The day has finally arrived, ISO 22301 has officially been published by the BSI.

Officially called ISO 22301 “Societal security - Business continuity management systems - Requirements” the new standard will officially replace BS 25999-2 which will be withdrawn on 1st November 2012. Don’t panic though as a transition period has been put in place. Further information can be found in an article on Continuity Forum.

The new ISO specifies the requirements for setting up and managing an effective Business Continuity Management System (BCMS) for any organisation, regardless of type or size.

ISO 22301 specifies the requirements to:

• Identify crucial risk factors already affecting your organisation
• Understand your organisation’s needs and obligations
• Establish implement and maintain your BCMS
• Measure your organisation’s overall capability to manage disruptive incidents
• Guarantee conformity with a stated business continuity policy

ISO 22301 is available to purchase and download from the BSI website for £50 (members) and £100 (non-members). You can download the standard from the following link: http://shop.bsigroup.com/en/ProductDetail/?pid=000000000030207716

Stephenson Resilience looks forward to providing information and services in relation to the new standard in the coming weeks.

We come across so many questions about resilience ranging from what is resilience to how can resilience protect my bottom line… So we thought it was about time we started an FAQ with frequently asked questions about business resilience and because we have both academic and practitioner experience, if we don’t know the answer, we’ll find it anyone else does! So feel free to have a read and pose any business resilience question you like by clicking on the comment bubble next to the title of the post.

We’ll Start with an Obvious One – What is Resilience?

It’s all about surviving and thriving! Business resilience is an organisation’s ability to identify, plan for and mitigate potential threats and respond adaptively to disruption, even creating opportunities and finding the silver lining from crises. IT disaster recovery alone is not enough!

Resilience is about more than ensuring continuity through disruption or recovering and bouncing back from disaster; resilience is about protecting your bottom line and thriving and bouncing forward to create advantage over less adaptive competitors.

A resilient organization effectively aligns its strategy, operations, management systems, governance structure, and decision-support capabilities so that it can uncover and adjust to continually changing risks, endure disruptions to its primary earnings drivers, and create advantages over less adaptive competitors.

Starr, R. Newfrock, J. and Delurey, M. (2003) Enterprise Resilience: Managing Risk in the Networked Economy, Strategy and Business (30), 2-10

You can think of resilience as un umbrella term which is used to describe the way your business survives and thrives, even when things go wrong. Resilience results from a combination of planning, innovating and training before a crisis, and adapting and innovating and learning during and after a crisis.

Steve Clarke – What constitutes business resilience?

Ok so we have our first question via a group on LinkedIn! Steve Clarke has asked – what constitutes business resilience? Well we have included an answer to the question ‘what is business resilience’ in the original post, but I feel perhaps what constitutes business resilience is a slightly different question, so here’s your answer Steve….

Business resilience is an organisational outcome; it’s a goal which organisations can aim for. Disciplines such as business continuity management, risk management, crisis management, security, IT disaster recovery and high reliability leadership are all tools which organisations can use to help them achieve resilience.

The Resilient Organisations Research Programme (www.resorgs.org.nz) model of organisational resilience suggests that resilience is made up of 2 dimensions (planning and adaptive capacity) which in turn can be measured using 13 indicators. A research report about the development of the model is included on our Publications page.

Sayed Harir Shah – How do you consider the role of risk, policy, safety, HR, disaster recovery and business continuity in business resilience?

 Another question from Sayed Harir Shah on a LinkedIn group who asks,

“I am a disaster risk management consultant and practitioner and for me Resilience is a very wide concept. Regarding Business Resilience, it is interconnect and interdependent mechanism based on legal reform of risk reduction, adaption and implementation of policies and plans, physical, social and economic safety of assets, availability of human and financial resources for developing and designing disaster recovery and business continuity planning. How you consider these aspects in your business resilience concept?”

Thanks for your question Sayed. We think of resilience in a similar way to yourself, business resilience is an organisational goal achieved through the art of integrating resilience disciplines such as business continuity and risk management (see our previous answer to Steve’s question. We consider these resilience disciplines as tools which, when balance in combination can build business resilience. The trick is knowing the strengths of each resilience discipline, being able to combine them successfully, and then continuously readdressing and realigning that balance as the organisation changes.

Sayed Harir Shah – How difficult it is to combine all of these multi-dimension and multi-sectoral functions together to make businesses resilient?

Combining all of the resilience disciplines together to actually build resilience is definitely one of the challenges that we face. It’s different for every business and even within organisations the approach needs to be continuously adjusted and tweaked in relation to changes in the business environment and its risk profile.

To do it we use all of the disciplines and their associated tools as a bit of a pick n’ mix, and then we choose the most appropriate tool for the job. In many ways BCM managers have been doing this for years, but we need to take it further. In practice it’s about integrating your approach right from the start with integrated holistic policies, governance, oversight, evaluation and measurement. After all if the purpose of disciplines such as BCM and risk management is to help build resilience, then their effectiveness can only be judged by the extent to which they achieve that.

