A review of the Business Continuity Institute's position statement on organizational resilience
- Published: Friday, 19 February 2016 09:36
The Business Continuity Institute recently published a very welcome positioning statement, looking to set out its view on organizational resilience. In this article David Honour, editor of Continuity Central, looks at the statement and invites business continuity and resilience professionals to have their say.
In the preamble to the positioning statement, BCI board member Tim Janes states that its aim “is to add clarity regarding the position of business continuity in the context of organizational resilience. It also provides the BCI’s perspective on how the development of resilience concepts may impact on the practice of business continuity.” There is certainly a need for such clarification. I have attended many webinars on the subject of organizational resilience and there is little agreement about how to define it, where its boundaries are, what it includes, and where it sits in relation to business continuity, risk management and other protective disciplines.
Working through the key points
The BCI’s positioning statement offered six key points and working through them in order they are:
Business continuity is not the same as organizational resilience
Although this seems an obvious statement, it is still an important one to make. Organizational resilience, certainly as envisioned by the standards committee that developed BS 65000, BSI’s ‘Guidance on organizational resilience’ standard, is a much wider ranging discipline than business continuity management. BS 65000 states that organizational resilience is the “ability of an organization to anticipate, prepare for, and respond and adapt to incremental change and sudden disruptions in order to survive and prosper”. It is the adaptive nature of the incremental change aspect which clearly sets organizational resilience apart from business continuity. This is something that is emphasised in the definition of organizational resilience in the draft version of the ISO 22316 international organizational resilience standard, which defines organizational resilience as the "adaptive capacity of an organization in a complex and changing environment.”
Confusingly, ISO 22301, the international business continuity management standard, seems to claim that organizational resilience is an output from the business continuity management process. Business continuity management is defined by ISO 22301 as “a holistic management process that identifies potential threats to an organization and the impacts to business operations those threats, if realized, might cause, and which provides a framework for building organizational resilience with the capability of an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities.” Presumably this discrepancy will be one of the issues discussed when ISO 22301 under goes its scheduled update.
The effective enhancement of organizational resilience will require a collaborative effort between many management disciplines.
BS 65000 specifies 21 separate operational disciplines that will need to be integrated to enable effective organizational resilience. How realistic this is will depend on each individual organization, but whatever the practicalities there is no doubt that silos are the enemy of the organizational resilience management discipline and the more resilient an organization wishes to be, the more joined up it will need to be.
No single management discipline or member association can credibly claim ‘ownership’ of organizational resilience, and organizational resilience cannot be described as a subset of another management discipline or standard.
While no single management discipline can claim ownership there is no doubt that this is where the battleground will be in many organizations unless leadership comes from top management. I would expect to see the emergence of chief resilience officers as a common designation in forward thinking organizations, with the role of leading the process. There seems no doubt that organizational resilience needs to be seen as a discipline which spans all four areas of organizational planning: strategic, tactical, operational and contingency.
In terms of whether any member association can “credibly claim ‘ownership’ of organizational resilience,” this is another battleground with various organizations vying for position. Whether one emerges as the clear leader waits to be seen.
Business continuity principles and practices are an essential contribution for an organization seeking to develop and enhance effective resilience capabilities.
There seems little to argue with here; but the important nuance is that business continuity is part of the organizational resilience jigsaw, not vice versa. Organizational resilience is not an output from the business continuity process; rather business continuity is one of the essential tools in the organizational resilience toolbox. However, the adaptive requirements do bring challenges to traditional business continuity techniques. For example, is the BIA in its current format really agile enough to provide the day-to-day information needed for effective organizational resilience?
The wide range of activities required to develop and enhance organizational resilience capabilities provide an opportunity for business continuity practitioners to broaden their skills and knowledge, building on the foundation of their business continuity experience and credentials.
There is undoubtedly an opportunity here. The business continuity profession has been leading the organizational resilience debate; and business continuity professionals should we well placed to lead their organizations into this brave new world. However, it will be important that business continuity professionals recognise the need for more strategic and tactical experience and influence if they are going to take their seat on the board as the new chief resilience officer.
The BCI, working with related partners and industry groups where appropriate, will develop relevant knowledge resources and training to support members who wish to advance their organizational resilience knowledge and skills.
This is to be expected and welcomed. The BCI has already staked its claim for the resilience market place, with the change in the wording of its purpose statement from “Promoting the art and science of business continuity management worldwide” to “To promote a more resilient world.” Leadership is necessary and the BCI is well placed to provide this. However, it is also important that a broad range of professionals become resilience leaders rather than followers. The discipline of organizational resilience is in its infancy and in order to grow to maturity it requires thinking outside the box. The current BS 65000 standard and the under development ISO 22316 need to be seen as a starting point, not the final word. Innovative professionals at the sharp end are necessary, to demonstrate how organizational resilience can move from being a huge and amorphous pipe-dream to something practical which organizations of all sizes can practice.
Make a comment
If you would like to make a comment on the above or on organizational resilience in general please click here.
I am pleased to see that BCI has made a position statement on organizational resilience and that Continuity Central has begun this conversation in the manner that it has.
In 2006 ICOR created its Resiliency Framework as documented in its University and built its education and credentialing programs around this Resiliency Framework. We are in the process of updating this framework to reflect some of the recent published work by BSI and as part of our participation in the development of the draft ISO 22316 standard on Organizational Resilience.
In addition, our certification program is built upon the capability and experience of resilience professionals and their understanding of how to coordinate these management disciplines as a leader in the organization. The different levels of certification are tied to their competence in the number of disciplines.
It is my belief that a contributing reason for why it has taken so long to produce ISO 22316 is due to the ‘battleground’ as you state where different management disciplines have tried to claim ‘ownership’ of organizational resilience.
Something that was not mentioned in your article is that the coordination of management disciplines or systems is but one attribute and activity proposed in the draft standard. Effective and empowered leaders, clarity of purpose, culture of resilience, anticipating and managing change, continual improvement, resource availability, and information and knowledge are the others.
The standard will be out for comment soon and we look forward to a wider audience for review and suggestions for improvement. We hope that the ‘battleground’ between disciplines will be limited!
Lynnda M. Nelson
The International Consortium for Organizational Resilience (ICOR)