Business Continuity and Crisis Management are often confused as the same thing
Recently, I have run across an interesting problem. It’s something that came up recently, and I want to share it with you. People around me are taking opposing views about whether business continuity and crisis management are the same things or not. One group sees crisis management as part of an emergency management structure. They believe that business continuity only focuses on helping business operations to recover from an outage. Others, like the Disaster Recovery Institute International (DRI), see crisis management as part of an overall business continuity management program. Both sides believe there are right.
Let's start with Crisis Management
Crisis management is the process of responding to, planning for, and mitigating emergency events. As a discipline, it has a planning process, distinct teams, and response structure. It developed from the emergency management structure globally, based on the phases of disaster management. Depending on your exposure, you may be familiar with four or five aspects of disaster management. I prefer five stages, which addresses: prevention, mitigation, preparedness, response, and recovery. However, in the United States, the Federal Emergency Management Agency’s (FEMA) mission statement focuses on mitigation, preparedness, response, and recovery activities.
Regardless of which structure you embrace, the objective of crisis management in the private sector is business protection. As emergency response focuses on life safety, crisis management addresses how to stop damage once an emergency happens and support business recovery. The value of crisis teams is that they engage in response activities during an event and assist the business with a return to daily operations. Outside of crisis events, personnel conduct planning, exercise, and mitigation actions to limit the impact of future incidents.
The Importance of Business Continuity
Business continuity, on the other hand, is the distinct practice of planning for and helping a company’s essential functions recover from an interruption or outage. Continuity focuses on critical aspects of business operations. It lays out what business units need post-interruption. It focuses on strategies for resumption after impacts on the workplace, personnel, network, or loss of a critical third-party supplier. The plan itself documents the procedures for recovery (ISO 22301, clause 3.5).
In today’s marketplace, it is vital to address threats from various sources that could negatively impact a company’s reputation and resilience. Effective business continuity plans also address the impacts of existing regulations and legal ramifications of a work stoppage. Effective business continuity plans put strategies and steps in place to help the business go back to work post-crisis.
The BC vs CM Balancing Act
Now, it is true that an organization should have both elements to respond and recover from emergencies. I am amazed at how often people confuse these areas because they each have a separate focus. Some link these disciplines into one holistic process, so it is easy to understand when people mix them up. Often, the overlap happens when the two subjects sit in the same group with a catch-all label like Business Continuity Management. Instead of understanding that there are different components of related work, it is natural that people lump them together.
There can be a real danger in this approach when the two disciplines are housed together without clear distinction. If the differences are not made clear, there can be a lack of understanding about why these activities are separate. The strategy of mixing business continuity and crisis management can lead to challenges in the workplace. It can also lessen the effectiveness of your response and recovery activities. Misunderstanding often happens when people you are engaging do not understand what disaster work is in the first place. With the overuse of words like disaster, crisis, and emergencies, it is no wonder that people get lost in our jargon. So, there needs to be a real effort on our part to help others recognize the difference.
Why you need both in a good BCM program
As with other things in the field of disaster work, it takes continued leadership to be transparent. Most business continuity associations will argue that a successful program integrates crisis management. They say that the organizational program needs to include business recovery, crisis management, disaster recovery, and emergency response.
I agree with this assessment, but I am seeing communications groups labeling activities related to reputation management or public relations crisis management. Although I understand the need for brand image protection in today’s fast-paced social media world, reputation management is only a part of the crisis management process.
Instead of working together, many organizations ‘ IT, communications, security, risk, disaster recovery, and business continuity groups work in silos instead of a unified response structure. This approach confuses leadership and impacts our ability to protect the organization as a whole. It would be better to adopt an integrated approach that separates the disaster phases.
Summary
What do you think? How is the work organized in your company, and do you agree with the structure or not? I want to hear from you whether your business makes a distinction between business continuity and crisis management.
If you haven’t already, I invite you to check out my related blogs:
Top Three Crisis Events Of 2019 So Far