After an amazing few days at the World Conference on Disaster Management (WCDM), Stephenson Resilience has teamed up with the leading Canadian consulting firm Plante & Associates to provide innovative and integrated resilience and business continuity consulting services.

This carefully designed partnership allows both firms to engage with a wider range of organisations across the world and enables their clients to benefit from an international, multilingual team able to provide a diverse suite of services from long term mandates in terms of business continuity services and added-value business impact analysis, to measuring and benchmarking organisations’ resilience and supply chain continuity assurance. The collaboration aims to advance the broad field of disaster management by integrating business continuity and resilience services to make organisations stronger and more flexible.

Over the coming months both firms will be releasing more information about how their collaboration can strengthen the industry and will provide insights into client work and the benefits demonstrated from working with an integrated team with a broad service offering.

Came across this video on Community Resilience today by Cultivate Ireland and thought some of you may find it of interest.

Lots of BCM managers are keen on the benefits that a resilience strategy provides but, it also seems like organisations are worried that their business continuity programme is not mature enough, so the assumption is that the organisation is not ready to think about being resilient.

Is there a good time?

Resilience does not have a beginning and an end, nor should it be thought of as an operational function of your business. Organisational resilience is a strategic mind-set and objective that you are aiming to achieve. It would be idealistic to have an effective business continuity programme before thinking about resilience, but is this task ever complete?

So to answer this question, no there is never a good time.  Business continuity is an endless cycle of improvement, perhaps the right time is down to your organisation and its current position. But if your organisation holds back it resilience strategy you might be in a position where something large impacts your business and you are forced to change. It is always better to be one step ahead rather than playing catch-up.

Get your management on board, develop a strategy for resilience as an organisation, because you might have more resilience than you realise.

The day has finally arrived, ISO 22301 has officially been published by the BSI.

Officially called ISO 22301 “Societal security - Business continuity management systems - Requirements” the new standard will officially replace BS 25999-2 which will be withdrawn on 1st November 2012. Don’t panic though as a transition period has been put in place. Further information can be found in an article on Continuity Forum.

The new ISO specifies the requirements for setting up and managing an effective Business Continuity Management System (BCMS) for any organisation, regardless of type or size.

ISO 22301 specifies the requirements to:

• Identify crucial risk factors already affecting your organisation
• Understand your organisation’s needs and obligations
• Establish implement and maintain your BCMS
• Measure your organisation’s overall capability to manage disruptive incidents
• Guarantee conformity with a stated business continuity policy

ISO 22301 is available to purchase and download from the BSI website for £50 (members) and £100 (non-members). You can download the standard from the following link: http://shop.bsigroup.com/en/ProductDetail/?pid=000000000030207716

Stephenson Resilience looks forward to providing information and services in relation to the new standard in the coming weeks.

Perhaps 1st order adaptation using existing plans and resources doesn’t qualify as resilience

This morning I read an excellent post by Ken Simpson about a BCI lecture by Dr Robert Kay of Incept Labs.

The BCI lecture focused on providing more depth and discussion around a recent research report and introducing the idea of organisational resilience to a new audience. The research paper ‘CEO Perspectives on Organisational Resilience’ is exactly that, the result of interviews with over 50 CEOs to explore what resilience means to them, how they think about it and where it falls in their range of priorities.

In Ken’s post about other points raised by Dr Kay, he notes:

While our disruption is within the realm of the risks we have anticipated and the plans we have developed, then the core discipline of execution applies, not the step off into the realms of resilience. Adapting is what you have to do if you don’t have a plan, if the plan doesn’t work, or if you never thought about the risk/disruption that has occurred. Adapting is not following a procedure or pre-detailed plan.

So to explain what this 1st order and 2nd order are all about…

In 2008 Woods and Wreathall use the analogy of how organisations and materials cope with stress and strain to think about organisational resilience as adaptive capacity. They identify two regions, the first – the uniform response region, when an organisation copes using its existing capacity and capabilities; this is 1st order adaptive capacity and I would argue this is also the space of Business Continuity Management (BCM).

The second region, the extra region, occurs when the organisation can no longer cope using its pre-determined plans or business as usual resources, and must innovate and develop new ways of working. This is 2nd order adaptive capacity and Woods and Wreathall argue that only this emergent adaptation can be labelled as resilience.

Reference

Woods, D. D. and Wreathall, J. (2008) Stress-Strain Plots as a Basis for Assessing System Resilience. in Hollnagel, E. et al. (Eds.) Remaining Sensitive to the Possibility of Failure, Vol. 1, pp. 143-158, Padstow: Ashgate

I’ve seen several LinkedIn posts and heard many discussions where people question the difference and relationship between Business Continuity Management (BCM) and Resilience.

BCM vs. Resilience, its sounds as though Harry Hill will at any minute shout FIGHT! In fact BCM and resilience are not in competition of at odds, they are inextricably linked.

Business continuity is to resilience what sugar is to cake – BCM is just one ingredient. It is important however to recognise that BCM is just one of the tools which organisations can use to achieve resilience.

BCM on its own is highly operational and is concerned with how you can continue to do business. Resilience is strategic and integrates many different disciplines to avoid disruption where possible and respond adaptively and competitively before the case for change becomes desperate.

