Your Guide To Business Continuity & Resilience

Pandemic planning or preparedness is an important part of business continuity planning. As COVID-19 has shown, pandemic preparedness presents unique challenges for businesses, given its far-reaching geographic impact and difficulty with predicting its scale and duration. It can also have a wide range of impacts on businesses (e.g., worker displacement, technology constraints, decreased production, and challenges with third-party capabilities). Below we list a few of the critical roles BCM can play in pandemic planning and response:

• During a pandemic response, BCM should ensure the crisis management function remains engaged, particularly as it relates to following a defined protocol and crisis communications. Following a defined protocol that also can be flexible to the fluidity of any disruptive situation is key to a successful response. Since a pandemic can cause the workforce to be dispersed, which can lead to feelings of isolation and disconnectedness among employees, teams and even third parties, crisis communications can and should include strategies for both internal and external audiences.
• The business continuity programme provides critical information that can be utilised as key inputs to the pandemic response plan. Similar to other plans (e.g., business resumption and IT disaster recovery plans), the contents of a pandemic response plan should be informed by foundational activities such as the business impact analysis (BIA) and continuity risk assessment. Outputs of these efforts should include elements such as the criticality of business processes, expected impact to the business caused by a disruption and maximum tolerable downtime. This information can be used to shape or inform a company's response.
• Another important data element that can be useful to pandemic response is identification of critical third parties essential for each business process to function. These critical third parties can be identified during the BIA, along with the resulting impact if they are disrupted or unable to provide products and services. This information will serve as a guide to develop subsequent strategies and planning discussions.
• Business continuity planning often requires developing playbooks that contemplate a variety of events or disasters that can impact the business and then outline how organisations should respond during and/or after those events or disasters. These playbooks can take the form of checklists or detailed step-by-step procedures and plans, and are typically scenario agnostic (i.e., an all-hazards approach). The most effective way to manage the impact of a pandemic, or any other crisis or disaster, is to implement playbooks that have been developed as part of a mature business continuity programme.

The core building blocks of any good BCM programme are business resumption, crisis management and IT disaster recovery. Each plays an important role in a business continuity lifecycle, which extends beyond the duration of an event. It also addresses how organisations return to normalcy after the event. As an example, the crisis management team that forms during a crisis to make critical business decisions in a timely manner that will direct and guide the response is the same team that will guide activities to restore normal operations.

Simultaneously, the group of IT professionals who helped execute an IT disaster recovery programme that allows, for example, an entire workforce to go remote all at the same time, and all of the bandwidth and infrastructure implications that go along with making that a possibility, are also responsible for helping those same individuals return to normalcy.

BCM is the design, development, implementation and maintenance of strategies, teams, plans and actions that provide protection over, or alternative modes of operation for, those activities or business processes which, if they were to be interrupted, might bring about seriously damaging or potentially significant loss to an enterprise. As BCM has evolved, the threat landscape has grown considerably to include both internal and external events, as well as extreme-but-plausible incidents.

BCM consists of three core disciplines:

• Crisis management and communications – This discipline enables an effective and cohesive response to an event. Crisis management processes focus on stabilising the situation and supporting the business if alternate modes of operation are needed, using effective planning, leadership and communication protocols.
• Business resumption planning or business recovery planning – This discipline focuses on disrupted aspects of business functions and processes that relate to or support the delivery of core products or services to a customer. Business resumption processes focus on the evaluation of people, processes, technology and other resources vital to the organisation's operations. The objective of business resumption planning is to mitigate potential impacts from disruptions, regardless of the cause, by developing plans that guide personnel through operations with diminished capabilities and toward business as usual.
• IT disaster recovery (ITDR) – This discipline addresses restoration of critical IT assets, including systems, applications, databases, and storage and network assets. An ITDR strategy also should encompass all technology service provider relationships (e.g., cloud providers) to ensure that all technical stakeholders remain aligned.

