Business continuity management continium
I get asked how crisis management & business continuity align. For this blog, I’m defining business continuity as business recovery. However, I recognize that business continuity management typically encompasses the emergency response and recovery lifecycle. I’ve worked mainly on the operations side, but much of what I am saying applies to IT DR processes. As we discuss resilience, it’s helpful to recognize that the regulatory rules in the UK for operational stability will drive improvements in Business Continuity Management (BCM).
For example, risk management in many firms brings BCM to the table to access their functional, application, and dependency data. Business Continuity Management is also valuable to better understand the organization, enabling risk to identify gaps while mapping the IT infrastructure. Yet, although closely interlinked, crisis response and recovery are two separate disciplines. Since I often get the question from you about this, I want to share how they align. So, let’s jump in.
Crisis management structure
Crisis management is the emergency management of the private sector. As I mentioned in my blog, Business Continuity vs. Crisis Management, it is the process of responding to, planning for, and mitigating emergency events. Its responsibility is to limit the damage of an unexpected event and organize resources to address the situation. However, it also supports business units to recover from any outages. The goal is to return the org to normal operations. Of course, we know that it is not always possible. So, a near or next normal state can be the goal.
The intersection of crisis management and business continuity is the necessary synergy between stabilizing operations and enabling business units to resume work from interruptions. Of course, the process is so much more as a crisis can impact employees, customers, reputation, assets, operations, or even the public. All of our business continuity plans don’t matter if the crisis management teams can’t assist in stabilizing the situation to allow for resumption. With the rapid increase in frequency, complexity, and concurrent events, resilient organizations will continue to need a robust crisis management component—ideally, a full-fledged program. Resilience expects that the enterprise will be able to reduce downtime and incur more negligible impacts–from employees to offices.
Business continuity value
How crisis management & business continuity align is in the handoff between the two. Crisis management vs. business continuity works hand-in-hand to ensure that a company can bounce back quickly. Recovery encompasses the procedures and strategies determined by a business process that assist them in coming back from an interruption. As you know, the lifecycle includes planning for difficult situations. Crisis management and recovery overlap. It’s not always a linear process. Due to that, resilience practitioners need to be thoughtful about the synergies and alignment of the resources necessary to maximize efficiencies within the disciplines. Sadly, as I talk to colleagues, one area tends to subsume the other due to company culture or interest. However, both are needed, and more significant calibration is required to allow for the appropriate investment in these areas based on a company’s needs.
Generally, I am an advocate for distinct but collaborative programs. Doing this ensures that each area receives the focus and support it requires. My recommendation is business recovery focuses on planning and deep-dive analysis of the business functions’ pain points. Learn what keeps the business up at night. Then, focus on planning for these likely scenarios. Taking this approach makes a recovery real, and the operations get trained in areas of most significant concern. By doing this, you raise their skill level, get their attention, and create stronger resilience.
Tying it together
So, how crisis management & business continuity align is in the space from emergency to resumption when an organizational structure is needed to help regain equilibrium. Let crisis management focus on the unplanned, larger-scale hazards through ongoing training and exercising of the business. Simple, straightforward crisis management plans that focus on developing the proper structure for response are valuable. Instead of just mobilizing when a large-scale event happens, crisis management structures need to implement practices for improving response frameworks.
A newer idea is microsimulations, which I find fascinating to provide a pop quiz way to keep ourselves ready on an ongoing basis. Approaches like this build our muscle memory rather than infrequent tabletops, which are the industry norm. If we can also make it fun and exciting (i.e., gamified), all the better. Everyone wants to feel that they are in the know and enable to perform at their peak. I cannot see a better way to build competence than embracing continual but low-touch virtual testing sessions. It is something to ponder. Regardless, resilience programs require both crisis response and business recovery pillars to prepare successfully.