Business Continuity Goes Beyond Crisis ManagementPosted 2013-05-17 Email Print
Re-Thinking HR: What Every CIO Needs to Know About Tomorrow's Workforce
Crisis management will get you through the initial impact of a disaster, but you need a comprehensive business continuity program to sustain you beyond 48 hours.
Strong Program Management
The success factors needed to establish and build a good business continuity plan include a strong program management function, which is central to the BCM planning effort; organizing and providing a structure for the effort; and helping to manage tasks, activities and dependencies across all functional areas.
The program management office helps capture and organize the information needed for the analysis phase of a BCM project. Supported by the BCM steering committee, the program office coordinates the development of the foundational components of the business continuity plan—those needed to continue the critical products and services of the organization during the recovery phase. The effort needed to develop the business continuity plan is structured using a phased approach that gathers the appropriate requirements. These steps include the following:
· Conduct a business impact analysis and a risk assessment, create impact scenarios and then examine the aggregate organizational view that emerges. Typically, these scenarios are scaled up to involve worst-case events, on the presumption that solutions developed for, say, a thousand-mile-wide Atlantic super-storm would more than suffice for a bad nor’easter.
· Craft solutions to address the impacts and risk. The solutions will form the business continuity plan: creation of a crisis management command and control structure; identification of secondary work sites; establishment of communications and IT architecture; and requirements.
· Create and practice the plans to train and educate and train the organization. Ideally, understanding how your critical third parties will respond to crisis events will enhance your plan’s viability. If you maintain visibility into their plans, you will be better able to understand whether their crisis has the potential to become your crisis.
Preparedness is the first step in response, but response is the critical test of preparedness. Once a company that provides critical services or products has gone through a crisis event, senior management should assess the impact of the event on the company’s operations and controls. It also should provide reassurance to customers, regulators, and other stakeholders that its systems-control environment is positioned to deal with future events.
It can take more than five years to create and mature a business continuity program that management can trust to significantly reduce the impact of major crisis events.
The journey begins by enlisting a full-time resource to coordinate the first efforts of assessing interruption risks and identifying critical business processes. Involving business continuity specialists at this juncture shortens the learning curve for creating effective business continuity plans, as specialists will provide proven industry and operational insight into what works. The result will be tested, easily assessable, streamlined and always relevant continuity plans maintained and owned by the appropriate critical-process owners.
To meet increased threats with symmetrically increased resources, organizations should begin objectively assessing their overall BCM program to determine whether it’s armed with the right tools to reduce the impact that crisis events have on revenue, reputation, regulatory compliance and expense management.
Ron Brown is managing director and global lead at PwC Consulting, specializing in governance risk compliance and business continuity management.