What if...?

Keynote speaker and facilitator at this year’s BCI Executive Forum, Dr James Bellini sets the scene and identifies some of the major issues that will face business continuity professionals in the years ahead:

As a futurologist of many years’ standing I am regularly confronted with requests to ‘predict’ the outcome of some activity or development in the world of tomorrow. On occasion I’m even asked the name of the winner of an important upcoming horse race, or the score line of a major soccer match a few weeks hence. If only my crystal ball were that magical ... but it also reveals a basic misunderstanding of what futurology is all about.

I see my task as threefold: to apply a reality check on popular perceptions of the world around us, to create a framework for examining how ‘the future’ might unfold and to identify one or two possible future events or issues that would, if they actually occurred, pose very serious challenges for either business, government or the wider society – or all of these together.

A key tool of the futurologist is the ‘scenario’, in effect a way of thinking about a range of ‘possible’ futures that would have major implications for the way the world works in five, ten or fifteen years from now. To be of any value these scenarios should have a degree of realistic plausibility about them. A Star Trek future of brain transplants and off-world vacation resorts might offer a wacky or romantic vision of life in the 23rd century, but is of little use to decision-makers keen to understand what environment they may have to deal with over the decade ahead. A ‘relevant’ future timeline of perhaps a dozen years at most is the backdrop against which business continuity professionals must arrange their thinking about the risks, pitfalls and options of a changing world.

I will use my opening session to explore the emerging new realities of tomorrow, offering a range of ‘possible’ futures that would – if any of them materialised – change the rules that shape the nature of crises and threats to reputation. For example, it is clear the ‘geography’ of global business will undergo a fundamental shift in the years ahead – but in which direction? What, to take a liberty with syntax, might be the where of tomorrow’s potential crisis situations?

Other scenarios will consider the impact new technologies might have in the years ahead. How (and where) might homes and businesses, neighbourhoods, cities and even entire countries function in the ‘smart’ world of the 2020s? The social benefits may be immense, but with ever more technology in our lives, will it also bring more risks to everyday continuity?

And what are the implications for crisis management of an increasingly connected, online, digital universe. How is this changing the way information is originated, managed, distributed and owned? What if the internet collapses, or the social media revolution takes an unforeseen change of direction, or people simply grow bored with their digital lives and dump the devices and networks that are now the backbone of business, government and everyday life? What if...?

With the theme 'a new horizon', the BCI Executive Forum takes place on the 21st and 22nd May at the Marriott Hotel in Amsterdam. For further information or to book your place, click here.

Does business continuity in the public sector work, and does it get the buy in it deserves?

Many larger companies which have Business Continuity Management systems produce or deliver products. Failure to deliver as a result of any interruption will very likely impact upon the business financially and could ultimately put companies out of business. Is there any wonder therefore that the management of such businesses are often quite willing to spend money on protecting their interests.

Public Sector organisations tend to be on the larger size, often having a few hundred employees at the very least and in some cases going into the several thousands of staff. So why is it that the willingness of managers in the public sector to deliver BCMs is not always on the top of the priority list? I should say at this point that I am fortunate to work for a large public service organisation that is wholly behind BC and which has continued to invest in BC despite the financial restrictions which are currently impacting upon us.

In relation to public services there is often little chance of losing business as a result of an interruption and even less chance of being put out of business as a result of financial implications. There is often a cushion of ‘the public purse’ and an assumption that we can manage without BC. However there is every chance of reputational damage being done to the organisation or even to a whole group of organisations. Damage to our reputations is probably under greater scrutiny than at any time in our history.

BC is implemented in the private sector as a matter of necessity or indeed because it is seen by the companies as beneficial. It provides protection against unintended events and may even be a requirement of insurance companies to mitigate any foreseeable risks.

In the public sector BC is often implemented because it is a statutory requirement for plans to be in place. In particular the Civil Contingencies Act 1994 imposes a duty for many public sector organisations to have BC plans in place. The feeling of having something imposed upon you without having the buy in from senior management can only be detrimental to the introduction of BC planning within an organisation.

Many Public Sector organisations utilise ISO22301 to align their BC planning to, or certify their planning against. Is this standard really suitable for the Public Sector? I have heard comments from various sources that the standard doesn’t work for certain organisations.

Many public sector organisations rely upon specialist equipment, very often things which can only be supplied by one manufacturer and sometimes with extremely long lead times. For instance if an individual piece of medical equipment, or a specialised vehicle, is rendered unavailable, no business continuity plan would provide resilience, or would it?

I firmly believe that ISO22301 provides all organisations with the opportunity to create BCMs which are appropriate to their individual requirements. Alignment to most parts of the standard can be achieved and for those organisations wishing to certify against the standard then there are ample opportunities to achieve this.