Business continuity is a process (something you do) and so it is easy to standardise. Resilience is a cultural ability or organisational aim (something you are) and so is very difficult to standardise. All organisations achieve resilience in different ways, it’s up to each organisation to find their balance between resilience and efficiency and to continuously tweak and maintain it.

My thoughts then turn to all of the BCM departments which have recently re-badged themselves as Resilience Teams. If they have all adopted a strategic focus, integrating previously disparate disciplines and are now enabling their organisations to adapt to conditions as they emerge, oscillating between pre-planned responses and adaptive innovation – I’ll be very surprised.

Just something to think about as we move through 2012 and consider whether talking the resilience talk is enough!

If you are going to the Business Resilience in the Supply Chain conference this Wednesday, stop by the Stephenson Resilience exhibit at stand 6 and learn about how you can measure your organisation’s resilience.

The BRiSC 2011 conference will be held on 14th September and is not to be missed, for further information or to book a place, visit the BRiSC 2011 website.

Also come along to our stand to see the goodies we have to give away

To arrange a chat with Stephenson Resilience or for further information email info@stephensonresilience.co.uk or call 01582 227872.

Stephenson Resilience will be exhibiting at Business Resilience in the Supply Chain Conference (BRiSC) 2011 on the 14th September, held at the Madejski stadium, Reading.

Aimed as a high quality, low-cost event this conference is affordable and informative. Places are still available, so jump onto http://www.brisc2011.com/ to book your place.

This years speakers include a mix from both academic and practitioners and shall be chaired by Robin Gaddum, a fellow of the BCI. So expect some interesting, relavant topics at this years conference. For further information on this years speakers see http://www.brisc2011.com/speakers.asp

If you are coming along to the conference please come and visit us at us at stand number 6.

See you there..

Many organisations want to survive the next ‘big thing’ that could impact them, and I am sure your organisation would love to emerge even stronger and more competitive than before. Knowing how well equipped your organisation is in areas such as business continuity, risk management, IT disaster recovery and emergency planning (resilience disciplines) helps to identify how your organisation’s resilience is performing. This blog post will look at how you can use the Resilience Measurement Tool to identify areas for improvement in your organisation’s resilience programme.

Knowing your organisation has achieved an excellent score with the Resilience Measurement Tool is great, but consider how useful it would be to know what your weaknesses are. Resilience is built through continuous change and improvement, through internal and external reflection. It is about being pro-active and adapting to the changing environment, not sitting comfortably knowing you are resilient. Your organisation’s environment is constantly changing, now more than ever – financially, environmentally, technologically, politically and the list goes on … being ready to flex and adapt is a key capability of a resilient organisation.

resilient -adjective

• (of a substance or object) able to recoil or spring back into shape after bending, stretching, or being compressed.
• (of a person or animal) able to withstand or recover quickly from difficult conditions

Referring to the extract from the Oxford Dictionary above if you’re an organisation, are you a ‘substance or object’, or a ‘person or animal’. Well, you are probably neither or a combination of the both. If you are a person resilient to a disease, you probably have a good immune system, which is helped by strong cells working together in unison. If you are a man mad object, you have been designed to meet a certain specification or requirement and will demonstrate some resilience under the conditions of your design. Organisations are run and maintained by people where the goal and requirements can change over time. While we would all like to think that our organisation is akin to a fine tuned athlete, this is not always the case. We must continuously pursue the organisation’s health, otherwise we will no longer be as fit and dynamic as we once were.  People in organisations do not always work naturally in unison like the cells of a human body. We must encourage the communication and processes within our organisations and ensure that resilience is not just procedural but cultural too.

Going back to the question “Do you want to know your organisation’s resilience weaknesses?” – Yes you do, even more than your strengths! Just like I mentioned above, to be an “athlete” organisation, you need to constantly check and test yourself. We recommend checking the balance of resilience in your organisation every 12-18 months by measuring your resilience, and running training and exercises across your organisation and across your supply chain, so that you can check that your resilience strategy is still aligned with your organisation’s objectives.

Discovering your organisation’s weaknesses can easily be done with the Resilience Measurement Tool. We can compare different departments and business units to identify whether they score high or low with against certain resilience capabilities. We can identify how well these capabilities have been embedded across departments and the whole organisation.

The Resilience Measurement Tool uses responses from staff across the organisation taking part in a survey, used as the ’intelligence’ for creating a custom report specific to your organisations needs. To find out more about measuring resilience click here.

Please feel free to comment or ask questions below.

This post is in response to a White Paper I spotted, going around Twitter- “Best practices in Business Continuity” by Pitney Bowes

Having downloaded and read the White Paper it is an interesting read, following up as a review to a fire experienced at their facility in Texas. The White Paper explores how having a Business Continuity Plan and planning for such an incident that took place, they could divert services to another depot, communicate with customers immediately and begin the recovery process.

During the implementation of their BCP, Pitney Bowes found the following 10 practices to be most critical;

1. Ensure employee safety.
2. Contact local emergency assistance.
3. Secure IT data center.
4. Secure client information and assets.
5. Contact corporate executives.
6. Notify customers.
7. Contact recovery partners.
8. Move to a secure location.
9. Communicate. Communicate. Communicate.
10. Begin restoration of services.

As is important in any Business Continuity Plan Pitney Bowes had exercised for a similar scenario months before.

A copy of the whitepaper can be downloaded here