BCM: One process to rule all scenarios
Choosing the right approach for BCM
Organizations are provided with a wide range of standards when it comes to Business Continuity Management (BCM) and Disaster Recovery (DR). However, often business disruptions that happen in reality are not the ones you have prepared for and business continuity policies, plans and scenarios themselves do not necessarily provide organizational resilience. A familiarized and shared business continuity process is key to achieving resilience.
By Jurgen Schot en Thijs Maters
- Two common approaches for business continuity
- The scenario-based approach
- The process-based approach
- One process to rule all scenarios
- More information?
In today’s unpredictable business climate, organizations need to develop, incorporate, and maintain the capability to adapt when disruptive changes in the business climate arise. This capability is referred to as ‘organizational resilience’. As part of this effort, organizations plan for the continuation of delivering critical processes and services under uncertain and difficult circumstances. For example loss of telecommunications, unavailability of personnel or physical locations. This is known as Business Continuity Management (BCM).
Two common approaches for business continuity
A key decision in BCM planning is whether an organization will apply a scenario or process based approach. The scenario-based approach leverages operational risk management practices to identify potential scenarios which could interrupt critical business processes. Subsequently, BCM planning activities such as conducting business impact analyses, the development of plans, and allocation of resources is organized around these predefined scenarios. In contrast, the process-based approach follows the theorem that can be abstracted from Murphy’s Law: “anything that can go wrong, will go wrong”. Therefore, this second approach stresses the central positioning of a structural set of process steps, applicable for every type of disruptive event. Exploring the pros and cons of both approaches will help an organization to make an appropriate decision with regards to its business continuity management.
The scenario-based approach
The scenario-based approach is a very tangible approach. It leverages easily recognizable scenarios as identified via the organization’s risk management process. Therefore, it could be significantly easier to engage top-management, as it contributes to mitigating risks that are discussed in the board room. Secondly, if a disruptive incident occurs which matches one of the pre-defined scenarios, organizations have precisely the right means in place in order to recover from that specific disruptive event and can therefore be real lifesavers for organizations. Furthermore, it provides a practical method to allocate resources, since scenarios offer organizations insight into the required means, people and budget for specific events. Third, the scenario approach offers practitioners a certain amount of grip and confidence, as they trained to resist against the organization’s most likely impact scenarios.
However, this approach also has its disadvantages. Although the scenario-based approach may be an easy handle to engage top management, it creates the illusion of being covered for every scenario that can occur which may subsequently lead to a false perception of risk. A second pitfall is the tunnel vision phenomenon. Preparing the organization around a structural set of impact scenarios may force practitioners to excessively focus on these predefined scenarios, potentially resulting in decreased capacity to improvise whenever a different scenario arises. A final drawback of this approach is its investment in terms of man-hours. Exhaustive lists of scenarios may be created for a diverse range of events. However, the majority of these events will never occur, resulting in useless spending of budget.
The process-based approach
A successful recovery in the process-based approach is not bound to the predefined scenarios; organizations are ready to respond to any type of disruption. This also triggers creativity within the recovery team, since there is a basic structure which can be tailored during the response and therefore leaves room for improvisation and an agile way of working. It allows for flexible stakeholder and environment management, enabling the team to maintain an open and holistic view on the situation. Stakeholder commitment is even further increased by maintaining an output-driven and client-centric orientation, showing the added value of continuity to the business processes of these stakeholders.
A drawback of this approach is that a process is less tangible then a specific scenario to prepare for. Therefore, it might be more challenging to engage top management. It is also less practical to apply and requires more training of personnel to acquaint them with an unfamiliar process which does not occur frequently. As such, the investment required for this capability may not be realistic for organizations with relatively high turnover and new personnel to consistently train.
One process to rule all scenarios
Organizations must carefully consider their operating environment and requirements before choosing a definitive approach to BCM. Both methods provide different benefits, however in our view the process-based approach provides a more mature BCM capability. By training personnel on how to react and not necessarily what to react on, an organization allows flexibility and therefore opportunities for precise and effective responses to an incident. Subsequently, scenarios can be utilized to train personnel, however this should be a means to train the process itself, without focusing on the scenario content.
Regardless of choice, all plans and processes require periodic training of personnel. A plan will never be effective until personnel are trained.
Do you want to know more on crisis management? Please contact Danny Tinga via his contact details below.