If there is one thing that businesses around the world have learned this year, it is this: nothing is certain. When we wished each other Happy New Year, most of us expected life to go on as usual. But as Dr. Spencer Johnson said in his best-selling book Who Moved My Cheese,
“Life is no straight and easy corridor along which we travel free and unhampered, but a maze of passages, through which we must seek our way, lost and confused, now and again checked in a blind alley”.
Ensure Continuity by Planning for Change
All businesses want to flourish regardless of the season, but this calls for forward planning and risk management to make one prepared for the unforeseen. And this brings us to two terms—business continuity and business resiliency—that are used interchangeably but are different in some ways.
Let’s take a look.
What is Business Continuity?
The ISO 22300:2018 standard defines business continuity as:
“The capability of an organization to continue the delivery of products or services at acceptable predefined levels following a disruption”.
A disruption could be anything from your superstar employee moving to your competitor, new legislation forcing you to make drastic changes to your products, or an unforeseen event in the local or global economy that destroys what you have taken years to build. Business continuity means anticipating such disruptions and preparing a plan to ensure that you can continue business operations if the disruptions materialize.
We can use the Plan Do Check Act (PDCA) cycle to describe the activities involved in business continuity management:
Plan
Planning for business continuity mainly involves:
- Understanding the environment in which your organization operates.
- Identifying potential risks which, if they materialize, can disrupt day-to-day operations. As you identify risks, you’ll classify, prioritize, and determine mitigation actions.
In addition, business impact analysis exercises are used to identify critical business processes, the underlying assets that support them, and the potential impact the organization faces should the assets or processes be disrupted. Here, key metrics such as RTO, RPO, and MAO are used to determine the acceptable disruption and required speed of continuity.
Do
This involves implementing the control measures that would ensure continuity in case disruption occurs in line with the business continuity plan. These would include:
- Appropriate IT systems
- People
- Suppliers
- Procedures
- Budget
- Defined target metrics
As people are expected to implement the business continuity plan, you must provide training for key players and create awareness for everyone involved to ensure alignment and preparation for the unexpected.
Check
The organization must continue to regularly check whether the control measures are working and remain relevant to meeting the organization’s needs, especially as the environment changes. Testing will identify whether the continuity metrics can be met using existing measures or more is required.
Act
Based on the results of the tests and actual disruptions, the leadership will need to take both corrective and preventive action to ensure the business continuity plan remains effective for the ever-evolving context that the business faces.
(Learn more about how the PDCA cycle can support continuous improvement.)
What is Business Resiliency?
The ISO 22316:2017 standard defines organizational resilience as:
“The ability of an organization to absorb and adapt in a changing environment to enable it to deliver its objectives and to survive and prosper.”
ITIL 4 defines resilience as the ability of an organization to anticipate, prepare for, respond to, and adapt to both incremental changes and sudden disruptions from an external perspective.
In simple terms, it means taking a blow and recovering from it. For a business, that means that when disruption occurs, you have mechanisms in place to absorb the hit without significant impairment to your business operations.
(Head to our learn page to learn more about Operational Resilience.)
In order to have a framework for effective organizational resilience, there are certain principles that need to be adhered to. Resilience requires:
- Behaviour that is aligned with a shared vision and purpose
- An up-to-date understanding of an organization’s context
- Ability to absorb, adapt, and effectively respond to change
- Good governance and management
- Diversity of skills, leadership, knowledge, and experience
- Coordination across management disciplines and contributions from technical and scientific areas of expertise
- Effective risk management
With these principles in place, you can deploy a coordinated approach that provides:
- A mandate to ensure the organization’s leadership is committed to enhance organizational resilience
- Adequate resources needed to enhance the organization’s resilience
- Appropriate governance structures to achieve the effective coordination of organizational resilience activities
- Mechanisms to ensure investments in resilience activities are appropriate to the organization’s internal and external context
- Systems that support the effective implementation of organizational resilience activities
- Arrangements to evaluate and enhance resilience in support of organizational requirements
- Effective communications to improve understanding and decision making
Business Continuity vs Business Resilience: next steps
According to PWC, business resilience builds on the principles of business continuity but extends much further to help enhance an organization’s immune system to be able to tackle challenges, fend off illness and bounce back more quickly.
How to increase Business Resiliency
As there is no single approach to enhance an organization’s resilience, it is more realistic to consider it the result of:
- The relationships and interactions of attributes and activities.
- Contributions from other management disciplines such as disaster recovery, crisis management, and business continuity, which by themselves are insufficient to lead to resilience.
Similar to business continuity, there is a lot of emphasis in organizational resilience on understanding the environment, identifying and assessing potential risks that could disrupt the business operations, and planning to deal with the disruption if it occurs. However, while business continuity is process centric, resilience is more strategic in nature, being a holistic approach that is influenced by a unique interaction and combination of strategic and operational factors.
Benefits of business continuity and resilience
Lasting business success requires that your organization has the resilience to survive, even thrive, through disruptions, maintain operations through tough times, and recover quickly. To ensure the continuity of your business through cyber attacks, natural disasters, geopolitical events, and supply chain or economic disruption takes planning and preparation. Here are some reasons why it is worth making those efforts.
- Minimized downtime: Effective business continuity planning ensures that everyone knows what needs to be done and who will do what. While nothing goes exactly as planned, you can recover faster with reduced downtime and the ability to maintain operational flow.
- Safeguarding reputation: As with people, companies that show they can perform under pressure earn the trust and admiration of others. You give employees, customers, and shareholders confidence when you respond swiftly and surely with minimal service interruption.
- Risk mitigation: Taking a proactive stance will help identify and mitigate potential risks before damage is done. When you prepare your business for the unexpected, you lessen the negative impacts of crises.
- Financial stability: Continuity planning reduces the financial fallout of a crisis. With resilient operations, you can maintain cash flow and strengthen stakeholder confidence.
- Regulatory compliance: Government regulations impose stiff penalties and fines on compliance failures, making a bad situation worse. Implementing business continuity measures with strong documentation reduces potential legal complications.
- Improved employee confidence: A well-structured continuity plan eases fears, removes indecision, and raises morale, instilling a sense of security from clarity and preparedness.
BMC team could, additionally, come up with a similar visual aid as shown below:
Additional resources
For more on business practices and culture, explore the BMC Business of IT Blog and these articles:
- What Is Threat Remediation? Threat Remediation Explained
- Impact, Urgency, and Priority: Understanding the Matrix
- The State of ITSM in 2020
These postings are my own and do not necessarily represent BMC's position, strategies, or opinion.
See an error or have a suggestion? Please let us know by emailing [email protected].
