By David Honour
shift seems to be taking place from disaster recovery-based attitudes
to business continuity to a more holistic business continuity management
approach. The former focuses planning activities and budgetary spending
upon business resumption and disaster recovery, while the latter
has the main objective of preventing business interruption in the
Business continuity management aims to proactively
manage all business processes, assets, facilities, supply chains
and human resources to ensure that, as far as is feasible, the business
will always function at its highest capacity. This is distinct from
disaster recovery-based business continuity which concentrates on
ensuring that contingency plans and procedures are in place to return
to business as usual as soon as possible after a crisis. Business
continuity management does not neglect disaster recovery, but it
sees it as a last resort.
However, as business continuity management
develops it is coming up against a major obstruction in many organisations;
that of corporate culture.
To be truly effective, business continuity
management must be more than a programme, it must be deeply embedded
into the corporate psyche of every employee. The organisation must
become risk aware, and each employee must see the management and
reporting of the risks under their control as their personal responsibility.
To achieve this, the business continuity manager
must don another hat. He / she must become a change management advocate.
The first step in the change management process
is to understand the general culture of your company. If you are
a long-term employee you will probably already have a good feel
for how risk aware, risk accepting and risk adverse your company
is, as well as the general attitude towards, and respect for, company
rules, regulations and procedures. However, you cannot assume that
you are correct and some research into company culture theory and
into the real attitudes within your company is an important starting
Stage two is to determine your vision. You
now know where your organisation currently stands; you need to know
where you want to take it. What is your aim for each division, department,
line manager and individual worker? What would your ideal look like?
What will you expect in terms of risk assessment, risk reporting,
risk mitigation and risk management activities and responsibilities?
You cannot achieve culture change unless you know where you are
Once you are clear about your destination you
can know create your roadmap. How are you going to get your organisation
to move from position a to position b? This requires a defined strategy,
it won’t happen by accident and it won’t happen quickly
or without hard work.
Aspects to include in the change management
* Working top-down
Senior management *have* to be on-board. Without their support and
sponsorship you will get no-where. They need to understand what
you are trying to do and why, and need to be included in the initial
strategy development phase. Senior management must lead by example
and must model the business continuity / risk aware culture that
you are attempting to create.
* Selling change.
The reasons behind change need to be clearly articulated. If people
do not understand why they need to change, they are more likely
to resist change or to offer half-hearted acceptance. Extensive
training and awareness work needs to be carried out. Employees need
to know 'what's in it for me?' They need to understand that the
changes that are being made will safeguard their jobs and their
future, by making the company more resilient against failure.
* Cascading modelling.
Each tier of management must take responsibility for modelling the
new risk-aware culture. Managers must take responsibility for selling
the culture change to their staff and for ensuring that the day-to-day
requirements of the new risk-aware culture are met.
* Win over the human resource department.
Your most effective supporters should be the HR department. HR will
need to understand and buy-in to your vision and will need to be
part of the training and awareness programme. When the culture is
established HR will need to take responsibility for building risk
awareness and responsiveness into HR policies, job descriptions,
psychometric testing etc
Once the new culture is established it must be enforced. There must
be some sanction for those who consistently fail to manage and report
Culture change is not something to enter into
lightly, but, for most organisations, if business continuity management
is to become an across the board reality, then it is essential.
The above only scratches the surface of a huge
topic. Over the coming months Continuity Central will publish more
information focussing on this area and will bring tools and resources
to the attention of business continuity managers who are attempting
to work thorough culture change issues.
If you have experience or resources in this
area we would like to hear from you.
David Honour is editor of Continuity Central.
24th October 2003 •Region: Worldwide •Type:
Article •Topic: BC
Rate this article or
make a comment - click