Divider
Divider

Jim Burtles
Jim Burtles

Business Continuity: Tools and Techniques

How to get started.

September 8, 2011
by Jim Burtles, KLJ, MMLJ

Disaster recovery which sought to recover data processing was a product of the 1970s. Disaster Recovery evolved into contingency planning in the 1980s, focusing on supporting the end users. Business continuity, which arrived in the 1990s, aims to support the whole of the business. Fear of the Millennium Bug caused a flurry of activity which turned into apathy after the big non-event, i.e. nothing much went wrong. The appearance of regulations and standards has raised the profile of business continuity in recent years.

The Business Continuity Institute (BCI) was founded in 1994 and published the first set of standards, which were developed in collaboration with the Disaster Recovery Institute (DRI). These ‘Standards of Competence’ defined the skills and formed the basis for evaluating the capability of a business continuity practitioner. Shortly after that, the phrase Business Continuity Management (BCM) emerged as the term to describe this multi-skilled lead discipline in the framework of modern governance.

Originally the DRI focused its attention on the local US market but it soon realized there was a global interest in the subject and changed its name to the Disaster Recovery Institute International (DRII) to reflect its intentions to operate around the world.

Overview

Like any other serious project or program, business continuity requires a champion. A sound game plan forms the wisest starting point, which means knowing what should be developed and delivered and how to convince others of the need.

Board-level motivation is the key to success, taking external as well as internal factors into account. Added value is an obvious benefit to them. Business continuity is best approached on a modular basis, suiting those modules to the size and structure of the organization.

There are an increasing number of standards in existence today and they may need to be interpreted to suit the nature of organization. The support of the auditor is a distinct advantage but they may require education to develop that support.

Every project or program has to start somewhere and requires someone to take the lead and make it happen. All too often good ideas gain token support for a brief while and then are abandoned in favor of some other more meaningful, more ambitious, more achievable or politically appropriate prospect. The secret of long-term success is to embed the components of success into the launch of the exercise.

These components of success include:

  • The right level of support behind the concept;
  • An enthusiastic and popular, champion to lead the project;
  • A viable game plan with regular milestones;
  • A clear vision of the deliverables and other outcomes; and,
  • One or more motivators that carry weight at board level.

There may well be other factors that can generate energy, funding and enthusiasm for the tasks ahead. If you cannot generate enthusiasm, you must at least gain acceptance for the work. Familiarity with the culture and the personalities involved may help you to judge the right ingredients. In any case, it is wisest to wait until you have prepared the ground before you launch yourself into the unknown.

I recommend that would-be adventurers read The Mind of a Fox by Chantell Ilbury and Clem Sunter. They outline a very sensible, structured approach that is likely to prove more fruitful than simply plunging in at the deep end. By adopting the mindset of a fox they suggest you can make wise choices about strategies and tactics, which are likely to lead to a successful outcome. The alternative is the hedgehog’s rather blundering approach, which can lead to disappointment and frustration.

The Right Level of Support

In order to start your business continuity program and get it off the ground and flying, you are going to need support from the highest levels in your organization.

For any attempt at business continuity to be successful it needs to be approached as a permanent fixture rather than a temporary attachment. The support for it needs to be stable and wide-ranging, which means getting the attention and the backing of one or more of those who can command respect and support throughout the entire enterprise. Of course, this is an ambitious starting point but it is the only effective way of ensuring the long-term cooperation of your colleagues, an allocation of funds and protection of the resources against hijacking.

In a typical commercial organization we are looking to gain the support of the chief executive or the managing director, i.e., someone who is in a position of unquestionable authority. Without their support it will be difficult to launch the program, much less sustain its momentum beyond the first stages. The ideal would be a commitment to support the BCM program from the entire senior management team. However, it is unrealistic to expect to generate such wholehearted support without some outside influence such as a regulatory body imposing the need or a catastrophe causing these individuals to feel exposed.

One effective way to attract attention to the existing exposures and the advantages of preplanning is to run a short exercise, making sure all of the executive team either take part or get to know the results. It does not need to be a large-scale nor complex exercise. You need to have something short, sharp and to the point. The point you want to make is that they are ill-prepared to deal with a serious incident which could occur at any time. The evidence for their exposure will come out of the exercise and a little research will soon provide you with plenty of evidence to suggest how things can and do, go wrong even in the best-un firms.

Try to get a few minutes of their time during one of their regular meetings or bring them together for a special exercise. Ask them, for example, to imagine their building has just been damaged from a fire. Ask how they would cope with such a situation. Be realistic and press for full details:

  • What would they want to do and what would they use?
  • When would it actually be done?
  • Where would it be done and who would do it?
  • How would they manage and control the situation?

Hold a dummy staff briefing and a dummy press briefing where they have to explain their actions to others. Finally, you should finish with a full debriefing or a debate about the issues and concerns which have been raised. If no issues or concerns appear, then it is probably time to think about moving on.

This article has been excerpted from Principles and Practice of Business Continuity: Tools and Techniques. This publication is available on CPA2Biz.

Rate this article 5 (excellent) to 1 (poor). Send your responses here.

Jim Burtles, KLJ, MMLJ, FBCI, is a well-known international figure in the business continuity profession with 30 years of experience spread across 22 countries. He is a founding fellow of the Business Continuity Institute where he has served as a director for over 10 years.