by Martin Caddick for BCI
Unpredictable is what you’d call Trump. Who knows what he will do next? Who knows what will happen next in the world? Business Continuity Management (BCM) may have a rather a staid image, but it could just be the most important tool we have to manage risk in these uncertain times.
Trump is a maverick, but he is also a symptom of the angst about change in society. The pace of change is astonishing, especially in the speed and complexity of communications. Businesses and communities sit within ever-more-complex networks, where we depend on lots of different players over whom we have little influence. The reliance on these networks has outpaced our ability to manage them. This increases risk. Less obvious is that it makes the probability and impact of risk more unpredictable.
Traditional approaches to risk and continuity are failing. There’s little point in having endless debates about how likely individual risks are when there are any number of unpredictable threats. We need measures in place that allow us to work around disruptions, whatever the cause, and to protect our reputation. This is what BCM does really well.
“Business continuity is the key discipline that sits at the heart of building and improving the resilience of organisations. It is a tried and tested methodology that an organisation should adopt as part of its overall approach to managing risks and threats. Business continuity is relevant and applicable to all industry sectors and organisations regardless of size, complexity, type and location.”
The image of BCM has suffered over the years because of perceived doom-mongering – for example over Year 2000, or pandemic flu. Leaders have made matters worse by a very reactive attitude to resilience. You need disasters on the scale of Grenfell to prompt the sort of measures that would have prevented or managed it more effectively. This is shutting the door after the horse has bolted and does very little to counter other threats that exist. BCM leaders are positioned low in organisations, often reporting in the areas where the last disaster occurred. Right now, many businesses put BCM under the security bracket because of the high level of cyber-threat – which won’t help if the next crisis is in the supply chain, for example.
Successful BCM rarely makes headline news, because it stops the situation becoming headline news. The goal of BCM is not to produce mountains of plans covering every eventuality. Instead, it is to make sure we have people able to respond to disruption and keep the challenge within manageable proportions.
Good BCM is not about recovery “battle bags” and detailed lists of assets. It is about understanding what matters most in the business and what we depend on. It is about having the right priorities. This helps enormously in today’s changing environments, when risks are hard to predict.
“I have always found that plans are useless, but planning is indispensable”
All the same, BCM is having to change. The term “resilience” is heard more often, because there is a realisation that no single protective discipline is enough. There needs to be a better, joined-up approach to protecting the business. BCM is having to learn how to work more effectively with other protective disciplines such as risk management and security, which is why the Business Continuity Institute is building bridges there.
Still, this is not enough. Resilience isn’t just about what we do – it’s also about what we are. Business continuity, security, and resilience depend on our behaviours and habits – in other words, our culture, and this comes from the top.
Resilience stems from leadership. Business leaders need to understand what makes their businesses more or less resilient. But many believe that an overemphasis on resilience prevents them from doing the very things that make a business successful – that is, taking smart risks – when it should do the opposite. At least one global manufacturer has been looking at measuring the resilience of its business units as a means of assessing how much business risk and what type of business risk each business unit can take. So resilience can help growth, as well as protect the business.