Comment: Culture change is key to business continuity management

By David Honour

A shift seems to be taking place from disaster recovery-based attitudes to business continuity to a more holistic business continuity management approach. The former focuses planning activities and budgetary spending upon business resumption and disaster recovery, while the latter has the main objective of preventing business interruption in the first place.

Business continuity management aims to proactively manage all business processes, assets, facilities, supply chains and human resources to ensure that, as far as is feasible, the business will always function at its highest capacity. This is distinct from disaster recovery-based business continuity which concentrates on ensuring that contingency plans and procedures are in place to return to business as usual as soon as possible after a crisis. Business continuity management does not neglect disaster recovery, but it sees it as a last resort.

However, as business continuity management develops it is coming up against a major obstruction in many organisations; that of corporate culture.

To be truly effective, business continuity management must be more than a programme, it must be deeply embedded into the corporate psyche of every employee. The organisation must become risk aware, and each employee must see the management and reporting of the risks under their control as their personal responsibility.

To achieve this, the business continuity manager must don another hat. He / she must become a change management advocate.

The first step in the change management process is to understand the general culture of your company. If you are a long-term employee you will probably already have a good feel for how risk aware, risk accepting and risk adverse your company is, as well as the general attitude towards, and respect for, company rules, regulations and procedures. However, you cannot assume that you are correct and some research into company culture theory and into the real attitudes within your company is an important starting point.

Stage two is to determine your vision. You now know where your organisation currently stands; you need to know where you want to take it. What is your aim for each division, department, line manager and individual worker? What would your ideal look like? What will you expect in terms of risk assessment, risk reporting, risk mitigation and risk management activities and responsibilities? You cannot achieve culture change unless you know where you are heading!

Once you are clear about your destination you can know create your roadmap. How are you going to get your organisation to move from position a to position b? This requires a defined strategy, it won’t happen by accident and it won’t happen quickly or without hard work.

Aspects to include in the change management strategy include:

* Working top-down
Senior management *have* to be on-board. Without their support and sponsorship you will get no-where. They need to understand what you are trying to do and why, and need to be included in the initial strategy development phase. Senior management must lead by example and must model the business continuity / risk aware culture that you are attempting to create.

* Selling change.
The reasons behind change need to be clearly articulated. If people do not understand why they need to change, they are more likely to resist change or to offer half-hearted acceptance. Extensive training and awareness work needs to be carried out. Employees need to know 'what's in it for me?' They need to understand that the changes that are being made will safeguard their jobs and their future, by making the company more resilient against failure.

* Cascading modelling.
Each tier of management must take responsibility for modelling the new risk-aware culture. Managers must take responsibility for selling the culture change to their staff and for ensuring that the day-to-day requirements of the new risk-aware culture are met.

* Win over the human resource department.
Your most effective supporters should be the HR department. HR will need to understand and buy-in to your vision and will need to be part of the training and awareness programme. When the culture is established HR will need to take responsibility for building risk awareness and responsiveness into HR policies, job descriptions, psychometric testing etc

* Enforcement.
Once the new culture is established it must be enforced. There must be some sanction for those who consistently fail to manage and report risks.

Culture change is not something to enter into lightly, but, for most organisations, if business continuity management is to become an across the board reality, then it is essential.

The above only scratches the surface of a huge topic. Over the coming months Continuity Central will publish more information focussing on this area and will bring tools and resources to the attention of business continuity managers who are attempting to work thorough culture change issues.

If you have experience or resources in this area we would like to hear from you.

Make a comment

David Honour is editor of Continuity Central.

•Date: 24th October 2003 •Region: Worldwide •Type: Article •Topic: BC general
Rate this article or make a comment - click here