BCM / DR / BCP Programs: Is Our Industry Due for a Change?

There’s an old saying that says “change it the only constant” and that’s true for almost everything in the world.  Our communities change, the kind of car we drive changes, our homes change, our families change, the technology we use changes, our music tastes change (though we do prefer some kind of music over others), so why is it there is so much push back when there is a recommendation – or even just the spark of an idea – to change our Business Continuity/Resiliency Management industry?

In recent years there has been the question about changing the way specific components of a BCM program are managed, in fact, there’s even the suggestion to stop performing the way specific components of a BCM program altogether.  In some circles, this seems to have sparked a firestorm of controversy with some jumping for joy that the scent of a change is in the air, while other BCM professionals and practitioners vehemently promote the same-old same-old way of doing things.  Of course, I’m talking about the Adaptive BCP movement that calls for the removal of the Risks Assessment/Analysis (RA) and Business Impact Analysis (BIA) from the overall BCM core competencies. I’m not going to go into Mark and David’s overall mandate, as that’s for them to discuss in detail, but I do think they raise a great point; the point that it’s time for a change.

Many of us have worked for organizations and clients that have various methods of building, implementing and validating Business Continuity and Technology Recovery Plans, so it’s only natural for those changes – and the reasons for them – to be promoted.  When our day-to-day processes don’t align with the supposed frameworks communicated by various BCM and DR governing bodies, then the reality is that there is a need to consider change.  From a personal perspective, I’ve been to many client sites that want a specific delivery within a specific timeframe – that’s reality – so I have to adapt what the client wants with the way I know how things should be done.  It’s just a fact, that we have to adapt ourselves and our BCM/DR processes to changing expectations of clients, communities and organizations.  Sometimes, that means not performing a specific program component in the same way a governing body would expect.  Sometimes, an organization, community or individual already know the risk or the potential impacts and has asked us – the BCM/DR professional or practitioner – to take the next step of developing contingencies. 

That’s the reality, folks!  It DOES happen and programs and program deliverables are still created to the satisfaction and expectations of company executives. So why continue to deny that it doesn’t occur or that by removing a step – or changing the say a BCM program component is done – does not or should not occur?  Change is inevitable. If the Project Management Institute (PMI) can develop the Agile Project Management methodology, then why can’t our current governing bodies accept new ways of performing BCM program components.

Change can be difficult and make us feel as though we aren’t doing what we should, but as long as we get to the expected end-of-the-road deliverable, should it really matter what path we take to get there?  Especially if we understand the risks of doing things differently and we document and/or communicate that risk then we as practitioners and professionals should walk the path best suited to the situation and expectation at hand.  

I think the shake-up and change in attitudes and ideas is good for our industry.  It might make some feel uncomfortable but that’s good – it means we are hitting the right notes because it’s getting attention.  If we stay stagnant then we’ll eventually lose our edge and value, as we’ll be seen as inflexible dinosaurs – and you know what happened to them.  Change in inevitable because it’s already happening. 

Advertisements

Preparing for the Unexpected (2019-09-26) – Crisis Management w/ Regina Phelps

Join us on 2019-09-26 as we air an encore presentation of one of our most popular shows “Crisis Management: How to Develop a Powerful Program” with Regina Phelps. 

https://www.voiceamerica.com/episode/115855/encore-crisis-management-how-to-develop-a-powerful-program

Enjoy!

The StoneRoad Team

 

 

 

Preparing for the Unexpected – 2018-04-19: The Challenges of BCM/DR Programs – Part II

The April 19/18 show continues from where Part I of “The Challenges of BCM/DR Programs” left off. Join us and see if you’re encountering the same challenges.

https://www.voiceamerica.com/episode/105776/the-challenges-of-bcmdr-programs-part-ii

The StoneRoad Team

 

 

Preparing for the Unexpected – 2018-04-12: The Challenges of BCM/DR Programs – Part 1

No matter the industry, the size of your organization, or the location(s) of your business, Business Continuity Management (BCM) and Disaster Recovery (DR) programs always seem to experience a common set of challenges. Drawing from 20+ years of experience, Alex Fullick will discuss these many challenges that seem to transcend industry and location – and which seem to appear at one time or another – in every BCM/DR program. Listen in to hear why some of these challenges occur and how to deal with them when you begin to encounter the same issues in your program.

https://www.voiceamerica.com/episode/105645/the-challenges-of-bcmdr-programs-part-i

Enjoy!

The StoneRoad Team

 

 

Business Impact Analysis (BIA): Organizational Integration (Project Change Impacts)

One of the major challenges for Business Continuity Management (BCM) professionals and organizations is ensuring that their Business Impact Analysis (BIA) is kept current and update to date.  The problem with keeping the BIA’s up to date is that there is no process that integrates the BIA into the existing organizational functions.  Continue reading

BCM & DR: Can Organizations be Resilient?

There’s allot of talk of organization’s becoming resilient and how they need to be resilient if they are to compete successfully and respond accordingly to the ever increasing disasters of the world – both man-made and natural in causation. But that begs the question: Can organizations be resilient? In this practitioner’s opinion, yes, they can though it takes more than a single aspect to become resilient.

