The Manager's Guide to Simple, Strategic, Service-Oriented Business Continuity

Rachelle Loyear, Kristen Noakes-Fry

• Publisher: Rothstein Publishing
• Year: 2017
• eBook ISBN: 9781944480387
• Topic: Business
• Subtopic: Insurance
• Index: Business

You have the knowledge and skill to create a workable Business Continuity Management (BCM) program – but too often, your projects are stalled while you attempt to get the right information from the right person. Rachelle Loyear experienced these struggles for years before she successfully revamped and reinvented her company's BCM program. In The Manager's Guide to Simple, Strategic, Service-Oriented Business Continuity, she takes you through the practical steps to get your program back on track.

Rachelle Loyear understands your situation well. Her challenge was to manage BCM in a large enterprise that required hundreds of BC plans to be created and updated. The frustrating reality she faced was that subject matter experts in various departments held the critical information she needed, but few were willing to write their parts of the plan. She tried and failed using all the usual methods to educate and motivate – and even threaten – departments to meet her deadlines.

Finally, she decided there had to be a better way. The result was an incredibly successful BCM program that was adopted by BCM managers in other companies. She calls it "The Three S's of BCM Success," which can be summarized as: Simple – Strategic – Service-Oriented.

Loyear's approach is easy and intuitive, considering the BCM discipline from the point of view of the people in your organization who are tasked to work with you on building the plans and program. She found that most people prefer:

• Simple solutions when they are faced with something new and different.
• Strategic use of their time, making their efforts pay off.
• Service to be provided, lightening their part of the load while still meeting all the basic requirements.

These tactics explain why the 3S program works. It helps you, it helps your program, and it helps your program partners.

Loyear says, "If you follow the 'Three S' philosophy, the number of plans you need to document will be fewer, and the plans will be simpler and easier to produce. I've seen this method succeed repeatedly when the traditional method of handing a business leader a form to fill out or a piece of software to use has failed to produce quality plans in a timely manner."

In The Manager's Guide to Simple, Strategic, Sevice-Oriented Business Continuity, Loyear shows you how to:

• Completely change your approach to the problems of "BCM buy-in."
• Find new ways to engage and support your BCM program partners and subject matter experts.
• Develop easier-to-use policies, procedures, and plans.
• Improve your overall relationships with everyone involved in your BCM program.
• Craft a program that works around the roadblocks rather than running headlong into them.

Part I

Traditional Business Continuity Management:
What Does and Doesn’t Work

This part of the book will take a look at the world of business continuity and a few closely related topics such as crisis management, emergency response, and organizational resilience. I explore some of the standards and guidelines that drive the traditional approach to business continuity management (BCM) programs, and then consider some alternative ways to think about those standards to allow you to get your BCM program up and running quickly and simply without getting bogged down in all the details of traditional BCM.

Are details always bad? No. But in my opinion, there’s a time and a place for them. Thus, in this book, the time is later and the place will be where you find yourself wanting to dig a little deeper into a particular topic or needing a more granular plan for a very complicated function. Starting out, there’s no need to make things any more difficult than an undertaking as large as a BCM program can already be.

In Part I of the book, I cover:

• Chapter 1 - Traditional Business Continuity Management: An Overview
• Chapter 2 - Traditional BCM: The Roadblocks to Success

Chapter 1

Traditional Business Continuity Management:
An Overview

I begin Chapter 1 by diving into the basic topics of what business continuity management (BCM) really is, what standards and guidelines have been the base of most traditional BCM programs, and how those traditional base standards can be simplified and made more accessible to people who are new to participating in a BCM program - whether they are running the program or being asked to contribute to the planning process as subject matter experts from departments that need continuity plans.

A Note on Chapter 1 for the Beginner:

If you are approaching BCM for the first time, a few basics in this chapter will ensure that through the rest of the book we are all beginning from the same basic understanding and terminology. Whether you:

1. Have been tasked with implementing a BCM program in your organization.
2. Think your organization might need BCM and would like to know more about how to build a program.
3. Are a business subject matter expert who has been named as a contributor to a BCM planning program.

...this chapter will give you a grounding in the everyday concepts of BCM.

A Note on Chapter 1 for the Expert:

If you are already an expert with years of experience in BCM, this book will help you gain more support and traction for your program in your organization. While much in this first part of the book may be familiar from your previous experience, in Chapter 1 you will begin to see how BCM concepts you already know align with the 3S model defined in the Preface to this book.

1.1 Business Continuity Management Defined

Several major organizations have produced excellent standards for BCM programs. Although they all have different approaches and ideas of what constitutes the best practices of a BCM program (some that I find highly useful and some that I find less useful), they are similar at the base level.

ASIS International and the British Standards Institution (BSI) in the American National Standard (ANSI) BCM.01-2010, the Business Continuity Institute (BCI) in the Good Practice Guidelines, and the International Organization for Standardization (ISO) in the standard ISO 22301:2012 share the following definition of BCM:

Business continuity management is an holistic management process that identifies potential threats to an organization and the impacts to business operations that those threats, if realized, might cause, and which provides a framework for building organizational resilience with the capability of an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities. (ASIS International & BSI, 2010, p. 53; ISO, 2012b, p.2; BCI, 2013, p.6)

Similarly, DRI International defines BCM as:

...a management process that identifies risk, threats and vulnerabilities that could impact an entity’s continued operations and provides a framework for building organizational resilience and the capability for an effective response (DRI International, 2016b).

