Identifying Business Continuity Strategies

John Bartlett CBCI, DBCI

Many organisations I talk to fail to adopt appropriate Business Continuity (BC) strategies. They either plan for scenarios that are unlikely, decide on an approach that is unachievable or fail to align BC strategies with other strategic initiatives. Identifying, implementing and maintaining appropriate BC strategies will determine how successful (or not) your organisation is when responding to major or localised incident.

The principle behind identifying the appropriate BC strategies is one of synergy and practicality. BC strategies should be aligned and integrated with other strategies (such as Business, product/service, IT and premises strategies) and be capable of meeting organisation requirements. These requirements were collected in the Business Impact Analysis (BIA) and Continuity Requirements Analysis and (CRA).

An Icy Crisis

Andy Osborne
Consultancy Director, Acumen
Author of Practical Business
Continuity Management

For those of you who know me, you may remember a blog I wrote about the trials and tribulations of working from home during a recent snowy period. What I didn’t mention was that the hassle of trying to work from home amid the Osborne menagerie was compounded by a small domestic crisis - the dreaded frozen pipes, which meant no running water in the kitchen for three days. And, more seriously, a non-functioning dishwasher and ice-machine in the freezer that couldn’t refill itself. I like to think that I cope reasonably well with most of the things that life throws at me, but washing up by hand and warm gin and tonic both come under the heading of “crisis” as far as I’m concerned.

 

The daft thing is that it happened last winter too. Only it was worse then because we ended up with burst pipes. And two indoor water features - a small waterfall cascading from our kitchen ceiling and a rather pretty fountain in the garage. So once I’d cleared up and repaired the offending leaks, I did a quick bit of risk management and set to insulating the pipes properly.

 

The trouble was that it seems I didn’t quite finish the job. I don’t remember why – hardly surprising really as I don’t actually remember not finishing. Presumably I found something more pressing or more interesting to do. Or maybe it was because it wasn’t much fun crawling around in the roof space above the kitchen. Anyway, I ended up up there again this year, squeezing into ridiculously small nooks and crannies with various bits of insulation. And jolly unpleasant it was too. The main problem was that I’m nowhere near bendy enough, and I never thought that, at the impressive height of 5’7″, I’d be too tall for anything. I ended up with a cricked neck and an aching back but, thankfully, no burst pipes.

 

But I fear I may be rambling. The point is that if I’d actually implemented the risk mitigation measures I identified last year properly, I’d have averted this latest crisis and wouldn’t have been in the predicament that I found myself in. Which isn’t all that dissimilar to the risk management efforts of some organisations that I’ve come across over the years.

 

The problem is that implementing risk mitigation measures often involves some effort or expense, or both. And quite often there’s something more pressing or more interesting to do. As a result, the mitigation measures are sometimes poorly implemented or not completed, or not monitored for their effectiveness. But the bottom line is that, to be effective, mitigation measures have to actually be done, rather than just written down in a risk register and forgotten about.

 

The second point, from a business continuity point of view is that, my own personal crisis happened during a particularly busy period work-wise, with some end of year deadlines looming. And my attention was somewhat diverted from these by my own problems. Many business continuity plans make no allowance for this and just assume that people will forget all about their own personal issues and be 100% available and focused on the recovery efforts of the organisation in question. I put it to you that this assumption may need a re-think.

 

A gin and tonic with ice!

 

I’m pleased to report that during the two subsequent cold spells our pipes remained unfrozen and the water continued to flow. And, most importantly, the washing up mountain has remained under control and the ice has been there for us when we needed it. Cheers!

Visit Andy's Blog >>
Follow Andy on Twitter @AndyatAcumen >>

Evaluating Threats as part of Business Continuity

John Bartlett CBCI, DBCI

My first article ‘An introduction to Business Continuity’ introduced Business Continuity (BCM) related risks and outlined different types of risk that we and our organisations can experience. Risks are unavoidable; how we assess these, decide which ones to deal with and the level of risk we are prepared to accept (our risk appetite), is entirely within our control.

Whole industries have been established and libraries of books written on Risk Management. Often risk and risk management means different things to different people and industries.

The Ramblings of a travelling BC Consultant

Andy Osborne,
Consultancy Director, Acumen
Author of Practical Business
Continuity Management
 

Last week I paid, quite literally, a flying visit to Dublin to meet a prospective client. The trip presented me with two opportunities. First and foremost, the possibility of some new business, but also the rare opportunity to sample “the black stuff” (Guiness) in its native environment.

 

For those of you who know me, I do like a nice cup of tea and, in my more relaxed moments, I’m quite partial to the odd gin and tonic. I also enjoy a glass or two of red wine every now and again. But just occasionally, I’m not averse to a pint of Guinness. And, as I discovered on a previous trip to Dublin some years ago, the Guinness there beats the proverbials off the Guinness in England. I don’t know what it is that makes it so much better. Maybe it’s brewed differently; maybe it’s the water; or maybe, like the French with their wine, the Irish keep the best stuff for themselves (and wo can blame them?) - perhaps someone can tell me. Anyway, it was an opportunity that was just too good to miss.

 

My meeting finished at about 1:30pm so, after a brief stroll round the city, during which I thankfully managed not to bump into the hen party that shared my flight in – not that i have anything against them per se, it’s just that the fifteen or twenty “ladies” with the words “on it til we vomit” emblazoned on their t-shirts sort of signalled their intent, as well as being just a bit scary – I selected a local hostelry in which to have lunch. I ordered my meal and asked for a pint of Guinness, now feeling really quite excited at the prospect. But in one of those “I don’t believe it” moments I was well and truly flabbergasted when the barman told me that they didn’t serve Guinness here! Victor Meldrew eat your heart out! I’d just walked past about two dozen pubs, hotels and other establishments advertising Guinness and I’d managed to walk into what is probably the only bar in Dublin that doesn’t sell the stuff!

Now I thought I’d made a pretty reasonable assumption but I’d quite clearly got it hopelessly wrong.

 

That’s the trouble with assumptions, of course…

 

Like the one about all of our key people being available when we need them; or the one about the IT recovery working even though it’s never been tested; or the willingness of our people to up sticks and relocate at a moment’s notice and work from some remote location for weeks on end; or that local office accommodation with all of the necessary equipment and telecomm’s circuits will be available within a few days; or that the media won’t talk about us if we don’t talk to them. The list goes on.

 

So I finished my lunch and got a taxi back to the airport, a good few hours earlier than I needed to, assuming I’d be able to find somewhere quiet to work – like, perhaps the cafe in the arrivals hall that I’d sat in for an hour when I first arrived. How wrong I was. I know that Dublin is a popular destination for stag and hen weekends but I’d sort of assumed that the numerous groups of stags and hens flying in might at least wait until they got into town before they got completely drunk and disorderly. That, of course, perfectly illustrates the problem with assumption.

Visit Andy's Blog >>
Follow Andy on Twitter @AndyatAcumen >>

Identifying essential activities for Business Continuity

John Bartlett CBCI, DBCI

A key and fundamental aspect to any BCM programme is the need to identify those activities that are essential within the scope of the BCM programme. In the BCM lifecycle, this step is referred to as ‘Understanding your Business’ and consists of three parts:

1. Business Impact Analysis (BIA) –identifies the impacts over time that a disruption may have on individual activities and the organisation’s ability to operate and continue;
2. Continuity Requirements Analysis (CRA) – resources required by the organisation to continue, restart and bring back to normal essential activities;
3. BCM Risk Assessment – a threat assessment which identifies the likelihood and potential impact on specific functions from known and identified threats.