Many would have you believe that you can buy resiliency off a shelf; a service or product purchased from a firm touting that they can make your organization resilient, as though the procurement of a ‘product’ will make an organization resilient. Well, unless they are a pseudo-psychologist or have a background in leadership psychology, they can’t; at least not completely. Sure, it’s fine to say that Business Continuity Plans (BCP) and Technology Recovery Plans (TRP) et al will make an organization resilient but that’s just not the complete picture. It’s only part of the overall picture.

It’s just not a simple concept – though it would be great it if was. What will make an organization resilient? Is there some sort of magic ingredient that will suddenly ensure that an organization will bounce back from any adverse situation? Well, yes and no. It’s not one single ingredient, it’s multiple ingredients that when combined just so, will help any organization get through difficult situations.

The following sections outline some areas that must be considered as part of the overall resiliency plan if an organization is to become resilient. See which one’s fit within your organization and which items you might want to focus on to improve or instil a sense of resiliency.

1 – Previous Adverse Experiences
Resilient by definition means ‘bouncing back from adversity’ so no one can be resilient if there hasn’t been previous adverse situations that the person / organization hasn’t bounced back from. How is an organization resilient if it’s never had an adverse experience? How can you measure resiliency? What are you measuring against? What has it bounced back from to prove it became resilient? It can’t be because it’s wouldn’t have anything to bounce back from, so how could it ever know it was resilient? It can’t. Of course, some would say that because the organization didn’t suffer badly during a disaster, it was resilient. Well, maybe it really wasn’t a disaster or major crisis, just a well-timed and coordinated response; that doesn’t automatically equate to being resilient.

2 – Plans/Process
It would be ridiculous to suggest that BCPs and TRPs etc don’t help make an organization resilient; of course they do. These are what get opened up and followed (or used as a guide) when the ‘real’ situation occurs. Through consistent validation and testing, amendments are made and they become more and more robust over time; able to deal with a myriad of situations. If the plans are living, validated and leveraged, then the plans will help the organization become resilient. Not just from providing point by point activities but because the validation and the testing that goes on behind them helps instil a sense of accomplishment and progression to those who use them.

3 – Technology
You can set technology functions up in a way that keeps it going even when the power goes out; even when a primary server (or other component) goes down and data/communications are redirected. You can keep the ‘green lights’ on in many ways (too many for this small article). The technology component is the single most discussed area of resiliency, to the point where many organizations believe they are resilient simply if they have a strong technology recovery or IT disaster plan in place. Well, we know that IT is only part of the overall picture.

4 – Leadership
Leaders are usually leaders because they are resilient as a person, not because they have a high profile title behind their name. They have fought there way through the ranks, overcoming obstacles and thought their way through many complex challenges, all so they can be the leader – or a leader – of an organization; a reward for hard work and perseverance. A good leader will give back to the organization and help train others within the organization how to better focus energies and deal with adverse situations.

5 – Culture
Who creates the culture? Leaders, create it. If the aspects noted in #4 are true, then the corporate culture will eventually sway in that direction, even when those that oppose the leader find they have to deal with the new way of doing things or decide to leave for other pastures. We all know what flows downhill when theirs a problem, but if a good leader really is a good leader, then the good also flows downhill. This positive aspect will help

6 – People
People. People are the most important component of resiliency. Without resilient minded people, no organization will ever truly be resilient. Its people that bounce back from adversity and as the old English adage states, ‘Carry On.’ From the org’s leadership right down to the newest person walking through the door. They all must work together to support each other; from the top down to the bottom up. Everyone has something offer in an organization and everyone has a role to play when a disaster occurs.

When all these aspects are combined, then and only then, will an organization have the chance to become resilient. Then, an organization must encounter a situation that tests all these components and that’s when an organization can determine if it’s resilient or not. Once an organization has bounced back and can stand in front of its clients, customers, partners and the general public stating that it has weathered the storm with its reputation intact, that’s when it becomes resilient; not when it buys a product or service off a shelf.

© StoneRoad 2014 (A.Alex Fullick)

BCM / DR Program Templates Available from StoneRoad

Check out our revamped shop at http://www.stone-road.com. We’ve added lots of new document templates to help get your new BCM / DR program off the ground – with more on the way. Each comes with built-in instructions so you don’t need to try and figure it all out on your own. You can even manipulate the templates if you want to so they address your specific need. Our goal is to show you ‘how’ to do things not just tell you ‘what’ you need to do.

Here’s a sample list of what we’ve got so far:
1 – Test-Exercise Project Change Request Template – $9.99
2 – Test-Exercise Scope Statement (Charter) – $29.99
3 – Test-Exercise Executive Summary – $29.99
4 – Operating Unit Business Continuity Plan (BCP) – $79.99
5 – Business Impact Analysis (BIA) (This one along can cost thousands for a software application.) – $79.99

Coming soon:
1 – Employee Logistics Plan – $tbd
2 – BCM/DR Program Policy Template – $tbd
3 – BCM / DR Program Overview (As a bonus, this will include the Policy template) – $tbd

If there’s something specific you’re looking for, send us an email. We’ve got lots in our arsenal and alwasy building new templates so we may just have what you need and just haven’t gotten around to getting it up on the site. We can always build something for you. You can reach us at inquiries@stone-road.com.

StoneRoad: Reducing Corporate Suffering Through Continuity Planning.

Regards,
The StoneRoad Team
StoneRoad 2013 (C)