Improving organisational resilience – the real justification for business continuity

Although the term resiliency is widely used in setting corporate goals, it is rarely defined in a way in which it can be meaningfully assessed. Traditionally business continuity has provided a proven means of reducing the severity of disruptive interruptions by understanding the operational priorities of the business, the infrastructure that supports them and the acceptable timescales for response and recovery. Business continuity practitioners have always argued that by taking a holistic approach to an organisation, critical dependencies and single points of failure can be better identified and mitigated, thus leading to improved reliability and customer satisfaction. This might seem a reasonable assumption but it is hard to really prove.

This lack of objective proof has perhaps contributed to the often reported difficulties in achieving more substantial stakeholder buy-in for business continuity at the most senior levels in an organisation. Perhaps this partly explains why the change in business terminology from business continuity management (BCM) to organisational resilience is happening so rapidly in many companies. Certainly key individuals promoting the resilience agenda see the opportunity to bring a new discipline into play at the strategic level as a game changer. Adaptability (rather than response) is becoming the new buzzword and traditional business continuity practitioners need to adapt to this new reality.

The construction of more and more detailed plans has failed to achieve the corporate goals for security and resilience that we as practitioners might have expected. The speed of business change makes the need for a more dynamic way of responding to crises ever more important, but as BCM professionals we need to change the way we work – developing organisational resilience capability and the people skills needed to take control of unexpected events should be our primary goals. Good planning is still essential but not writing more compliance based procedural plans.

So what are the obstacles to implementing a successful business resilience plan? Firstly, getting support from the top of the organisation and by this I mean not just budget, but rather the way the message needs to be enthusiastically and positively communicated from the top. Secondly, getting buy-in from the people who have to deliver the plans; this is predominantly the middle managers who are often already over committed and under resourced. Thirdly, making the risk look and feel real because if it is seen as just compliance then you will create a tick-box mentality.

To successfully address these obstacles, it is essential to properly understand how the business actually works and who the really influential players are, those whose opinions are sought and listened to. Find out what the real drivers of success are and what top management really worry about. Do not talk to senior management until you know what is important, any lack of company knowledge will ruin your credibility immediately so prepare well before you talk to them. Build awareness programmes and get your message right when you give presentations as the people who you need on your side are not interested in technical solutions, they want to know about what you can do to help them eliminate or reduce future business problems.

Business resilience is much more than recovery from disaster or serious incidents. It is the ability to identify and monitor risks to prevent them from happening in the first place, or at least minimise the impact. It is about the capability of the organisation to deal with incidents that cannot possibly be predicted or adapt itself to changes in its external circumstances such as civil war in a key supplier country. In some ways it is difficult to highlight companies who are good at resilience because by definition they will be the ones that handle problems, major incidents and even crises almost seamlessly.

The top challenge on the horizon for BCM professionals is changing the mind-set of people both inside the profession and outside it. We have many excellent programme managers but there is not enough really innovative thinking going on. The enthusiasm for the idea of resiliency does give us a chance to articulate a wider strategic vision for our discipline. Thinking up relevant approaches to deal with issues that do not fit the old BCM model of physical disruption to assets is a real challenge – cyber resiliency must be high on our agenda as is mitigating reputational damage using social media. It might be difficult but if we don’t do it, who will?

Lyndon Bird
Technical Director at The Business Continuity Institute

Rules of crisis management: don't let lightning strike twice

The great Irish playwright George Bernard Shaw famously once said of success, that it “does not consist in never making mistakes, but in never making the same mistake a second time”. In much the same way this rule can be applied to crisis management. To suffer a crisis once is unfortunate; to suffer a crisis a second time is careless.



Last month the Spanish clothing firm Zara caused outrage when it put on sale a piece of clothing which to some resembled the shirts worn by concentration camp prisoners during the Second World War. The shirt had been designed to be ‘wild west’ themed, but unfortunately the large gold star over the chest looked very much like the Star of David.
To Zara’s credit the company acted quickly to take down the offending item from sale. It also posted apologies to anyone who had been offended by the item on its social media feed with a statement recognising the insensitive nature of the shirt.

Unfortunately for Zara, this was not the first time that the clothing brand had been in trouble for using Second World War iconography in its designs. Back in 2007 the company suffered similar negative publicity when a customer noticed a bag they had purchased from the store included four green swastikas. Again, the company immediately withdrew the item from sale, but not before several tabloid newspapers in Britain had run pictures of the company juxtaposed with Adolph Hitler.
There is no doubt that Zara has made an honest mistake in both instances, unfortunately activist groups and NGOs are less forgiving, with several attacking the company on social media for “ignorance” and a “lack of education”.

In both cases the company reacted swiftly to withdraw the offending products from sale. However, in making the same mistake twice the company has left itself open to accusations of carelessness in the way in which it handles its internal quality control processes.