Due to the very nature of public services, usually a ‘can do’ attitude and the ability to obtain mutual aid from each other, perhaps the very existence of Business Continuity Plans provides the opportunity for us to document this reliable form of restoring services. Borrowing both staff and equipment is not unusual throughout much of the public sector. There will always be occasions when a single point of failure cannot be wholly mitigated against, but this is a rarity and should not be used as an excuse not to establish a course of action, as a minimum, should a failure occur.

In the current climate, where most public sector organisations are trying to deliver services with less financial backing there seems to be an increase in appetite for BC plans to identify resilience, especially in relation to reputational issues. It is clear to the majority that massive reductions in staff numbers across the sector lead to a reduction of services and certainly do not allow for any depth of resilience should the worst occur.

It is imperative that public services spend their available finances wisely. A small amount of expenditure spent now to provide suitable resilience could save large chunks of their budget in the future.

The smallest of changes can make a difference. BC managers should grasp every opportunity to join groups of BC professionals, enabling them to share experiences and collaborate with each other. They should take advantage of training opportunities, which don’t always have to be expensive, participation in webinars and locally arranged events are a great source of information. They should also take advantage of organised promotions to put plans in place and embed them throughout their organisations.

Russ Parramore
Business Continuity Manager
South Yorkshire Fire & Rescue

Business Continuity Flash Blog

On Tuesday 18th March 2014, as part of the Business Continuity Awareness Week activities, we witnessed the first ever BC Flash Blog. This is probably a new term to most readers, it is a virtual Flash Mob – but instead of a dance routine the participants wrote and published their own blog post or article.

The event featured 22 writers, from all sectors of the BC industry – and from various corners of the globe. All the articles were on the same subject, and published at the same time. In keeping with the BCAW theme, the subject was “Counting the costs, and benefits, for business continuity”, with each writer taking their own, unique, perspective on this issue.

If you haven’t already done so, you can find links to all 22 of these blogs here. If we do nothing else, we can at least pay these writers the respect of reading their work.

For those who are interested in statistics, the page with the list of articles has had over 600 views (as of the 7th April). The list is hosted on a service called List.ly that facilitates social media style interactions with the community. Readers are able to flag like/dislike; indicate which articles they have read and, perhaps just as importantly, which subjects they would like to learn more about.

To date there have been 123 of these interactions recorded – but sadly these have come from only 11 people. You do have to register with the service to interact, which may have stopped many from casting a vote. These interactions are still open, and it would provide useful feedback to guide future articles if you could visit the site and record your thoughts.

Despite the relatively low number of interactions recorded, the feedback from a number of the writers indicates a good level of hits on these articles. While not everybody had full scale analytics, reported around 100 hits on their article and another over 180 hits. This may, in part, represent the existing audience of some of these writers as much as the BCAW promotion - but that is part of the educational value to be derived from the exercise.

BC folk need to learn about tapping into, and leveraging, existing networks and communities if we want to promote our cause and our message. The extra reader base accessed by distributed, rather than centralised, blog hosting. Just as importantly, the extended reach of the Social Media networks of the various writers and the 'priceless' publicity that was generated by the Tweets and Retweets. These are lessons we can look at applying to our own BC programmes. How we can use tools like blogs and wikis in our organizations; improving our understanding (and adoption) of the various social media tools (like List.ly) and the value of debate and interaction, rather than passive consumption, in promoting a vibrant discipline.

One message that comes through very clearly in several of these articles is the passion that BC people have for the work we do. It was a joy to see that passion from old practitioners as well as from newer ones. The passion for the work and promoting the cause also spanned geography and language.

That passion means we can at times be forceful when we debate our different views and perspectives on how to count the costs – and even what constitutes benefits and value from BC. But it also drives a genuine desire to promote improvement and learning across our practices. Without debate, and passion, no field of knowledge will develop. But debate requires engagement.

I spoke about this passion, and used three of the articles as examples, in my BCAW webinar. It is recorded and can be accessed here, it also contains some instruction on how to access and engage with the List of articles.

It would be great to hear some feedback about the concept of a Flash Blog, about the articles, or even what topic you would like to see for a future Flash Blog event. You can comment here on The BC Eye, or start a discussion in one of the many Linked In groups where this post will be promoted.

My thanks to all those who contributed articles, I hope you all keep writing! Thank you also to those who take the time to read – and extra special thanks to those who make it all worthwhile by engaging and debating these ideas.

Finally, if you are wondering why we chose to have our Flash Mob write a blog post rather than demonstrate a dance routine – then this YouTube clip (featuring one of our contributors) should provide an adequate explanation.

Ken Simpson
Director of The VR Group

Counting the costs and benefits of business continuity, a Non-Executive Director's perspective

Essentially the Non-Executive Director's role is to provide a creative contribution to the board by providing objective criticism. So I recommend that all Non-Executive Directors consider challenging the board to count the costs involved in deploying business continuity management and balancing these costs against quantifiable benefits gained from its Business Continuity Management System and Programme.

The Good Practice Guidelines suggest that embedding BCM is hard to measure, but secretly I believe that Executive Directors deep down in their hearts and minds know full well if they are merely trying to be compliant.

