How to bring business continuity back to the basics
As business continuity practitioners, it would serve us well to take a cue from writer Antoine de Saint-Exupéry, who stated, “Perfection is achieved, not when there is nothing more to add, but when there is nothing left to take away.”
Many risk and resiliency initiatives are more robust and complicated than they need to be. Common signs of an over-engineered program may include: lengthy plans packed with procedures and protocol, a BIA that takes months to complete, lengthy internal audits fixated on industry standards, and just a handful of people who actually know what to do in an incident.
Blessed with “the curse of knowledge,” we as practitioners can easily lose sight of how business continuity is perceived by our stakeholders. We fall prey to assuming that others understand the value of participating in program activities, much less have the expertise to decipher industry jargon (how many times in your career have you had to explain “RTO” and “MTPD”?).
Even Wikipedia’s description of “business continuity planning” is prefaced with the warning: “This article may contain an excessive amount of intricate detail that may only interest a specific audience.”
Put yourself in the shoes of a stakeholder who rarely thinks of contingency planning or has yet to experience an incident, and it’s even more critical that you keep your program simple.
What would happen if we were to boil down business continuity to just the basics? What if we began describing concepts in layman’s terms, and it helped to ease understanding and facilitate program adoption?
When an incident occurs in an office environment, most people need five things to continue business: a place to work, access to technology, tools to communicate, notify, and escalate events; leadership, and a basic plan. This plan can be built by answering these simple questions:
- Who’s in charge?
- What is the leader’s intent (purpose and desired results)?
- What do you do?
- What do you need to do it?
- How soon do you need to do it?
- What do you do if an event occurs?
To continue business in a manufacturing setting, people still need leadership; they also need access to the factory, critical equipment, tools to communicate, notify, and escalate events; and available raw materials with inbound-outbound capability. Similarly, a basic manufacturing plan can be built by answering these simple questions:
- Who’s in charge?
- What are the critical production objectives?
- What products must be produced to meet those objectives?
- What is the key equipment you need to produce those products?
- How soon do those products need to be produced before being out of stock?
- What do you do if you lose key equipment?
For more ideas on getting back to the basics, check out:
- Myth #1: The plan is the promised land, which explains why hyperfocusing on plans is the worst possible approach.
- Myth #2: You need a business impact analysis, which offers a more practical approach to the traditionally tedious BIA.
- The 8Rs of Resiliency, which breaks down various routes for responding to an event.
Need to consider the type of Environment
There are two types of environments. One type is called well-ordered domain. These are environments that are familiar to us; that is, we know how they work. We can think systematically through these situations as well as make accurate estimates and decisions. Procedures and detailed plans work well in this environment. Centralize decision-making works well in situations where we do not have to take the context of the situation into account.
The other type of environment is called complex domain. This environment is not structured, stable, or predictable. We have difficulty thinking through these situations because we don’t know how they work. We have difficulty making accurate estimates and sound decisions. Frameworks. Intelligence, and stories work well in this environment.
Our business continuity program needs to accommodate both environments. For situations that we are well familiar with, we will have greater control and detailed procedures. It should be integrated into normal business. For situations we are not familiar with, we will rely on frameworks, intelligence, and tacit knowledge.
Lootok is an industry leader in crisis management and business continuity planning, plans, and strategy. Contact us to assess or enhance your crisis management and/or business continuity program(s).