Breaking the Business Continuity Mould Embrace the process, not the destination Business continuity and crisis management is moving from its traditional roots and by-the-book implementation, to a much more disruptive—and much more effective—process. Business continuity planning has become more complex, nonlinear and inclusive of multiple third parties, and the growing ecosystem of cloud and as-a-service providers has moved much of the risk outside of the immediate control of the risk manager. This is all complicated by the inherent difficulty in getting buy-in and participation in what is often a project nobody really wants to be a part of. It becomes even more complex when planners must prepare for a wider group of possibilities, which includes not only natural disasters, labor disputes and equipment failures, but cyber-disasters which are often not as well defined and even more unpredictable, and are based on environments and actors which have no physical boundaries. The problem of in-the-drawer business continuity The traditional approach of business continuity creates a document which attempts to anticipate an unknown event, which may take place at some uncertain time in the future, the impact of which is unknown, cannot be controlled, and is impossible to predict. This typically comes in the form of a playbook, which anticipates as much as possible, lays out strategies and scenarios, and is then placed in a drawer, to be brought out in case of emergency. The problem with that “wait for impact” approach is that, by the time the emergency occurs, processes have changed, key personnel have moved into different roles, and the people who created the document and understood its contents have left the company. It’s the planning, not the plan, that counts “It’s the journey, not the destination.” That’s not just New Age philosophy, it’s the heart of good business continuity planning, where the actual plan is less important than the process of creating it. Documents are quickly forgotten, but an ongoing process that engages team members, uses storytelling and activities, and brings together people from all layers of the business, will be remembered. We pay attention to that which we experience and visualize. Business continuity, developed with an activity based approach, focuses less on the creation of a static document and more on creating a learning experience. The result may still be the creation of a document, but along the way, stakeholders actually learn something, their memories are enhanced, and they truly participate. The plan is just a byproduct of planning, which allows us to simplify complexity, build common ground, and share expectations and concerns, and it’s the planning process which can actually create a valid culture of preparedness within the company. At the time of a disaster, individual line items in a document may be forgotten, but the planning—the group activities, games, and stories—will be remembered. In what is sometimes referred to as a “predictability trap,” committees get rewarded by predicting and controlling as much as possible and documenting everything, but in the complex, nonlinear environment that makes up a realistic risk profile, it is essential to take the context of the situation into account, and go beyond the document to leverage a decision making and problem solving framework, and leverage situational awareness. The Tom Sawyer approach to business continuity When the fictional character Tom Sawyer was tasked with whitewashing his Aunt Polly’s fence, it was a task for which few people would offer assistance. He made it attractive, transforms a mundane task into a social event, and even turns it into a competition of sorts by claiming some of the other boys wouldn’t be able to complete the job to Aunt Polly’s satisfaction. Today’s continuity and risk managers are a little like Tom Sawyer. He or she must not only make the task of continuity planning interesting, they must encourage people to participate, and make them want to do it on an ongoing basis. In so doing, the planning process rises beyond the plan itself, business continuity stays in the forefront of the workgroup’s mind, and when that inevitable disaster does strike, the continuity plan will be personally meaningful to everyone involved—and the recovery will be smooth and seamless. Rather than creating a committee of draftees which are less likely to be engaged, modern continuity planning places stakeholders on a continuum of demand, which ranges from unaware, to draftee, to enlisted, to loyalist, and finally, evangelist, with the goal being to nudge people up that chain, transforming the planning process from a “push” model of imposing tasks, to a “pull” model, where the entire process is desirable, and people may even compete to be on the committee. Effective business continuity planning and risk management is a disruptive process. Far more than merely creating a document, done right it transforms and better prepares the company for the future. Originally published on August 23, 2017 by disruptionhub.com.