These basic definitions are useful and valid. However, their wording is stodgy and formal, and, honestly, does not communicate directly to define BCM to professionals outside of the BCM profession (such as business executives and attorneys).

My goal in developing this 3S BCM model was to boost participation in the BCM program by non-BCM professionals. Therefore, in the interest of simplicity (the first, and probably most important of the three S’s of BCM success), you will need to prepare your clear “elevator speech” to explain to anyone what you do in BCM. For example, here is the definition that I use when I tell people I am in business continuity and they ask me what that means:

Business Continuity Management (BCM) is a program that ensures the business can keep doing its critical work when any kind of business disruption hits it, and then can get back to running normal operations as quickly as possible after that disruption. It’s identifying the Who, What, When, Where, and How of keeping your business up and running no matter what is thrown at it.

When you are asked the real reasons that organizations have and need BCM programs, the above definition pretty much delivers the message in a simple way. You can be certain that all your BCM program partners can understand it, no matter their particular area of expertise. After all, all the subject matter experts whom you work with are just that - experts in their subjects. Trying to make them additionally experts in BCM is not fair to them, and it’s not a proposition that will likely engage them in your program. While there are some common terms they’ll probably already have familiarity with like risk, or resilience, I have found in my dealings with my BCM program partners that sticking to common cross-business terms simply makes life easier for all involved.

1.1.1 What’s in a Name? Talking the BCM Talk

The world of preparedness and continuity has gone through some considerable shifts and changes over the decades, and what people have called the area responsible for dealing with bad events that impact the organization has changed many times. In the beginning, there was contingency planning and information technology (IT) recovery. As time went on, terms like disaster planning, disaster preparedness, and emergency response came into vogue. Finally, as people began to see that a business might be impacted by more than just a natural disaster, terms like crisis management and business continuity began to come up. Today, as I discuss in Chapter 8, the industry is beginning to see an even more holistic view, shifting to the overall umbrella of organizational resilience.

In this book, I generally refer to business continuity management - BCM - because I am focusing primarily on:

• The continuity program.
• Continuity plan development.
• Plan testing.
• Plan team training.

You will also see references in this book to the terms resilience, crisis management, and emergency response. I discuss crisis management and emergency response from a planning perspective, because in my opinion, writing these plans is a good fit for a BCM team already tasked with writing continuity plans. I will not, however, attempt to train you on how to actively manage an ongoing crisis or emergency - those topics are covered in many other books by other authors. I also mention resilience sometimes, because continuity, crisis management, and preparedness are often thought of in the business world under that umbrella and as a single package, as you can see in Figure 1-1.

Figure 1-1. BCM-Related Terminology

In this book, I use these definitions:

• Emergency response refers to the immediate life-safety aspects of dealing with impact from a destructive or damaging event (such as fire, flood, tornado, or bombing).
• Crisis management refers to the holistic management of the effects of any type of business impacting crisis, including destructive or damaging events, but also other types of crisis like a reputational or public relations event that does not interrupt business activities.
• Business continuity refers to the plans and processes put in place to continue doing business during a business interruption.
• Resilience refers to any part of a program designed to protect an organization from negative risk impact.

Ultimately, in the world of BCM, all of these terms are often used interchangeably and with no specific barriers of scope between them, so it’s a good idea to understand that they sometimes mean something different, and sometimes mean the same thing - depending on whom you are talking to.

1.2 Business Continuity Management Standards and Organizations

Although this book will focus on the need for simplifying your BCM program and making it more accessible and user-friendly to your BCM program partners and the subject matter experts in your organization, it’s still important for the person tasked with implementing the program (quite possibly that person is you) to have a good grounding in the technicalities of the field. After all, if you don’t first understand the details of the discipline, it’s very hard to provide a simpler explanation to those who don’t need to have the level of grounding in the material that you need.

Rolling out a BCM program that will fit the needs of your organization and gain support and traction from the business itself begins with understanding all of the recommendations for a comprehensive BCM program, then paring back and tailoring that program to fit only what’s required for your particular organization to recover and return to business. Later chapters of this book will cover the simplification process, but for now, let’s look at some comprehensive practices and recommendations that you might pick from.

As you saw above, many dedicated organizations have published voluminous standards on the topic of business continuity planning, and the related areas of organizational resilience, disaster recovery, crisis management, crisis communications, and emergency management. These organizations offer excellent resources for BCM professionals, providing background, methodologies, explanations, and details to those of us who are immersed in the world of BCM.

Table 1-1 lists some of the most influential organizations that provide expert information, guidance, and practices in BCM. In addition, many local organizations are at work across the globe; however, the most recognized groups are included in the table.

Table 1-1. Standards and Guidelines Organizations for Resilience Topics

Organization

Standard or Guideline Descri...

Table of contents

• Cover
• Title page
• Copyright
• Preface
• Part I: Traditional Business Continuity Management:What Does and Doesn’t Work
• Part II: A New Solution: The Three S’s of BCM Success
• Part III: Putting It All Together For Results
• Appendix A: Example Procedure Documents
• Appendix B: Example Tiered Plan Template Requirements
• Appendix C: Example Plan Documents
• Appendix D: Example Crisis/Disruptive Event Checklists
• Appendix E: Business Impact Analysis and Risk Assessments
• Credits
• About the Author
• More from Rothstein Publishing