Lots of BCM managers are keen on the benefits that a resilience strategy provides but, it also seems like organisations are worried that their business continuity programme is not mature enough, so the assumption is that the organisation is not ready to think about being resilient.

Is there a good time?

Resilience does not have a beginning and an end, nor should it be thought of as an operational function of your business. Organisational resilience is a strategic mind-set and objective that you are aiming to achieve. It would be idealistic to have an effective business continuity programme before thinking about resilience, but is this task ever complete?

So to answer this question, no there is never a good time.  Business continuity is an endless cycle of improvement, perhaps the right time is down to your organisation and its current position. But if your organisation holds back it resilience strategy you might be in a position where something large impacts your business and you are forced to change. It is always better to be one step ahead rather than playing catch-up.

Get your management on board, develop a strategy for resilience as an organisation, because you might have more resilience than you realise.

The day has finally arrived, ISO 22301 has officially been published by the BSI.

Officially called ISO 22301 “Societal security - Business continuity management systems - Requirements” the new standard will officially replace BS 25999-2 which will be withdrawn on 1st November 2012. Don’t panic though as a transition period has been put in place. Further information can be found in an article on Continuity Forum.

The new ISO specifies the requirements for setting up and managing an effective Business Continuity Management System (BCMS) for any organisation, regardless of type or size.

ISO 22301 specifies the requirements to:

• Identify crucial risk factors already affecting your organisation
• Understand your organisation’s needs and obligations
• Establish implement and maintain your BCMS
• Measure your organisation’s overall capability to manage disruptive incidents
• Guarantee conformity with a stated business continuity policy

ISO 22301 is available to purchase and download from the BSI website for £50 (members) and £100 (non-members). You can download the standard from the following link: http://shop.bsigroup.com/en/ProductDetail/?pid=000000000030207716

Stephenson Resilience looks forward to providing information and services in relation to the new standard in the coming weeks.

Perhaps 1st order adaptation using existing plans and resources doesn’t qualify as resilience

This morning I read an excellent post by Ken Simpson about a BCI lecture by Dr Robert Kay of Incept Labs.

The BCI lecture focused on providing more depth and discussion around a recent research report and introducing the idea of organisational resilience to a new audience. The research paper ‘CEO Perspectives on Organisational Resilience’ is exactly that, the result of interviews with over 50 CEOs to explore what resilience means to them, how they think about it and where it falls in their range of priorities.

In Ken’s post about other points raised by Dr Kay, he notes:

While our disruption is within the realm of the risks we have anticipated and the plans we have developed, then the core discipline of execution applies, not the step off into the realms of resilience. Adapting is what you have to do if you don’t have a plan, if the plan doesn’t work, or if you never thought about the risk/disruption that has occurred. Adapting is not following a procedure or pre-detailed plan.

So to explain what this 1st order and 2nd order are all about…

In 2008 Woods and Wreathall use the analogy of how organisations and materials cope with stress and strain to think about organisational resilience as adaptive capacity. They identify two regions, the first – the uniform response region, when an organisation copes using its existing capacity and capabilities; this is 1st order adaptive capacity and I would argue this is also the space of Business Continuity Management (BCM).

The second region, the extra region, occurs when the organisation can no longer cope using its pre-determined plans or business as usual resources, and must innovate and develop new ways of working. This is 2nd order adaptive capacity and Woods and Wreathall argue that only this emergent adaptation can be labelled as resilience.

Reference

Woods, D. D. and Wreathall, J. (2008) Stress-Strain Plots as a Basis for Assessing System Resilience. in Hollnagel, E. et al. (Eds.) Remaining Sensitive to the Possibility of Failure, Vol. 1, pp. 143-158, Padstow: Ashgate

I’ve seen several LinkedIn posts and heard many discussions where people question the difference and relationship between Business Continuity Management (BCM) and Resilience.

BCM vs. Resilience, its sounds as though Harry Hill will at any minute shout FIGHT! In fact BCM and resilience are not in competition of at odds, they are inextricably linked.

Business continuity is to resilience what sugar is to cake – BCM is just one ingredient. It is important however to recognise that BCM is just one of the tools which organisations can use to achieve resilience.

BCM on its own is highly operational and is concerned with how you can continue to do business. Resilience is strategic and integrates many different disciplines to avoid disruption where possible and respond adaptively and competitively before the case for change becomes desperate.

Business continuity is a process (something you do) and so it is easy to standardise. Resilience is a cultural ability or organisational aim (something you are) and so is very difficult to standardise. All organisations achieve resilience in different ways, it’s up to each organisation to find their balance between resilience and efficiency and to continuously tweak and maintain it.