In addition to the traditional BCM disciplines listed above, many organisations manage other closely related programmes as part of their overall BCM programme. These programmes include:

• Incident management (or incident response) – This term commonly refers to identifying, analysing and managing the response to a disruptive event. Regardless of nomenclature, incident management programmes typically include emergency response measures such as evacuation of facilities, first-aid response and first-responder interactions.
• Cybersecurity incident response – This is specific to the planning for, response to and recovery from a cybersecurity incident such as a data breach, a phishing attempt or a distributed denial of service (DDoS) attack.

Finally, due to the nature of business continuity, it is common for several functions to be integrated at various phases of business continuity planning. For example, facilities or physical security teams may engage in emergency management activities, and safety and environmental health teams may have input in developing recovery strategies. Integration of these enterprise-impacting functions, depending on the organisation or industry, can be confusing.

One of the more confusing aspects of BCM is its terminology. The confusion is mostly due to differences in how regulators and industry groups use and define terms in the BCM lexicon. Below are a few examples grouped according to the core discipline to which they are most aligned.

Crisis Management and Communications

• Continuity of operations plan (COOP) – Federal government agencies and entities typically use this term to establish policies and guidance for essential functions related to a broad range of events and disasters.
• Emergency management and operations – This phrase is commonly used in the healthcare field, particularly in the clinical (i.e., patient-facing) side of contingency planning. It is sometimes used interchangeably with “crisis management” in other industries, but typically as a reference to the initial response aspects immediately following an event.
• Emergency response – This term refers to the immediate actions taken to preserve life and safeguard property and assets, often a subset of a broader crisis management programme. A building evacuation plan is an example of an emergency response action.
• Incident management and response – This is often used interchangeably with “crisis management.” It is also commonly used to refer to responses to any number of events impacting a particular entity or location, such as a hurricane on the Gulf Coast, an earthquake in California or a supply chain disruption for a logistics provider. Recently, firms have been developing incident response plans as part of their crisis management programmes to leverage the shared, high-level protocols associated with escalating and reporting an event. This strategy enables companies to quickly and efficiently put into action predefined plans designed for scenarios that may impact a function or facility.
• Major incident management (MIM) – This term refers to a response programme for serious interruptions of business activities. It is frequently used interchangeably with “crisis management.”
• Resilience – This is an evolving concept that refers to the ability of companies to withstand and quickly adapt to disruptions while attempting to maintain continuous operations. Resilience focuses on preserving business services and relies on regular maintenance to ensure that the entire business operation, or process or function, maintains its ability to remain flexible in all circumstances. Recently, this term has been used to describe a focus, such as technology resilience, business resilience and cyber resilience.

Business Resumption Planning

• Business recovery planning – The term refers to various steps taken for an individual process or business line as it relates to the planning of inputs/outputs, personnel resources, information technology and physical work locations in the aftermath of a disruption. This term is often used interchangeably with “business resumption,” “contingency planning” or “business continuity planning.”
• Business continuity planning (BCP) – This term is used to denote the planning aspects of business continuity management (BCM). BCM usually refers to the comprehensive programme, while BCP is the predefined set of steps taken to recover a business process in the event of a disruption. This term is often used interchangeably with “business resumption,” “contingency planning” or “business recovery planning.”
• Business resumption planning – This process focuses on recovery of business functions. The term is often used interchangeably with “business recovery,” “contingency planning” or “business continuity planning.”
• Contingency planning – This phrase refers to the set of tactical steps a team or function may take to resume a disrupted process. Often the term is used interchangeably with “business recovery,” “business resumption planning” or “business continuity planning.”

IT Disaster Recovery (ITDR)

• Disaster recovery – This is a term reserved for recovery and resumption of critical technology assets in the event of a disaster. Disaster recovery can include tasks such as resuming individual systems or recovering all critical aspects of the IT environment. Disaster recovery is a component of an overall BCM programme.

(Note: The above list is not comprehensive. The practises within a specific industry or regulatory landscape may influence how BCM terminology is used.)

