Cultural conditioning – the training dilemma
Louis Pasteur once observed that ‘chance favours only the prepared mind’. In the context of business continuity management this implies that no matter how prepared an organization is to profit from effective business continuity management; the probability or likelihood of being successful will be greatly enhanced if mental preparation or conditioning is favourable. Those who strive to, and achieve, greatness in business continuity often do so, not because they have better plans or better technology, but because the corporate mindset – the summation of all thinking people within the corporate realm - has been collectively tuned to a common or unifying purpose which ‘touches’ everyone, and with which all can identify. This is achieved not through business impact or risk assessment work - important though these stages are - but through a genuine programme of transformation which alters human behaviour, values and culture. Or stage six of the eponymous BCM lifecycle. Present investment in training represents the Achilles heel of business continuity management, specifically the training and integration of cross-functional management teams to manage crises. The business continuity management process (still too often resourced and managed as a finite project rather than an enduring programme) must involve much more training at every level; and a shift in the balance of activity between analysis and training would, ideally, accompany this. It seems to me that BCM lives in constant danger of getting itself a bad name because it is reliant - sometimes over-reliant - on complex and often costly analysis from which too few people actually benefit; whereas training can quickly enfranchise everyone within the corporate realm often at low or reasonable cost. As practitioners we still talk about ‘testing business continuity plans’ whereas really we should be rehearsing people, exercising plans and testing systems. It is in the life-like conditions of such rehearsals that the best training takes place; training that is remembered and engrained into the subconscious. The emotional baggage associated with ‘tests’ serves as a block to its positive effects and acts as a barrier to adoption. Testing people has negative connotations and resonates too closely with the language of pass or fail. And no one likes failing: so tests are, unsurprisingly, studiously avoided on the grounds of being too costly, too time-consuming or irrelevant. Why would anyone therefore embrace the added risk of testing plans when they have a glowing audit report demonstrating that their documentation is compliant with BS 25999? Winning new friends and converting them to the ‘continuity cause’ is rarely achieved through analysis or a risk assessment. Much better, more fun and an easier win is to use the idea of a training programme to underpin the value of investing in business continuity and use the training ethos to engage with those resistant to the idea of training because of whatever blocking pretext is fashionable. The improvements to operational outputs and the strategic effects which flow from any well engineered BCM programme – all of which are positive – should have an uplifting effect on fragile hearts and minds. As a result, resilience as a concept improves and critical business processes generally continue to ‘harden’. The message is simple: it’s in everybody’s interest to train. The business continuity community must appreciate that members of incident or crisis management teams require an understanding of the interaction and co-ordination of different people with different responsibilities, and at irregular times when they would, more than likely, be operating under immense pressure. They must also be tuned into the key variables influencing information management, human behaviour, process and infrastructure vulnerability, and of organizational decision-making and internal politics. Above all, it is progressive training programmes that will enable decision-makers to understand and appreciate that incident / crisis management isn’t a product, a feature, or anything that we can simply acquire and then implement; it is a highly complex, organic process, one we must manage heuristically and optimize as an ongoing process. In other words the effort and prevailing assumptions inherent in producing a workable plan must be validated before anyone can have any confidence in its efficacy. Confidence is key. You can have a plan without an incident ever occurring, but you cannot manage an incident without a plan. Achieving confidence in the plans and planning process is best achieved in a benign environment, where mistakes can be made without fear of the consequences, before things go wrong for real. A continuous process of improving resilience based on a regular exchange of ideas, the cross-over of key skills and rapid decision-making is one of many vital outcomes of business continuity training. This must become the discipline’s enduring hallmark if stage six of the BCM lifecycle is to have any lasting effect. Our future credibility as BC professionals therefore, depends not just on testing technology but on rehearsing people in their planning assumptions and decision-making techniques; so that our legacy to the user community is one in which we continue to influence ‘our leaders, people, doctrine, organization and training; in order for them to take advantage of ideas, techniques and technology to achieve superior effectiveness in their decision-making, in their strategic recovery options, and (when events conspire against the status quo), in the speed and quality of their response measures.’ In practice this means that vulnerabilities and threats should be constantly acknowledged and managed; while vital senior management ‘buy-in’ – across an organisation – must be more than just endorsemanship and tokenism. Senior management, upon whom an organisation relies, must demonstrate that they can impose their corporate will on a given situation and make timely often life-threatening decisions in times of uncertainty, organisational paralysis and crisis. This is most effectively achieved through rehearsals as part of a rolling training programme. Rehearsal and training events should become must-do-events which everyone anticipates with optimism and confidence rather than worry and anxiety. Maintaining a regular and steady rhythm of activity – an exercise or training heartbeat – throughout the BCM lifecycle is the vital ingredient for success. Scheduled (and sometimes unscheduled) rehearsals, workshops and training events should be woven into the fabric of normal business culture. This helps to sustain operations in all environments where the commitment to, and requirement for, a joined-up approach to resilience grows more acute with each day. If business operations are affected, as they most surely would be if widespread disruption occurs; then training all decision-makers, and their teams, to minimise the consequences of disruption – however caused - by empowering them to take swift and decisive action is the top priority for any business continuity team tasked with implementing and maintaining a progressive training programme. And the programme must be creative, imaginative, ambitious, fun, thought-provoking and challenging. If it isn’t then training will fail to win hearts and minds and the BCM discipline will soon be consigned to the corporate scrap heap. Author: James Royds is a director of InfoSec Associates and a passionate advocate of the use of training exercises to bring business continuity plans to life. He has worked exclusively in the operational risk, information assurance and business continuity industry since 1996 and has taken part in or facilitated exercises all over the world. James is a Fellow of the Business Continuity and Chartered Management Institutes. www.infosec-associates.com
•Date: 18th July 2008• Region: UK/World •Type: Article •Topic: BC general |
