[i]Business continuity management (BCM) – holistic management system identifying potential threats and their impacts on the operation of activities within an organisation. It provides a framework for building resistance and ability to respond to an incident occurrence efficiently, where such a response protects the interests of the key owners and shareholders of the organisation, as well as the reputation of the organisation, its brand and activities creating values.
So much for the definition, which is very descriptive, however, not to those who have no experience with BCM. I have recently reflected on the best way to describe BCM. Being a former soldier, I thought of an analogy of a foreign mission.
What these two have in common is a controlled process with a certain goal. I will make a stop here for a while. The thing is, the sentence above is of crucial importance determining whether your BCM efforts will be successful or not. Military service is all about organisation. In the army, management process is brought to perfection. Roles, obligations and liabilities are defined there and every member of the team is familiarised with the mission goal.
A mission requires a mandate; BCM requires the support of the company management. Similarly to a person responsible for business continuity planning, every commander on a mission needs to:
know their own environment – fighting force, as well as the weaknesses, their teams and the team’s actual capabilities
know the enemy – when and how to attack and with which goal, to have the procedures clearly stipulated.
In fact, it is only a matter of time when some inconvenience occurs. The logical conclusion is that it is good to know how to get out as fast as you can and with as little loss as possible.
Business continuity is the ability to be ready and to respond to incidents and disruptions in activities (crisis situations) with the aim to continue with these activities on an acceptable level. Let me explain it to you using an example: The fact that the enemy attacked me does not mean I will stop supplying my advance guard. There are some places where not getting your water supply does not only mean a ruined day; it is actually a life-or-death situation. Similarly, the provision of continuous services is a matter of existence for many businesses. However, if I plan things properly, there is no need to worry, as I know that my client’s enquiry will be dealt with using a back-up server within the requested time limit, comparably to a situation where the guard gets support by the coalition forces.
A typical crisis situation arises upon the attack by an enemy, whether this involves a real enemy or a virtual one. When there is a crisis situation, it is crucial that every team member knows their role, obligations, procedures and reporting method. A soldier responsible for guarding the military base will not be present in an OR; a nurse will not run to guard the perimeter. Trust me, once the base is attacked, there is no time to ascertain where the keys from the ammunition warehouse are. Everyone has their own tasks and fulfils them according to predetermined procedures. All kinds of possible, or even impossible, threats are pre-identified and the activities to eliminate threats have been defined, trained and tested. What works here is the substitutability thanks to standardised processes and procedures described with perfection. Army drills can thus be perceived as a very efficient tool serving for the training and testing of BCM procedures.
We have survived the attack with small or big losses, what’s next? On a mission, there is a team ascertaining the scope of damage upon every attack. Then the restoration is initiated. All activities take place pursuant to so called SOPs (standard operating procedure), which means that everyone knows what to do and in which way. In the event of any doubts, there is a communication procedure stipulated.
Functionality is restored; it is time to look back. To assess whether the mission was successful, to check for any lessons learned and to admit honestly what went right and what should improve in the future. Everyone makes mistakes, but it is silly and quite expensive from the business point of view to repeat the same mistakes time and time again. Unfortunately, on a mission, the price of a repeated mistake is much higher...
As for BCM, you would hardly find anyone who knows the ropes better than the army. As opposed to commercial businesses, various armies all around the world have thousands of years of experience with crisis management, and their ability to manage critical situations can prove unequivocally that the “forewarned is forearmed”.
[i] ISO 22301 Business Continuity Management System