Although vague, this frequently asked question is a valid one. Business continuity management (BCM) approaches and scopes vary widely; one size does not fit all. The primary driver of a BCM programme should always be the recovery requirements (and constraints) of the business. However, several recommended attributes or programme characteristics should be integrated with every BCM programme. The process of embedding each of these into the programme may vary:

• BCM programme governance – This involves identification and formalisation of the BCM steering committee and executive-level risk management oversight to determine BCM programme requirements.
• BCM programme and implementation design —This includes definition of policies, standards and tools to support business continuity efforts. In addition, an effective BCM programme should define the operating model, which includes who is accountable and responsible for each key discipline of the programme (e.g., crisis management, business resumption and IT disaster recovery), technology tools used to monitor and manage the programme tasks, and any defined key risk indicators (KRIs) and key performance indicators (KPIs).
• Business impact analysis (BIA) — The BIA, a type of risk assessment that serves as the foundation of a BCM programme, enables organisations to capture and effectively measure the potential business impacts of a disruption (i.e., operational, reputation, financial, regulatory or compliance impacts). The objective of the BIA is to establish recovery priorities for business processes and the resources (i.e., technology, workspace, equipment, personnel and third parties) on which each of those processes rely.
• Risk assessment — In BCM parlance, this may be referred to as the continuity risk assessment (CRA), which includes identification and prioritisation of threats and failure scenarios to which the organisation may be vulnerable. The CRA is not an enterprise risk assessment (ERA). Rather, the scope of the CRA encompasses those scenarios that pose a direct risk to operations (e.g., a supply chain disruption, a technology outage, a data breach, or severe weather in a densely populated area where operations reside).
• Strategy design and implementation – Identification and implementation of continuity strategies that best meet the organisation’s needs, based on a cost-benefit analysis and operational risk tolerance, is crucial. The results of the CRA and the BIA should inform the design of the recovery strategies.
• Plan documentation – Following the design of a viable recovery strategy for a particular risk, the response, recovery and restoration procedures should be documented to enable effective business continuity operations. Each discipline employed (i.e., crisis management, business resumption and IT disaster recovery) should have a documented strategy and plan.
• Testing – A BCM programme that is not tested regularly cannot be confidently relied on. Testing and continuously improving the validity of business continuity strategies and corresponding teams and plans are critical. Rigorous testing of each key discipline’s teams and plans, both separately and in tandem, should be conducted to ensure confidence in the BCM programme.
• Training and awareness – An organisation is better prepared operationally if its employees are knowledgeable about their respective roles and responsibilities regarding business continuity activities. Training should be provided to all employees, including those directly responsible for response/recovery team efforts as well as those not directly engaged on a recovery team.
• Compliance monitoring and audit – Conducting regular and objective reviews of the BCM programme allows for programme changes, if needed, while following a reasonable cadence. Also, the reviews will enable easy-to-maintain compliance with internal and third-party business continuity standards.

When planning for near-term events with business continuity implications, organisations are increasingly implementing creative processes to streamline the rigorous and detailed analysis effort required to complete a formal BIA and risk assessment, which can span many months. Organisations often do not have the time to complete an exhaustive analysis of all environmental, man-made, business process, supply chain and IT continuity risks.

One option to identify risks and prioritise recovery needs is to perform an abbreviated BIA and/or risk assessment through an executive work session. A facilitator leads a high-level cross-functional team to define impacts (at an organisational level, as opposed to a business-function or technology level), which in turn will be used to assist with establishing business-process and technology priority levels, recovery objectives and an order of recovery. This process is designed to reach preliminary conclusions in hours, as opposed to many weeks, using the input of business leaders throughout the organisation.

With regard to an alternative for the comprehensive continuity risk assessment, a business continuity steering committee and/or project team can define a realistic worst-case scenario to inform an abbreviated scoping and planning process. The scenario, which should impact the entire organisation, can provide a framework to assist planners with developing response and recovery strategies. The value in this approach is found in the streamlined manner of identifying the numerous impacts of a disruption without dissecting each type of triggering event. Many organisations have found that using a worst-case scenario can help them plan for less-impactful events.

While substituting a risk assessment and BIA process with an abbreviated approach will not result in a thorough understanding of all risks and impacts to the organisation, the examples noted above provide a way to jumpstart the planning process, particularly when the organisation faces a distinct deadline or management has not formally endorsed the BCM process. Going forward, the abbreviated processes should be refreshed with more-thorough analyses that consider information and perspectives from multiple levels within the organisation.

