with a renewed feeling of enthusiasm for your work and full of useful knowledge and some new ideas to try back in the office, then it has been a worthwhile investment and one you will continue to reap the benefits of for a very long time.        

And if you are looking to save a bit of money, the BCI are offering an Early Bird Rate for both Members and Non-Members, which is available until 31^st July 2012.  So hurry and take advantage of this by booking your place right now here   

To find out more about the Conference click here or download the Conference Programme here

Look forward to seeing you there.

Deborah Higgins, MBCI

Technical & Learning Manager at the BCI

The Revival of IT Disaster Recovery as a BCM Core Issue

Lyndon Bird FBCI

The one thing that almost all Business Continuity professionals agree upon is that BCM originated in IT Disaster Recovery (ITDR). Until very recently I would have argued that ITDR was no longer a core issue of BC practitioners in multi-national or global organizations. Although the risks of IT failure were extensive and the potential impact massive, the probability of those risks being manifest was very much under control. The sheer expenditure and sophistication of ICT in major organizations should have designed resilience into the infra-structure so that IT failures were largely invisible to customers and other external stakeholders.

My first reaction to hearing that the Royal Bank of Scotland had serious IT problems with a software upgrade was one of disbelief. Surely not I told my colleagues, there has to be more to it than this, perhaps a cyber-attack or perhaps internal sabotage. When no rumours of such dramatic events emerged and the banking group kept extending their expected recovery period I had to reluctantly admit I was wrong. As I write, the banking group are still not totally operational at their Ulster Bank subsidiary after 4 weeks of disruption, and even customers at the bank’s main brands (RBS and NatWest) experienced delays of a week or more.