My thoughts then turn to all of the BCM departments which have recently re-badged themselves as Resilience Teams. If they have all adopted a strategic focus, integrating previously disparate disciplines and are now enabling their organisations to adapt to conditions as they emerge, oscillating between pre-planned responses and adaptive innovation – I’ll be very surprised.

Just something to think about as we move through 2012 and consider whether talking the resilience talk is enough!

Many organisations want to survive the next ‘big thing’ that could impact them, and I am sure your organisation would love to emerge even stronger and more competitive than before. Knowing how well equipped your organisation is in areas such as business continuity, risk management, IT disaster recovery and emergency planning (resilience disciplines) helps to identify how your organisation’s resilience is performing. This blog post will look at how you can use the Resilience Measurement Tool to identify areas for improvement in your organisation’s resilience programme.

Knowing your organisation has achieved an excellent score with the Resilience Measurement Tool is great, but consider how useful it would be to know what your weaknesses are. Resilience is built through continuous change and improvement, through internal and external reflection. It is about being pro-active and adapting to the changing environment, not sitting comfortably knowing you are resilient. Your organisation’s environment is constantly changing, now more than ever – financially, environmentally, technologically, politically and the list goes on … being ready to flex and adapt is a key capability of a resilient organisation.

resilient -adjective

• (of a substance or object) able to recoil or spring back into shape after bending, stretching, or being compressed.
• (of a person or animal) able to withstand or recover quickly from difficult conditions

Referring to the extract from the Oxford Dictionary above if you’re an organisation, are you a ‘substance or object’, or a ‘person or animal’. Well, you are probably neither or a combination of the both. If you are a person resilient to a disease, you probably have a good immune system, which is helped by strong cells working together in unison. If you are a man mad object, you have been designed to meet a certain specification or requirement and will demonstrate some resilience under the conditions of your design. Organisations are run and maintained by people where the goal and requirements can change over time. While we would all like to think that our organisation is akin to a fine tuned athlete, this is not always the case. We must continuously pursue the organisation’s health, otherwise we will no longer be as fit and dynamic as we once were.  People in organisations do not always work naturally in unison like the cells of a human body. We must encourage the communication and processes within our organisations and ensure that resilience is not just procedural but cultural too.

Going back to the question “Do you want to know your organisation’s resilience weaknesses?” – Yes you do, even more than your strengths! Just like I mentioned above, to be an “athlete” organisation, you need to constantly check and test yourself. We recommend checking the balance of resilience in your organisation every 12-18 months by measuring your resilience, and running training and exercises across your organisation and across your supply chain, so that you can check that your resilience strategy is still aligned with your organisation’s objectives.

Discovering your organisation’s weaknesses can easily be done with the Resilience Measurement Tool. We can compare different departments and business units to identify whether they score high or low with against certain resilience capabilities. We can identify how well these capabilities have been embedded across departments and the whole organisation.

The Resilience Measurement Tool uses responses from staff across the organisation taking part in a survey, used as the ’intelligence’ for creating a custom report specific to your organisations needs. To find out more about measuring resilience click here.

Please feel free to comment or ask questions below.

This post is in response to a White Paper I spotted, going around Twitter- “Best practices in Business Continuity” by Pitney Bowes

Having downloaded and read the White Paper it is an interesting read, following up as a review to a fire experienced at their facility in Texas. The White Paper explores how having a Business Continuity Plan and planning for such an incident that took place, they could divert services to another depot, communicate with customers immediately and begin the recovery process.

During the implementation of their BCP, Pitney Bowes found the following 10 practices to be most critical;

1. Ensure employee safety.
2. Contact local emergency assistance.
3. Secure IT data center.
4. Secure client information and assets.
5. Contact corporate executives.
6. Notify customers.
7. Contact recovery partners.
8. Move to a secure location.
9. Communicate. Communicate. Communicate.
10. Begin restoration of services.

As is important in any Business Continuity Plan Pitney Bowes had exercised for a similar scenario months before.

A copy of the whitepaper can be downloaded here

The day is finally here and the secret is out!….the Resilience Measurement Tool is available and you can take a sneaky peak at mini version of the tool by clicking here which will give you an idea of what the full version looks and feels like, and we’ll even send you some results!

So what is the Resilience Measurement Tool?

Ah good question…..it’s a web-based tool that enables us to measure and compare your organisation’s resilience. The idea behind the tool is very simple…

As business continuity, resilience, emergency and crisis managers we can often struggle to actually quantify how resilient our organisations are, and also to demonstrate progress or success towards becoming more resilient as a result of our efforts and investment. The Resilience Measurement Tool solves those problems for you.

