sharp

Issue #44

Last Update March 2, 2006

Technology Business Continuity and Crisis Management by John Sharp This article consists of extracts from a longer article submitted by Mr. Sharp. This condensation was done to make it more suitable for a general audience and to fit the space constraints of New York Stringer Magazine. The complete (original) article can be viewed by clicking on this link.

As an organization can never be fully in control of its business environment, it is safe to assume that all organizations will face a business continuity event at some point. Although this simple reality has been etched in high_profile names such as Bhopal, Piper_ Alpha, Perrier, Barings Bank, Challenger, Herald of Free Enterprise, Coca Cola, Exxon_Valdez, Railtrack, the Canary Wharf bombing, Enron, Anderson, Marconi, Landrover and the World Trade Center, experience also teaches that it is the less dramatic but more frequent business continuity events that can be even more problematic to deal with. Unfortunately, it seems that many public and private organizations still think, 'it will not happen to us'.

In this context, it is worth remembering (and reminding all senior executives) that 'managerial ignorance' is no longer an acceptable legal or moral defense if a crisis is handled badly. All managers should consider the following key questions that are likely to be asked in a subsequent inquiry:

When did you know there was a problem?
What did you do about it?
If you didn't do anything, why not?
If you didn't know there was a problem, why not?
What would you have done if you had known such a problem could exist?

Around the world regulators and governments are putting great emphasis on the need for organizations to have effective Business Continuity Management in place. Insurance companies are setting the level of business interruption premiums according to the speed at which an organization is able to resume business. The latest pressures are coming from the credit rating agencies who need evidence of effective BCM at the time of setting ratings. It is therefore not in the interest of any organization to ignore Business Continuity Management.

Business Continuity Management (BCM) is defined by the Business Continuity Institute (BCI) as ‘an holistic management process that identifies potential impacts that threaten an organization and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities'. It is not just about IT disaster recovery. Too many organizations tend to focus all their efforts on IT because of its mission_critical nature, leaving them exposed on many other fronts.

The key objectives of an effective BCM strategy should be to:

ensure the safety of staff
maximize the defense of the organization's reputation and brand image
minimize the impact of business continuity events (including crises) on customers/clients
limit/prevent impact beyond the organization
demonstrate effective and efficient governance to the media, markets and stakeholders
protect the organization's assets
and meet insurance, legal and regulatory requirements.

The Business Continuity Management process must encompass the business functions of risk management, disaster recovery, facilities management, supply chain management, quality management, health and safety, knowledge management, emergency management, security, crisis communications and PR.

An organization consists of people, and people at the top who give a cultural lead. As a consequence, business continuity and crisis management are not solely a set of tools, techniques and mechanisms to be implemented in an organization. They should reflect a more general mood, attitude and type of action taken by managers and staff.

In adopting this methodology and regularly exercising, rehearsing and testing, the organization maintains an effective up_to_date and fit_for_purpose BCM and crisis management capability. When a crisis hits the organization everyone knows what to do and a smooth invocation of the plan takes place ensuring that the impact on mission critical activities is minimized and reputation and brand image are not tarnished but enhanced.

John Sharp is CEO of the Business Continuity Institute, a professional organization based in London. The Business Continuity Institute participates in the development of business continuity management best practices and standards, and the certification of business continuity management professionals.