Released by: Manager@Work, The Edge
Date: : 22 June 2009
The future is here with us today and history has a habit of foretelling our future if we choose to heed and take survival actions.
Why so? History has shown us the reality of crises: natural ones such earthquakes, tsunami, SARS, avian flu and the man made ones such as terrorism 9/11, Y2K, computer viruses, disruptive technologies, wars and more recently, the financial collapse of Freddie Max, Fanny Mae, Lehman Brothers, Bear Sterns amongst others. Now we have the influenza virus A(H1N1) pandemic which is affecting, disrupting
and threatening the closure of many businesses. On a daily basis we are bombarded and reminded that the economic situation is a bleak one and business confidence has deteriorated. In today's discontinuous and disruptive business environment, business contingency or continuity planning and management (BCPM) is essential for organisational survival, resilience and sustainability. Hence, much effort
has been emphasised to improve business continuity planning and contingency capability in recent years particularly mission critical businesses such as telecommunication, banking institutions, airlines and ubiquitous
globalbusinesses amongst many others. The focus is to foresight these probable occurrences and improves the extent to which management in organisations and enterprises work together in response to major incidents and crisis that challenge the organisation. BCPM can be considered as a strategic framework that encompass tactics to mitigate risks or incidents that might cause assets or financial
losses, customers service failure, business process failures and damage to brand or reputation.
What is Business Continuity Planning and Management (BCPM)?
According to Business Continuity Institute in UK, Business Continuity Management (BCM) is defined as a holistic management process that identifies potential impacts that threaten an organisation and provides a framework for building resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities.
Business Continuity Planning (BCP) on the other hand refers to the advance planning and preparations that are necessary to identify the impact of potential losses; to formulate and implement viable recovery strategies; to develop recovery plan(s) which ensure continuity of organisational services in the event of an event, incident or crisis; and to deliver a comprehensive training, testing and
maintenance programme. In plain language, BCPM is working out how to stay in business in the event of disaster, which may be a part of an organisational learning effort that helps reduce operational risk associated with lax
information management controls and urgency.
Source: http://www.business.qld.gov.au/dsdweb/v4/apps/web/content.cfm?id=11060
Business Continuity Planning and Management (BCPM) involves four stages which is Prevention (Risk Management Plan) which incorporates the prevention element that identifies and manages the likelihood and/or effects of risk associated with an incident; Preparedness (Business Impact Analysis) which incorporates the preparedness element that identifies and prioritises the key activities
of a business that may be adversely affected by any disruptions; Response (Incident Response Plan) which incorporates the response element and outlines immediate actions taken to respond to an incident in terms of containment, control and minimising impacts and lastly Recovery (Recovery Plan) which incorporates the recovery element that outlines actions taken to recover from an
incident in order to minimise disruption and recovery times.
Implementation of BCPM
According to the META Group research, 80 percent of Global 2000 organisations have some form of disaster recovery or business continuity plan in place, but only 60 percent of these plans are reasonably complete and actionable i.e. they adequately address sufficient coverage of resources and can be successfully executed by the owning organisations. A Gartner Research report titled `What is Crisis
Management' indicates something similar. Gartner says 85 percent of Global 2000 enterprises have established a disaster recovery plan for core technology and infrastructure, but only 15 percent have a full-fledged business continuity plan. In another report Gartner had projected that by 2005 more than 70 percent of large enterprises will have invested in business continuity planning.
In Malaysia, according to a study by PricewaterhouseCoopers, implementation of BCP varies by sector which includes airline and aerodrome operators, multinational oil and gas corporations, telecommunications and financial services but it is not widely implemented across all sectors of the industries. Perhaps it is now time to think forward to implement BCPM at a larger scale and it should begin
with senior management confronting and demanding honest answers to a vital question: Is the organisation prepared to withstand a major disruption? Each of the possible causes of disruption must be assessed, including the relative probability of each of these causes and the damage they could cause. To protect the organisation, management must allocate adequate funding to the creation, review,
testing, and upgrading of continuity plans.
Below are some management insights that you can consider to implement BCPM in your organisation:
Management Insight #1: Expect the Unexpected and Think the Unthinkable.
History has shown us that the unexpected and the unthinkable have happened. Hence, we should learn from theses phenomenon and continue to foresight future unexpected and unthinkable happenings which could occur in the future. This will provide you with the alertness and preparedness when these events should materialise.
Management Insight #2: Identify Mission Critical Functions, Organise Assets and Do Classification.
It is very important for the organisation to identify its mission critical functions and activities, organise and safeguard the value its assets both tangible and intangible. These critical functions need to have a sound contingency and recovery plan. In the event of a disaster, the available resources should be directed towards ensuring the operations get back up quickly and the safety of assets
that are most valuable are protected.
Management Insight #3: Perform Risk Analysis and Management.
All the potential risks along with their impact on the business need to be analysed. There must be a mitigation strategy that identifies the potential threats and puts appropriate controls in place to reduce the vulnerabilities. The organisation needs to define the "acceptable risk" it is prepared to take.
Management Insight #4: Prepare and Address Emergency Response Mechanism.
There must be a detailed operational plan and detailed procedures in place to respond in cases of emergencies or catastrophes. Responsibilities, resources and process must be defined in detail and communicated in your BCPM. Pre and post disaster activities must be clearly identified and addressed.
Management Insight #5: Perform Communication and Review with Everyone.
The business continuity plans have to be shared with all the stakeholders, including employees and partners, to be effective. There must also be periodic reviews and rehearsals to align the business continuity plans and management strategies with changing business needs and objectives.
The Way Forward
A new concept has entered the BCPM vocabulary, which is that of `resilience'. If we could somehow get the right formulae of leadership selection, risk assessment, criterion and action for response, training, communication strategies, decision making, data support systems and the list goes on; then all our business continuity problems might disappear over the horizon.
Organisational resilience and sustainability improvements will depend on how these people respond to these crises. With respect to action, I have often related this story in my management leadership teaching: "Once a-upon a time, there were three frogs sitting on a lily pad. One of the frogs getting a bit bored decided to jump. So how many frogs were left sitting on the lily pad? Some management
students would say, 2 frogs left sitting on the lily pad. The reality is that all 3 frogs were still sitting on the lily pad as the frog only decided to jump but did not really jump. Like Nike's saying, "Just Do It" is the order of the day rather than the lamentation that we had really decided to do it after the damage is done and the pieces are strewn all around. In today's era of business
discontinuity and disruptions, it is much better to practice pro-active rather than re-active management. Adopt and implement BCPM and may your business be resilient to last a 100-years and more. In summary, the volatile,
unpredicted and turbulent business environment as we have not seen before in the past provides great challenges and much opportunity for management leaders and business continuity practitioners. We should always `plan for the worst and manage for the best'.
Dr Wilson Tay, MMIM, MIM-CPT is CEO of the Malaysian Institute of Management, the national management organisation of Malaysia. MIM invites companies and professional managers to be members. Contact MIM Membership Support and Outreach at (603) 2164 5255; fax (603) 2165 4681; e-mail: enquiries@mim.org.my or visit www.mim.org.my.