In the busy world of the Executive, maybe they only have time to ask if the business is adequately covered from a risk and business continuity perspective. Is it the difference between plausible deniability and culpable liability? To paraphrase a well-known political interviewer: “Did you know there was a problem, in which case you are culpable or did you genuinely not know in which case you were incompetent, which is it?”

Apply that logic to the board and ask them if they understand the relationship between, in some cases, hundreds of thousands they spend on business continuity management believing that it will deliver benefits should it be needed, without insisting on seeing the cost benefit analysis that proves the case, only to find that in reality, plans are hardly invoked or utilised even in a real event.

I can only suggest from experience that Top Management Executives are unlikely to ask the question: “Show me the costs associated with maintaining our Business Continuity Management System/Programme and tell us how much deploying our strategy for resumption will cost if invoked and the savings, yes, savings to the business in reducing the impacts to the business over a known time scale.”

If business continuity professionals were pressed to answer this question, they would have to take a more commercial view of business continuity, they would have to truly align to risk disciplines and share common risk and impact scales and they just may invite procurement professionals to assist in quantifying response strategies and tactic and resource requirements.

This would lead to Top Management Executives having a genuine opinion, to give a mandate and possibly believing that business continuity does indeed add commercial advantage to your business.
So, I implore Non-Executive Directors and Heads of Audit Committees, challenge your Top Management Executives to prove the commercial case for undertaking business continuity management for your business.

Ask your Chief Risk Officer or their equivalent in your business:

• How much do we spend annually on business continuity management, without an incident taking place?
• How much would you estimate we would spend on deploying our strategy and tactics during a disruption and in achieving the timescales for resumption how much cost avoidance would we achieve in monetary terms?

Even as I write this, the national news talks of under spending and being under prepared for severe disruptions, they offer the costs associated with preparedness and with failure, within days or weeks of an event.

So I will say it one more time, why do we not estimate these impacts in monetary terms using the same methods as undertaken post event – but do this in advance. Why can we not offer Top Management Executives fixed and variable costs (including invocation) set against the cost of impacts over time? Let them decide their Maximum Attitude to Disruption M.A.D.

Finally, why don’t Top Management Executives ask these questions, rather than simply are we covered?

By David Window
Non Executive Director at Continuity 22301 Ltd

Counting the costs and benefits of business continuity, the BCI Technical Director's perspective

For those of you who think BCM is expensive, try operating without it.

Business Continuity has often been treated almost as an ‘act of faith’. Common sense has suggested that well prepared companies are likely to recover from an unexpected interruption quicker than unprepared ones; that they are likely to lose much less money by being productive again more quickly.

In times of financial restraint, with organizations looking to squeeze costs wherever possible this position is hard to defend, in some cases it simply no longer works. It is not too difficult to find out how much is directly lost as a result of disruptive incidents; in fact our friends from the insurance world have facts and figures about all types of incident – the amounts claimed, the amounts paid out and the actuarial data that supports the likelihood of every type of known problem.

This does however, leave difficulties for the BCM practitioner. Given the increasing attention paid to ‘black swans’, ‘unknown-unknowns’ or generally unpredictable events (illustrated again by the Malaysian aircraft disappearance), conventional risk pricing that requires forecasting both probability and loss expectancy is meaningless. For BCM people, how can we hope to quantify the potential loss connected to brand and reputation damage, market-share loss, share value collapse and more aggressive targeting by competitors?

Even if we can argue successfully (without detailed facts and figures) that we need to protect ourselves from the potentially terminal consequences of unexpected incidents, can we make a strong enough case for BCM as the solution? It is one thing to point out a problem, it is an entirely different thing to show you have the answer. For many years the BCI and other similar bodies have conducted regular surveys that demonstrate that the cost of business disruptions is significant. This has increased in line with trends such as ‘JIT’ manufacturing, complex and extended supply chains, increased off-shoring of services and purely cost driven out-sourcing of operations.

A soon to be released global survey indicates that almost 30% of respondents have experienced business losses of over $5 million as a result of a disruptive incident. This was up from less than 20% three years ago. The challenge for BCM professionals is not so much to shout about those facts (although that approach can help sometimes) but to show why Business Continuity can help both reduce the likelihood of suffering that loss at all, but if it should happen that the loss can be dramatically mitigated.

The wider dialogue taking place about resiliency throughout industry and government actually helps our case. In some ways recovery is simply a failure to be resilient, although total protection from everything is clearly impossible. The need to balance measures that make us inherently more able to withstand rapid changes in risk (political, environment, social and technological) with our ability to adopt and response as needed is the future for BCM thinking. What value do you put on success and what cost do you put on failure? Does effective BCM make the former a more likely outcome than the latter? The answer to those questions provide the justification for Business Continuity – in my view it is a modest investment for corporate decision takers who understand the real questions.

By Lyndon Bird
Technical Director at the Business Continuity Institute