Evidence-based business continuity management
Introduction – evidence-based medicine Arguably, the starting point for the essay was Cochrane’s experience as a Prisoner of War in World War 2 where he found himself as the only medical officer in a camp with over 20,000 PoWs. Under-nourished, lacking in facilities and without modern pharmaceuticals, he expected the camp to be decimated by TB, typhoid and diphtheria. However, in his six months in the camp only four PoWs died: three of those from gunshot wounds. This triggered in the young doctor scepticism about the effectiveness of many conventional treatments and set him on a lifelong search for a more scientific approach to medicine. Every profession risks overestimating its own effectiveness and I suggest that it is timely, at this early stage in the growth of business continuity management, to review if we can truly justify everything that we do as a profession or if we have already started accumulating the baggage of custom and tradition. Defining inputs and outputs Typical measures for inputs in healthcare are: Directly analogous measures can easily be defined for business continuity management, such as: The key measures of output for a healthcare system are mortality and morbidity. Business continuity management is generally promoted in terms of its impact on the survival of organisations i.e. in terms of ‘mortality’ but something analogous to morbidity would actually be a more useful measure. In the same way as the young Cochrane found that the lack of medical care had little impact on mortality, it is unquestionably the case that organisations have survived and prospered for centuries without any formal business continuity plans. The first major challenge for evidence-based business continuity management is therefore to define an appropriate measure of the output from investment in BCM. The most obvious answer is to measure something like ‘availability of critical systems’ but systems are not an end in themselves and such a metric says nothing about the impact on the business as a whole. As an intermediate step it is preferable therefore to look at a more business-focused measure such as ‘customer satisfaction’. Ultimately though, it should be possible to demonstrate that business continuity management makes a positive impact on the overall performance of the organisation as measured by, for example, profitability or growth. Measuring effectiveness Case-control study Most existing attempts to justify the effectiveness of business continuity management have been based on a retrospective approach – e.g. the famous ’80 percent of businesses without a business continuity plan fail after a disaster’ quote - but without the rigour of a proper case-control study. The 80 percent figure (even if it is true) is meaningless without knowing how many businesses with business continuity plans also failed. Properly designed case-control studies though would appear to be a very promising avenue for further work: one could analyse similar-sized samples of businesses that failed and businesses that survived a disaster (e.g. Hurricane Katrina) to identify the relative proportion of business continuity plans or disaster recovery provision in each group. Cohort study Bearing in mind this caveat, conducting a cohort study of business failures could be a very frustrating process. Given the relatively low incidence of business failures, and the fact that only a small proportion of these are caused by operational disruptions of the sort that could reasonably be mitigated by business continuity management, one would need an enormous cohort and a great deal of time to gather any evidence of effectiveness. Returning to the earlier discussion of inputs and outputs, business failure (‘mortality’) is not the only, nor necessarily the most appropriate, measure of output. Useful evidence on the effectiveness of business continuity management activities might be gleaned from comparing some suitable measure(s) of business performance over time across a cohort of businesses some of which engaged in the activity (e.g. conducting annual crisis management exercises) and some of which didn’t. Randomised clinical trial (RCT) Whilst it has been very successful in medical research, it is difficult to see how an RCT would practically be implemented to gather evidence on business continuity management activities. One of the key advantages of the RCT is the ability (e.g. by the use of placebos in drugs trials) to eliminate the psychological effect of a treatment. Whilst it would be interesting to be able to eliminate the psychological effects of a business continuity management programme, there are very few BCM measures that can be effectively implemented without informing people of their existence. Conclusions Author: Patrick Roberts is senior consultant Needhams 1834 Ltd
•Date: 11th January 2008• Region: UK/World •Type: Article •Topic: BC general |
