Many organisations have reached for business continuity plans in response to Covid and found them to be wanting. A hugely common mistake when developing a business continuity programme is to start with the Business Impact Analysis / Risk Assessment. The logic of immediately focussing in on understanding the most time critical business activities, working out what resources they need to support their delivery (IT, Buildings, suppliers etc) and what the risks are is strong but flawed.
As the old joke goes, the traveller asks, “How do I get to Tipperary?” and the local responds, “well if I were you, I wouldn’t start from here..!”
Picture yourself as a head of department with a busy day job on the receiving end of an email from the Chief Operating Officer (written by the BC Manager) with a large template to fill in, asking you for information that already exists in range of places – business plans, risk registers, staff and asset lists etc. Your immediate reaction may well be – can I ignore it or can I delegate this away to someone else. Neither are the reaction you are looking for, so how should you go about this?
Before sending out a BIA template it is vital to develop the business continuity programme “offering” and support. Some examples of what I’ve seen working really well are set out below. It is not meant to be a comprehensive list and each approach needs to be tailored to the way your organisation operates.
1. Understand the organisation’s objectives and gather incident anecdotes as to why these could be at risk – you need to be able to sell this up the chain and stories and anecdotes are powerful things.
2. Secure senior management commitment to the agenda (use your stories) and set up a steering group to help you get traction with all the areas that need to support and input. Think Covid – every part of the organisation may be involved in managing disruption, notably professional services such as HR, IT, Estates, Communications.
3. Do a gap analysis – what is already in place and working well? Where are the resilience gaps? Where are the points of friction and frustration if you already have an existing process?
4. Run a workshop to identify the top business priority areas that support your value chain and focus efforts here.
5. Build your training and awareness – your target managers completing the BIA need to understand the “Why” before they get a template.
6. Simplify your data requirements and make sure what you are asking for adds value. Understand what data sources already exist and link to these. For example, IT Services should have Service Levels already established for Key IT Systems (many set contractually as part of SAAS provision), so use the BIA process to validate that these meet business requirements. Estates will already have building and occupancy information but may not have a way of identifying what is business critical and what assets are vital for each business area. Use the BIA process to support this. Your insurers will be delighted to have better information on business interruption risk (see my previous blog on this).
7. Align your risk scenarios and risk scoring to the corporate approach so you can use data that aligns centrally
8. Develop and pilot your BIA template. Try different approaches here from facilitated workshops to self-completion with guidance and local support to see what gets you the best results. Be open to reviewing the data that are collected. Everything should help bring business intelligence and support setting priorities during incident response.
9. Often Business Continuity Managers work alone or have this as just part of their responsibilities. Bolster the support available within your business by creating a group of internal champions (think about Building, Operational and risk leads) and train them up on what good looks like using a populated BIA example.
Now you are ready to launch and set deadlines with support in place. It may seem like a lot of work, but it is the difference between a paper exercise that adds little value and a process that helps to develop business intelligence and supports a better risk and safety management culture.
If you need advice on how to build your support offering and make your BIA process one that adds value and helps build resilience, please do get in touch.
