My colleague, in response to a previous asked a good question after reading one of my posts: What makes up a BCM program? I pondered this for quite some time and had to think about it. In fact, the response I put together is in two (2) parts and this will only be the first – expect the 2nd next week. I want to tell you that I’ve specifically left some things out so as to spark conversation and thought and bring ideas to the topic.
Some things came to mind and like many of you, there’s all sorts of things that came to mind. Some of the components are rather obvious and probably came to mind of everyone reading this post: BIAs, Crisis management Plans, Department BCPs, Emergency Response Plans and many other components that can be utilized. But then I got thinking of a few things and it didn’t’ seem to settle right. Do all of these things make up a BCM program? Let me explain.
When I was first thinking about a response I came up with the analogy of a car or vehicle. There are many types of vehicles on the road and they all have the same thing in common: enable people to go from one place to another. That’s it really; nothing more to it. However, depending on the type of person you are and what you do, the vehicle and its components will be different.
One vehicle may contain with power windows and power lock with leather interiors and all sorts of fancy gadgets to offer luxury to the driver and passengers. Of course, it also depends on the money the purchaser has to spend on a car as well. J Still, no matter what the vehicle has to offer – and there are hundreds of options and hundreds of vehicles ot choose from – the purpose is still to allow people to drive from one place to another. The reason for the vehicle may vary – take kids to soccer, grocery shop, many long road trips etc – but the purpose is still the same. So too is true about a BCM program. Not all programs will have the same level of detail, structure or components developed within it.
Larger companies may have larger components with each separate components managed by a small team of individuals. I know of one very large “wireless” company that does this (I know because I once discussed an employment opportunity with them) while other companies may have just a couple of individuals or a sole lonely person working on everything. And yes, some companies won’t have anything but I won’t go down that road right now – my vehicle is in the shop right now.
What I’m getting at is that all BCM programs should be tailored to the need and requirements of the organization. It shouldn’t be that organizations tailor their strategies, methodologies and practices to a specific practice. Of course, they all should use good practices to encompass what they need but there is no point in having components in place that aren’t needed – or that don’t have the resources to be able to do in the first place.
I know of one company that only had one individual who was responsible for a very large program and to make it work he combined the Risk Analysis with the Business Impact Analysis (BIA). It might sound strange to some but he pulled it off in one shot and got what he needed; he did what was right for the organization he was working for, regardless of what another company might do.
Still another person combined the “Coordinate Activities with Public Authorities” with the companies Health & Safety committee (which was done in conjunction with the Facilities team) and also leveraged what was put together for their Crisis Management Team (CMT).
Did these people cause issues for themselves? I don’t think so. They have exactly what they need and have created great programs yet if they were asked to show a specific tailored document to each program component, they may have difficulty showing it because it’s encompassed in other components. The point is that they still have what they need and not what someone else needs or what someone else has told them they should have. Here’s another example I found in speaking with a colleague the other day.
Some organizations follow specific methodologies and/or are trying achieve some level of certification and if that’s the case, these methodologies are going to say that there are specific components/actions/processes you must have in place to achieve the certification. When I say that I’m in no way knocking any of the methodologies or practices that are out there – all have benefits. Some have negative aspects too but maybe I’ll save that for another blog at a later date.
Let’s look at one component: the Emergency Response Plan and specifically the evacuation plan. Not all organizations have this in their plans because companies part of larger facilities don’t need to create their own evacuation plans. That is the responsibility of the property management company. Of course, they may summarize and send something out to their employees but once again, most – if not all – of this material is provided by the property management group. So any organization that resides in a multi-unit building will all follow the exact same process and don’t need to recreate the wheel. Why would you want to?
Now, involvement may come when each corporate resident offers up a couple of people for fire wardens or floor wardens for training and assistance but still, its not created by the corporation’s (the tenants) themselves. So, in saying that does a corporation need to document these processes (evacuation processes) when someone else has done it for them? Is this really part of their program or are they leveraging someone else’s plan?
If they are audited for certification, do they need to provide the processes to auditors considering they aren’t theirs and didn’t develop them – yet, they still follow them and consider them part of the program? Interesting question I think. I’m sure the property management people would be a bit peeved if they found out they were being audited in this manner (and I’ve seen this happened).
Here’s another idea, will a manufacturing company have the same level of BCM components – in size, shape, content – as a Financial Institution. Both will have many of the same needs but they have to be tailored to the industry and corporation they represent.
So it’s not as simple as saying what constitutes a BCM program – we can all ramble off many things – but it’s rather what the corporation itself needs in its BCM program and how they leverage other things.
So what constitutes a BCM program? It’s whatever the company deems necessary and what the company will actually need when the proverbial “you-know-what” hits the fan.
Now if you’ll excuse me, I have a car to pick up…it’s not the greatest but it meets my needs.