New thinking required?
By David Honour, editor, Continuity Central
Business continuity requirements are changing.
Techniques that were adequate five years ago are starting to become
out of date. The key elements of the discipline are well documented
but the business world is moving on, driven by the demands of globalisation
and the 24 hour, high-tech society. I believe that four areas of
business continuity particularly need to be addressed; new thinking
Prevention rather than cure
Business continuity grew out of disaster recovery so it is not surprising
that the discipline still tends to focus on response and recovery.
However, today’s business world demands much more. The need
for zero downtime of mission critical processes is growing, meaning
that prevention, not recovery, is now the order of the day. Business
continuity managers need to recognise that they are in the business
of disaster prevention, not disaster recovery. This requires a fundamental
shift in the traditional approach to business continuity. Under
this new paradigm business continuity truly becomes a management
discipline – managing the mission critical business processes
to ensure continuous availability. This is proactive, interventionist,
hands-on involvement in day-to-day company operations.
In the 21st century organisation business continuity can no longer
sit in its own silo, separated from IT disciplines; information
security management; operational risk management; crisis communications;
emergency planning etc (delete as appropriate for your organisation!)
Business continuity must bring all business protection issues under
its umbrella, ensuring effective oversight of all mission critical
processes, giving transparent insight into all areas of the organisation
and allowing effective continuity management.
In too many organisations vital mission critical
risks go unmitigated because separate departments all think that
the threat is being handled by someone else. This problem can only
be truly resolved by taking a holistic approach to business continuity.
Flexible crisis plans
One of the biggest lessons from September 11th was that disasters
are not predictable. Many business continuity plans failed because
of inflexibility – recovery processes required rapid lateral
thinking, not set procedures and flow charts.
Recovery plans need to be kept very simple,
with much more emphasis being given to crisis team development.
Teams should be trained to think outside the box and should conduct
regular exercises, which must test their abilities to act quickly
and calmly under extreme pressure.
If it comes to a choice, it is safer for a
company to have a well trained crisis management team capable of
quickly reacting to any disaster than to have a formal business
continuity plan. The wise organisation will have both.
Using BIA in a different way
The business impact analysis is undoubtedly a crucial tool for the
business continuity manager, however for the larger organisation
it can no longer be relied upon to produce an overall picture of
organisational risks. BIA tends to rely on information seeking via
questionnaires and interviews and as such is time-consuming and
cumbersome. When you add in the fact that business processes change
and develop rapidly, the BIA often provides the BC manager with
out of date and incomplete information.
To be truly effective organisations need to
change their approach to the BIA from being an information seeking
to an information gathering process. Business divisions need to
be trained to assess their own risks and to make impact analyses.
Ownership of this must be a key responsibility of a senior manager
in each organisational division and a regular business impact report
should be a mandatory requirement of his / her role.
In this way, the BIA is no longer an occasional
‘snapshot’ of business risks, it becomes and ongoing
business continuity management tool.
Have your say
Want to add a comment? Use the link below or e-mail David
to view reader comments.
7th March 2003 •Region: Worldwide •Type:
Article •Topic: BC
•Rate this article
or make a comment - click