The key thing about pistols (as anyone who has seen a western will know) is to take the gun out of the holster before firing it, otherwise you risk shooting yourself in the foot, and in this case, twice.

Tom Curtin is the Chief Executive of Curtin and Co, a BCI Partner specialising in crisis communications and reputation management. You can view more blogs my Curtin and Co by visiting their website or by joining their Linked In group.

The CPD Merry-go-round: Why individuals struggle to stay on for the ride

Ever groaned at the thought of undertaking more CPD, to add to another yearly record?

You are not alone: The CPD Research Project found that thousands of professionals in the UK have a great deal of apathy, and negativity, towards their CPD. Many struggle to keep motivated and focused on its true purpose - upholding best practice and ensuring professional qualifications don't become obsolete.

Often such apathy stems from heavy top down requirements from professional bodies and regulators, for number of hours, points, topics, or skills to be covered, coupled with a lack of support or guidance. Yet, paradoxically, CPD Schemes are purposefully designed to be flexible in terms of topic, and are rarely prescriptive in advising what, where, and how an individual professional should undertake their CPD.

Such confusion about what, and how, CPD can be undertaken often spirals and as a result individuals rarely perceive their CPD as a personal achievement and significant addition to their work portfolio.

In particular - individuals lose sight that CPD is actually for them.

Recent CPD should be displayed on your LinkedIn profile, discussed in interviews and job reviews, and included on your CV. Our CPD research shows that clearly demonstrating CPD to employers dramatically improves career prospects, which in real terms, means higher salaries and remuneration.

So what created this generalised apathy in the first place?

A quick look on the internet shows an expansive number of training providers, courses, online activities, events, lunch time and breakfast briefs, and seminars. Many of which have not been verified as 'true CPD'.

For many, the choice is endless, and identifying high calibre or relevant CPD activities becomes a 'hit and miss' activity.

More worryingly, the CPD Research Project found that an alarming number of providers whose training activities are ‘branded’ as CPD happen to be in the lower quartile - in terms of quality.

It therefore comes as no surprise that a central cause of CPD’s bad reputation stems from individual professionals receiving negative, sometimes terrible, CPD experiences. The results of a CPD environment that is populated with low quality training, negative CPD experiences and apathy from all involved, has significant consequences, with many professionals reduced feeling that they are on an endless, and sometimes pointless, merry-go-round.

Find out more at www.cpdstandards.com, and when you are sourcing CPD activities, keep an eye out for the CPD Standards accredited providers mark.

Holly Steiner is the Client Relationship Executive at the The CPD Standards Office, a Part of the Professional Development Consortium.

The development of organisational resilience

With the search for the comprehension and understanding of the meaning of organisational resilience gathering pace with each passing month, the Business Continuity Institute is now well embedded, perhaps even pivotal, in this latest quest to push forward the boundaries of the thinking and theories that relate to protecting and maintaining the value of organisations. The debate about what organisational resilience means in practical terms to organisations and industry practitioners is ongoing, but the recent publication of the BS 65000 – Guidance on Organisational Resilience – as a draft standard for public comment by the British Standards Institute is clearly another step forward in this search for the 'Holy Grail' in enterprise risk management.

The debate about organisational resilience is fascinating because it has been led by a number of academics and academic institutions, which is slightly counterintuitive in the field of social science research and organisational management studies. The usual methodology in the field is for phenomena to occur, the academics then research the phenomena and attempt to understand the causation, context, applicability and the whole myriad of considerations that underpin a theory in the social sciences arena.

With organisational resilience however, this has not been the case. Academics have postulated on the theory of organisational resilience without having the case studies to investigate and sense check their theories against. This situation is exacerbated by the fact that organisational resilience can be a point in time phenomena, so no evidence of the measurement of an organisation’s resilience over a protracted period of time has been published to date. To the contrary, one recently published study stated that an organisation was resilient in its operations, despite the fact that the organisation under consideration no longer exists and its demise was well documented and planned in advance. This situation seems to be counterintuitive to the theory, especially when there is some measure of consensus amongst academics and practitioners that capacity to adapt to change and evolve and thrive in a structured and strategic manner is a key part of what may constitute the state of resilience for any particular organisation.

The BCI has worked to address the gap in the understanding and meaning of organisational resilience by leveraging the wealth of experience and expertise that can be found in the ranks of its members and actively worked to support the development of BS 65000. The BCI also actively participated in the development committee’s deliberations, inputting member’s views and thoughts throughout the development cycle, exactly as it did with BS 25999 Parts 1 and 2, BS PD25666 on Testing and Exercising, ISO 22301, ISO 22313, BS 11200 on Crisis Management and the many other relevant industry standards that have been published nationally and internationally over the past six years.