We use tools from each discipline to improve organisations’ planning and make them more responsive, adaptive, agile and competitive during ‘business as usual’. Through training and awareness we then transfer the knowledge locked up in documents and management boards into actual capabilities.

Exciting news! After 3 years researching this very topic I gave a presentation on it at the World BCM Conference in London last year and was invited to write an article in Continuity Magazine.

The article which discusses what resilience is and presents a model that measures resilience is available in the current issue of Continuity Magazine and can be downloaded for FREE from the Business Continuity Institute’s website at – http://www.thebci.org/continuity.htm

Any questions or feedback on the article or the tool are welcome!

A robust business continuity management programme and planning provides a framework for your organisation’s resilience. A resilience framework can enable your organisation to link your business continuity planning with your business as usual objectives and better respond if something does go wrong. Business continuity management is all about making sure that you can continue to operate if your business is disrupted e.g. one of your suppliers goes out of business, your premises are damaged by fire, or you loose important business data. Stephenson Resilience can help you to:

• Develop and formalise BCM policy that is appropriate for your organisation
• Assess BCM and resilience awareness and training across your organisation
• Conduct a business impact analysis (BIA) to identify and qualify the business impacts of a loss, interruption or disruption
• Identify areas of your disaster recovery planning which could be improved
• Develop business continuity strategies
• Develop, formalise and review your business continuity or emergency response plans
• Develop planning for specific business functions or units such as IT
• Provide staff training and development in the context of business continuity management roles
• Develop and run exercises to test and validate business continuity management plans and enable staff to practice their business continuity roles
• Review your business continuity management programme to identify any possible gaps or areas which need to be updated

We use the British Standards Institutes’s (BSI) Business Continuity Management (BCM) BS25999 standard and the Business Continuity Institutes’s (BCI) Good Practice Guidelines to help you develop a comprehensive and consistent approach to your BCM.

Fixed price review – Need your existing planning material and processes reviewing?

(We are closed for business forever. Image by PetroleumJelliffe . CC 2.0)

Why is supply chain resilience important?
All organisations rely on others to help them do business. However with supply chains becoming more and more complex, they are also becoming an increasing source of uncertainty and vulnerability. You may have contracted a company to look after your IT networks or your payroll, but how resilient are they? and what would you do if they failed? With more complex supply chains you don’t only have to worry about your own disasters, but everyone elses as well!

How can Stephenson Resilience help me to increase the resilience of my supply chain?
Stephenson Resilience can help you to understand and increase the resilience of your supply chain and to identify strong and weak links as well as strengths, risks and vulnerabilities. We help you to identify the critical nodes or suppliers and processes in your supply chain, the ones that would have a catastrophic impact on your business if they failed. We can then work with you and your suppliers to assess resilience, identify strengths and weaknesses, review contracts and insurance, run through scenarios and develop solutions to increase your supply chain resilience.

(chained to the overpass. Image by bagaball. CC 2.0)

What are risk assessments and vulnerability assessments all about?

Understanding your organisation’s strengths, weakness, threats and opportunities as well as its risks and vulnerabilities can be very valuable. Using our background in risk consultancy and our risk and vulnerability analysis tools Stephenson Resilience can help you to identify your business risks and understand the impact that they might have on your business. We’ll then work with you to develop and prioritise a plan of action to increase your preparedness, planning and response capabilities.

What risks might be important to my business?

As well as the risks that are common to organisations in your industry sector or organisations of a similar size or type to your own, you also face risks that are unique to your business. Trying to understand these risks and the impact that they might have can be confusing but we have tools that we can use to help you. Organisations often make excuses for not planning or managing risks such as we’re too large to fail or too small to be important, someone else will rescue us if something goes wrong, head office should be looking after that etc. and many businesses see planning as a luxury. But considering the potential cost of failing to plan effectively, risk assessment and planning is actually a cost of doing business and an investment in your business’s future.Â

Examples of risks for small businesses include:

• Key person dependency – what happens if the senior manager or owner becomes ill or is unable to work?
• Cash flow – while a high cash flow will not necessarily ensure the survival of your business it will certainly help to plug the gap until your insurance claims are paid out. How long could your business survive without income?
• Critical infrastructure failure – e.g. power cuts, telecommunications
• Competition from new firms or technology
• Reliance on a single large customer or partner – what would happen if they failed?

Examples of risks for larger businesses include:

• The failure of a unique supplier that you rely on to provide your product or service
• Brand or reputation damage resulting from a product fault or the misuse of your product or service by a third party
• Regulatory changes in your industry
• Critical infrastructure failure – e.g. power cuts, telecommunications, water restrictions
• Staff disputes
• Seasonal illnesses and pandemics affecting staff

(Dice. Image by MissTurner . CC 2.0)

Why is measuring resilience important?
Most organisations recognise the need to be resilient; however they often struggle to prioritise resilience or to allocate resources to improving it. This is because resilience is difficult to measure, and success in becoming more resilient is difficult to demonstrate. As a result organisations struggle to show the business case and return on investment for resilience programmes such as BCM, risk management, crisis management etc. Most organisations never know how resilient they are until something goes wrong! However if resilience could be measured it would help businesses to identify their strengths and weaknesses and to evaluate the effectiveness of their resilience strategies.