The tool provides a quantitative measurement of your resilience and clearly identifies your organisation’s resilience strengths and weaknesses. We’re in the process of developing some case studies so that you can see how it works from start to finish (keep your eyes peeled for these in the near future), but you can also see an example of an organisation’s resilience results summary graph here.

In addition to measuring your organisation’s resilience, the tool can also compare it. So, say for example you decide you would like to compare resilience between your office or site in the UK, and another office or site in Switzerland – no problem, we can do that for you! You can also compare resilience between departments or business functions, parts of the organisation with different cultures (common in acquisitions and mergers) etc.

Once we have collected data on your organisation’s resilience we go away and analyse your data and present you with a full customised results report.

So how do you measure resilience then?

We asked ourselves the same thing back in 2007, and since then we have been working through the Resilient Organisations Research Programme at the University of Canterbury in New Zealand to find an answer! The Business Resilience Intelligence Tool is the result of over three years robust research, and we’re continuously working to tweak and improve it.

You can find a research report that summarises the development of the tool on our Publications page. For more information about resilience in general and to answer questions like What is resilience? click on this link.

How is this tool different?

There are a few tools around which measure business continuity or organisational preparedness to some degree, and many of them are very useful as audit tools for programme management. However the Resilience Measurement Tool provides actual data about how resilient your organisation is. Instead of focusing on whether senior managers and continuity professionals have the right intentions and documentation, it measures whether those cultural resilience values have actually been embedded across the organisation.

As many business continuity managers know, embedding plans and strategies into the organisations culture is a critical part of the business continuity lifecycle, but it is also the step which converts documents and plans into real resilience capabilities! The Resilience Measurement Tool enables you to measure, check and demonstrate that.

If you would like to discuss the tool in more detail, get to know us as a company, and find out how the tool might work at your organisation and what it could deliver, give us a ring on +44 1582 227872 or email amy@stephensonresilience.co.uk

Both academics and practitioners in the fields of resilience, continuity, emergency, crisis and disaster management write articles, posts and papers about topics important to their field. Some of the most interesting of these outputs share lessons from previous events, provide case studies, introduce new tools and technologies and share research findings and results.

But where does this important information get published and how can we find it?

I have increasingly seen requests for information from a variety of sources asking this very question…I’ve written, or would like to write, a paper about …. where could I publish it?

The social networks have also provided a simple and effective solution! I have started a list of the publications, websites and places in which we can all publish, search for and find information on resilience and related fields. It can be accessed through the following link, and if you know of any others, please feel free to add them!

http://tiny.cc/extmx

As with most professionals in the field of continuity and resilience I’m a member of a large number of industry groups on LinkedIn and other industry websites, and just like them I get regular feeds. Over the past few weeks I’ve been amazed by the sheer number of fantastic ideas, questions and conversations shooting around and so I thought I’d share some of the best with you!

A definitive list of exercise scenarios

One member of a group started a conversation about generating a definitive list of exercise scenarios to support exercise planners in identifying, defining and justifying scenarios for emergency exercises and simulations. When designing exercises, planners often face questions about why they chose a particular scenario or how they can guarantee that it’s realistic. Of course as a planner it’s always good to have resources which can support you and this group has actually created one – what an amazing use of a group.

The thread has now had over 80 responses and many professionals have contributed to the living document online that holds all of the information. It’s a closed group and so I can’t provide a link to the document here but the list includes natural and man-made events and provides examples of when, where and how the events may have actually occurred.

BCM key indicators

This post focuses on developing a list of KPI’s for business continuity management (BCM) programmes. I think what it really served to highlight is the incredible variety in focus of BCM professionals. Some suggestions were very operational and IT focused and other suggestions (although still the minority) were more strategic. Still very few if any of the suggestions directly addressed the human factors involved in BCM.

Supply chain impacts of the Japan earthquake and tsunami

Of course as continuity and resilience practitioners we have been looking to the earthquake and tsunami in Japan to see any evidence of disruption moving along supply chains as a result of the events. As one practitioner pointed out, it may be some time before the full impacts on supply chains are known, but as stocks run out these will become increasingly clear. The main impacts highlighted by group members so far seem to be around cars and parts within the automotive and engineering industry. There was also some speculation that further disruption may be experienced in telecommunications, computer hardware and general manufacturing.

Well I’ll keep an eye out for more interesting topics and keep you all updated!

Ooooooo…..I can feel the anticipation and as we’re putting the last few touches to a new service which we will launch over the next few weeks.

You’ll have to keep your eyes and ears peeled for details, but it should be a good opportunity for businesses to take adavantage of a great marriage between business resilience and business intelligence!