So back to BS 65000 on organisational resilience and what is happening now, the comments that were submitted from the public consultation phase have now all been collated and the standard’s development committee is now considering those comments and amending the text of the draft standard where that is necessary. After completing the development process and gaining all the necessary approvals required for its final publication, and then the real challenge will commence, as organisations will hopefully take the guidance in BS 65000 and use it to either enhance the resilience of their organisation or sense check or benchmark their current arrangements against the guidance in the standard and then feedback and share their experiences.

It is important to remember that standards and the thinking contained in standards evolves all the time to mirror advances in the relevant industry or activity sector. The new BS 65000 standard not only represents the next big step in our understanding of organisational resilience, but it is also the next phase in the quest for that understanding and the meaning of organisational resilience and it seems quite clear that the quest is still far from complete.

Kevin Brear is a ‘Strategy and Business Systems’ PhD Candidate at the University of Portsmouth and played an important role the development of BS 65000 through his position as a member of the BSI Standards Committee.

Seven deadly sins of business continuity plans

Recently I helped plan and deliver a workshop for the Scottish Continuity Group. The theme of the day was to give the delegates ideas of ways to improve their plans. Presentations were given on a number of aspects of planning - including short plans, using business continuity software, the army way of planning and different ways to set out your plans. I gave a talk at the beginning of the workshop to set the scene. It was entitled 'The Seven Deadly Sins of Business Continuity Plans' and I thought I would share the main points with you.

Sin 1 – Unnecessary information

Many Business Continuity Plans I see seem to be full of unnecessary information which is not needed on the day of the incident. They contain policy information, details of when the plan was last exercised and how business continuity is managed within the organisation. I believe that the plan should only contain information which you are going to use on the day of the incident. All the other information should be kept in a separate document.

Sin 2 - Samey

“When something remains consistent when one would expect there to be more variation”.

This is where the plan initially looks good, with lots of detail, and it appears that lots of thought has gone into it. You then read a number of plans within the organisation and you find that almost all the plans are exactly the same. The call centre plan looks exactly the same as the finance plan, except for the name on the front. This says to me that business continuity within the organisation is not taken seriously and the organisation is happy for its plans to be cut and pasted from one department to the next. Of course there will be some parts that need to be the same in all plans, such as the incident management hierarchy, but make sure that your plan is properly tailored to your part of the organisation.

Sin 3 – Connection to the BIA

Many organisations have a large and elaborate Business Impact Analysis (BIA), which capture vast amounts of information. When you come to looking at the plan there is nothing in it recognisable in the BIA. The BIA has a vital part in informing the recovery strategy and key information such as the system recovery order, how many seats the department needs over a timeframe and most importantly what are the Recovery Time Objectives (RTO) of the different activities carried out by the department. Make sure you iron out the essential details which you need during an incident.

Sin 4 – Scope

With many plans I see it is not clear what the scope of the plan is. Is it just the Glasgow call centre or all three call centres across the United Kingdom? Perhaps the author knows the scope of the plans but has not put it into the document. I am never sure whether this is the case or if they have not really thought through the scope of their plan. I think within the plan there should be a very clear scope and the parts of the organisation which are outside of the scope should also be identified.

Sin 5 – No strategy

Many plans you have to read four or five times to actually work out what their strategy is and how they are going to recover their operation. Sometimes it is impossible to work out what they are going to do! There may be tables listing the number of staff to be recovered but no actual location where they are to be recovered to. Sometimes I worry that the organisation doesn’t really know what they are going to do and will make it up on the day, hence they have no strategy to actually write down. Within the plan, I believe, it should be very clear what the recovery strategy of the organisation is. Within my plans I write a paragraph describing the recovery strategy which makes it clear how the organisation will implement its plans.

Sin 6 – The Team

According to the Business Continuity Institute’s Good Practice Guidelines every plan must have a team to implement it. This seems to be missing from many plans and it is not clear who will implement the plan. Even if the plan will be implemented by a team detailed in another document, there should be reference to this within the plan.

Sin – 7 Medium to long term recovery

Many plans I see concentrate on the immediate response to an incident and recovery of the first activities to their designated RTO. After this they run out of steam and are vague on how to recover beyond that. I was guilty of this when I was responsible for planning for a large office of 1,600 people. I had a good robust plan involving a work area for 300 of the key staff but had no plan in place for the recovery of the remaining 1,300 people. Finding space and recovering a small amount for immediate activities is easy; what is more difficult is finding space for the remaining large amounts of people. The same amount of thought and planning should go into your medium and long term planning, especially if it involves large numbers of staff. Once you know how to recover the remaining large numbers of staff then this should be included within your plan.
Charlie Maclean-Bristol is a Director at PlanB Consulting in Scotland.