Are we ready for significant power outages?

Have a quick look around you and see what is powered by electricity in your buildings, pretty much everything. We need to start asking questions, questions like:

1. Can we maintain Power for all our critical services through generator provision? Remembering that accessibility to large quantities of fuel becomes difficult without electricity.
2. Are we up to date with our alternative power supply testing regimes?
3. If our plans include the hire of generators, will they be available to you? Have you an agreement in place? Remember that everyone might want one.

The power outages may be localised meaning staff can work from other sites, therefore:

1. Have we alternative sites and are staff able to work remotely?
2. Can we switch sites/are staff happy to move?
3. Do we have a home working policy?

There are no hard and fast answers to this and you will no doubt be mindful that the only way to respond is to be aware, plan and test. I think this may well be the biggest issue facing practitioners over the next 18 months, being prepared for power loss on a grand scale is no mean feat, but with careful consideration of this issue in your plans between now and whenever will no doubt assist in your response.

Steve deBruin is the Business Continuity Lead at North Somerset Council, UK.

How MAD are your Top Management?

Dare to ask that question of your Top Management? Maybe not, but a Risk Manager would try to understand their attitude to risk and their mythical 'Risk Appetite'. As a Business Continuity Manager, why not explore their 'Maximum Attitude to Disruption' (M.A.D.) a phrase I believe I uniquely use and created hoping it becomes more prevalent in a commercially driven BC world.

Risk appetite is a feeling, a sense of danger perhaps. Your risk attitude is what you intend to do about avoiding that danger, your Maximum Attitude to Disruption is a mixture of your Top Management’s risk appetite and risk attitude expressed in a business continuity context.

How much disruption are they willing to tolerate in terms of impacts to the business over time and to what reduced service levels? It’s in part a BIA output, but not simply this alone. How many times do I hear that "quantifying and qualifying” your impacts is too hard to do expressed financially? Conversely how quickly do people manage to count the cost of the disruption after the event, who professes not to be able to do this beforehand?

Questions

Can you quantify your fixed cost associated with your business continuity management arrangements? Can you estimate your variable costs associated with an invocation of your response strategy and tactics and resource requirements? Do you know the estimated cost of your impacts over time and what is intolerable to Top Management?

M.A.D.

Somewhere in this wealth of (cost) data gleaned in the analysis and design stages of the business continuity lifecycle is your Maximum Attitude to Disruption. An acceptable commercial ratio between the cost of disruption over time and the cost of your response leading to resumption.

Impacts grow exponentially over the time of a disruption if left unchecked. Each response phase carries a cost of achieving your time objectives, each phase will attract negative impacts, without a planned response cost spirals upwards leading to an intolerable level of impacts. For those of you that are now saying, but not all impacts are financial, pause a moment and think of a reputational impact that has no financial impact associated with it.

When undertaking the 'Initial BIA/Strategic BIA', if your report to Top Management included an estimated (expressed financially and based on a seasonal view) set of impacts over time, would this focus their mind on what was their desired set of time objectives and minimum service levels? In doing so, would you then arrive at a draft Maximum Attitude to Disruption?

Armed with this aspirational view from Top Management you can progress through the lifecycle to the end of the design phase at which point you will be capable of answering the questions I asked previously prior to your next sign off gateway.

What are you asking Top Management to sign off? The outputs from your analysis stage and the outputs from the design stage. The cost of achieving their time based objectives to reduce impacts to that which is tolerable over time to achieve the Top Management's Maximum Attitude to Disruption.

David Window is the Managing Consultant of Continuity 22301 Ltd in Cheshire, UK.

Crisis management - achieving control in a crisis

Dominic Cockram
Steelhenge

I will be talking on the topic of 'achieving control in a crisis' at the BCM World Conference 2013, and focussing on the key areas of:

• What happens in a crisis?
• What are the challenges you face?
• How can you achieve control in such a situation?