As organisations begin to develop their BCM programme capabilities and plans, they are confronted with a common question and dilemma: Who should own the overall programme? A successful BCM programme requires various levels of accountability and responsibility within an organisation. While some organisations may ultimately decide to create a separate business function or unit to own the programme, many choose to utilise existing resources and/or personnel.

Organisations typically provide leadership to the BCM programme through one of three roles: sponsors, owners and custodians. Sponsors provide and ensure organisational and financial support. Given that consistent visibility to the board and senior leadership is essential, sponsors should be executives. Owners have direct accountability or are responsible for ensuring support and overall programme execution. BCM owners are department leads with an understanding of strategy and direct working relationships with those implementing the annual plan and managing day-to-day tasks. Finally, custodians have the primary responsibility for coordinating BCM tasks executed throughout the organisation. Custodians understand the various roles needed for each aspect of a comprehensive programme and are empowered to escalate a concern in a timely and coherent manner.

It is not uncommon for these oversight roles to be aligned to the respective BCM discipline. For example, the CTO, CIO or CISO may own the IT disaster recovery programme and the head of marketing may own crisis management. It is common for organisations to have a BCM steering committee or other similar decision-making and governance group providing oversight.

There is no single recommended structure for a BCM programme. The nuances of a company’s industry, risk profile, culture and operations can influence the decision about where the BCM should reside. Some examples include:

• Finance – The CFO’s function or vertical.
• Executive council – A subset of the senior management team, which may include the general counsel and the directors of human resources or corporate communications.
• Operations – The COO’s function or vertical.
• Risk management – The CRO’s function or vertical; this is most common, as a designated and qualified business continuity practitioner would align most directly within an operational risk programme.
• Information technology – The CTO’s, CIO’s or CISO’s organisation or vertical.

As a matter of practise, it is recommended that BCM programme ownership be maintained at an executive level within the organisation so that it remains visible to decision makers and influences enterprise adoption while supporting all aspects of a mature programme.

When not a compliance need, BCM is often viewed as discretionary, since the value of time and resources spent planning, training, documenting, testing and validating all aspects of a programme cannot be realised until something truly goes wrong. In the absence of regulatory requirements, audit findings or specific customer demands, the most effective way to convince executive management to fully support BCM efforts is to conduct and share results from an exercise that highlights risk (e.g., the business continuity risk assessment and business impact analysis, or BIA). Results from the exercise, which typically include recovery priorities, corresponding recommendations and industry benchmarking data, should provide executive management a complete view of the organisation’s business continuity needs.

Communicating the value of business continuity efforts to executive management can also be accomplished through a cost-benefit analysis. The cost analysis addresses the funding and resources necessary to add resiliency and recoverability to key areas of the existing business and technology environment, while the benefit analysis relates to avoiding the potential impacts of a disruptive event (e.g., revenue loss, downtime, property damage, and reputation degradation).

Another data point that can be shared with executive management is business interruption premium savings from the organisation’s insurance provider as the result of implementing a tested BCM programme. Programme implementation can also help firms realise savings in the cost of procuring directors and officers (D&O) liability insurance. From a fiduciary perspective, if the directors and officers understand that they can be held personally liable for the organisation’s response to a business interruption, they are more likely to support and enforce BCM.

BCM regulatory requirements and standards are increasingly being enhanced in response to a growing focus on corporate governance and risk management and the devastating impacts of technology disruptions and catastrophic events. The enhancements are designed to help organisations develop more effective continuity responses to the evolving threat landscape, including providing enhanced protections for employees and all those who depend on an organisation’s services (e.g., customers, clients and patients).

Regulations and standards are used to support BCM programme development, measure adherence and assess maturity. While regulations and standards often provide guidance on required or suggested areas of focus and approaches to BCM, they rarely dictate specific items, formats or levels of detail in planning documentation. The most comprehensive guidelines and standards are geared toward financial services. Using these more rigorous guidelines, it is not uncommon for other industries to apply the relevant controls and strategies as they model all best practises.