How can Stephenson Resilience help you to measure your business resilience?
Stephenson Resilience is currently working with researchers at the University in Canterbury in New Zealand to enable businesses to use a resilience measurement tool that was developed through their Resilient Organisations Research Programme. The resilience measurement tool is a web-based survey which measures organisational resilience. Results from the survey provide a snapshot of an organisation’s resilience and highlight their resilience strengths and weaknesses. Used over time the tool tracks increases and decreases in resilience. We are very excited about being able to make this tool available for organisations to use. Keep an eye on our blog for news about the development of the tool or contact us so that we can keep you up to date with progress!

(Measuring Up. Image by lowjumpingfrog . CC 2.0)

Continuity and resilience are relatively new fields in research with researchers in New Zealand, the US and the UK leading the way. With our experience of research in organisational resilience, continuity and emergency management through the Resilient Organisations Research Programme in New Zealand, Stephenson Resilience are well placed to help you with your business research needs. Organisations get involved in resilience research for a variety of different reasons including to:

• Get a better understanding of what resilience is and what it means for your business
• Find answers to questions about the level of resilience in your business
• Understand how your industry sector or organisation type addresses resilience and continuity
• Review strategies and best practice for building resilience
• Demonstrate thought leadership in your field
• Investigate the links between resilience and profitability
• Identify lessons for resilience from other organisations or industry sectors

If you would like to investigate resilience or have some specific questions that you would like to address, Stephenson Resilience can help you to identify whether this research has already been done (there’s no point re-inventing the wheel), what benefits it could provide for your organisation, and we can help you to plan, complete, review and share your findings.

Why are awareness and training important in the context of business continuity management, crisis response and resilience?
Awareness of training is particularly important in the context of business continuity management, crisis response and resilience for three key reasons:

• Board or senior management buy-in and support
• Disaster and crisis roles are diffierent to business as usual roles
• Raising awareness of resilience issues to integrate them into decision making
• Training converts business continuity management and crisis response documents into capabilities

Board or senior management buy-in and support is very important for the success of any BCM or emergency programme. However many of the ideas involved may be new to board members and are often difficult to evaluate. Stephenson Resilience can deliver awareness sessions to senior management teams to inform them about resilience and to demonstrate the links between resilience and better performance during business as usual with resilience during crisis. Disaster and crisis roles are different to business as usual roles. Many senior managers and board members have gained their positions through years of experience and hard work and are very ood at managing during business as usual. However they may not have experienced a crisis situation and it is not realistic to expect that they will naturally be able to cope with crisis just because they are good managers during business as usual. Stephenson Resilience can provide training and scenarios so that senior management teams can learn and practice these new roles before a crisis happens. Resilience issues are integrated into every part of the business and strategic decisions often have an impact on the organisations risk profile. It is therefore important that senior managers and decision makers are aware of resilience issues so that they can flag any potential conflicts or emerging threats. Stephenson Resilience can provide workshops to help senior managers and decision makes understand the potential impacts, on resilience, of business as usual decisions. You may have heard the saying that plans are worthless, while planning is priceless. Planning documents are useful in that they record information, decisions and knowledge which can be used by new members of the organisation as they join. However the majority of planning documents are rarely used during an actual crisis. Plans and arrangements must be embedded into the organisation’s culture if they are to effectively contribut to the organisation’s business continuity and resilience. But how can we do this? Stephenson Resilience can help you to embedd your plans and arrangements into your organisation’s culture through training workshops, exercises and simulations which convert planning documents into capabilities.

What is emergency response planning?
If the worst does happen and you experience a crisis, emergency or disaster, your ability to respond quickly, effectively and adaptively will determine how your business survives. All organisations face disruption and challenges of varying scales at some point. What makes disruption and challenge an emergency or crisis is when it cannot be dealt with using the organisation’s business as usual response methods. Emergencies and crises require organisations and their members to use new processes, ways of working and resources to address the problem quickly, efficiently, effectively and compassionately. During an emergency or crisis things often seem to spin out of control quickly, very little information may be available about what has happened, and people, property or reputation may be harmed. It is important to realise that the new processes, ways of working and resources must be planned, designed and embedded into the organisation through documentation, raising awareness and training – they will not suddenly appear by magic!

What kind of emergencies are we talking about?
When people think of emergencies and disasters they often think of large natural hazards such as earthquakes, mudslides and volcanoes. Thankfully, while we do have some natural hazards in the UK, they do not usually cause a large amount of damage or loss of life. However other parts of the world suffer from these severe events more regularly and with more severe consequences. Other examples, including man-made hazards could include flooding, food and fuel shortages, severe weather, terrorism, fires and coastal erosion.

How can Stephenson Resilience help us to respond effectively in an emergency?
There is actually an amazing amount that can be done in advance to help you respond effectively to an emergency affecting your business. Assessing the risks of your business environment, clarifying emergency roles and responsibilities, putting plans in place to deal with possible impacts and training and exercising staff in their emergency roles all increase your business’s repertoire of responses and your chance of responding effectively.