In the context of the pace of change in the modern business world (especially related to technological developments, cyber risks and instant communications), a reactive approach to business continuity management is no longer an option.
The range of unpredictable potential business interruptions is simply too large and too far-reaching not to take a proactive and preventative approach.
An IT-based disaster recovery approach, essentially reactive in nature, is no longer sufficient to mitigate the many business risks now facing most organisations. For this reason, practitioners increasingly have been turning to the concept of business resilience.
Broadly speaking, the concept of business resilience refers to the idea of building into the organisation, and specifically its personnel, the capacity and skills to act in times of stress with initiative and good judgement, potentially without access to the usual IT support and related tools, to achieve the best possible business outcome.
Business resilience can be broken down into three interacting elements within the organisation; strategic resilience, operational resilience and process resilience.
Strategic resilience deals with broader areas of both threat and opportunity to the business, such as fluctuations in market share, impacts from regulatory changes etc. Operational resilience refers to the ability to respond to every-day business threats, such as cyber risks, utility failures, loss of plant and equipment etc. Process resilience refers to the underlying systems upon which the organisation relies to function, such as IT and other technological systems, business processes and management systems.
With strengths and capacity in all three areas, an organisation is well placed to respond proactively to potential business interruptions.
Critical to the development of business resilience are two fundamental areas: accurate assessment of critical functions, and effective development and empowerment of the staff.
Without properly identifying, analysing and mitigating the vulnerabilities of critical business functions, these high risk functions may not be readily recognised in a time of crisis and therefore not appropriately prioritised. A thorough, and regularly reviewed Business Impact Analysis is required to achieve this information.
Without people who understand the way the business works and (in the context of a knowledge of the key principles of risk management and business continuity management) the business objectives and critical business functions, there will be no-one to undertake critical responses in a timely fashion when crisis strikes. Planned implementation of the business continuity program, good quality and broad-based training with refreshers, and regular testing exercises are the keys to empowering the staff. Regular testing and thorough debriefing will also help to ensure that the business continuity program (and the staff) continually improves.
Please contact QRMC for more information.