 

First of all, one must understand just what a crisis means in terms of the characteristics of the actual crisis itself and the impacts on an organisation.  It is generally accepted that crises are characterised by:

• Unpredictability
• Complexity
• Highly dynamic threat
• Lack of boundaries
• Scrutiny from the media, public and other interested parties
• Uncertainty

These aspects create a situation which is volatile, fast moving, confusing and enormously pressured – not to mention the potential added emotional aspects if people have been injured or killed. Into this environment comes a crisis team – brought together at very short notice, not necessarily fully in the picture and expected to lead and generate the key strategic decisions for the organisation that will steer it into calmer waters with its reputation at least intact.

No pressure then!

Whilst this pressure cannot be removed necessarily, there are a number of aspects of good practice in crisis management that can, if well applied, lead to achieving control over events and the ability of the crisis team to get on the 'front foot'.

My focus at the conference will be to bring these critical areas to life, to use practical examples of what works and what does not, and what are some of the most important areas upon which to focus in order to maximise the chances of 'taking control' and achieving a good outcome for your organisation.

Dominic will be discussing the issue of crisis management within the 'Thought Leadership' stream at the BCM World Conference on Wednesday 6th November, starting at 11:15.

How can we evaluate business continuity risks in the supply chain?

James Stevenson
Rolls-Royce plc

The experts keep telling us that supply chain risks are important and it is old news that:

• An interruption could damage the business
• Customers should work with their suppliers to reduce the risk of interruption
• Sometimes the problem is with supplier’s supplier, or their suppliers
• Unfortunately, supply chain risks seem to be increasing in scale and complexity

Occasionally, this kind of alarm call reaches the Board or Executive Management responsible for understanding the significant risks facing their business. They realise that the threat is real and ask around to see who is managing this area of risk.

In my view, BC Managers are well placed to do this and with some minor adjustments to the BCM programme we can help the business to understand and manage supply chain business continuity risks.

At the BCM Global Conference, I will introduce the work underway at Rolls-Royce plc that is helping us to:

• Assess the BCM process site by site
• Evaluate the major SC risks at owned facilities
• Evaluate the major SC risks presented by external suppliers

I hope that this will provide BC Managers with practical steps and simple suggestions to evaluate supply chain business continuity risks more effectively.

James will be discussing this and the issue of supply chain continuity within the 'BC in Action' stream at the BCM World Conference on Thursday 67h November, starting at 10:35.

Making the most of your conference experience

Andrew Scott
Business Continuity Institute

The BCI is a global organisation with Members, Forums, Chapters and Partners all across the world, but whether it is due to time, distance or perhaps even environmental concerns, unfortunately not everyone who would like to attend the BCM World Conference and Exhibition on the 6th and 7th November will be able to do so. Sadly some people will miss out…

I don’t know about you but I sometimes feel like I’m doing several jobs at once. I'm sure we all do at times but even so, and with the best will in the world, none of us will be able to attend all three streams of the conference at the same time, not to mention the packed exhibition that will be going on or the free seminar programme taking place. With so much happening, we simply cannot attend everything. Again, sadly some people will miss out…

Or will they? Of course attending the conference and listening to the individual presentations will offer the best learning experience. But just because you’re separated by several thousand miles, or only in the next lecture hall, does not mean you have to miss out completely. In this day and age, with many of us using social media, we can take the discussions out of the lecture hall and into the virtual world. We can involve in our conversations all those connected to the Institute, or business continuity in general, whether they are at the conference or not.

If you use Twitter or Linked In, or perhaps Google+ or Facebook, then why not start a discussion online and engage with many more of your BC colleagues. The bonus is that it will help make sure the conversations continue long after the conference is over.

Of course it is also important not to miss out on the earliest form of social networking - talking to your colleagues face to face, at least those who are fortunate to be there with you.

Enjoy the conference and I look forward to meeting many of you there. For those of you on Twitter, the hashtag we will be using is #BCM2013.