Is there a good time?

Resilience does not have a beginning and an end, nor should it be thought of as an operational function of your business. Organisational resilience is a strategic mind-set and objective that you are aiming to achieve. It would be idealistic to have an effective business continuity programme before thinking about resilience, but is this task ever complete?

So to answer this question, no there is never a good time.  Business continuity is an endless cycle of improvement, perhaps the right time is down to your organisation and its current position. But if your organisation holds back it resilience strategy you might be in a position where something large impacts your business and you are forced to change. It is always better to be one step ahead rather than playing catch-up.

Get your management on board, develop a strategy for resilience as an organisation, because you might have more resilience than you realise.

Officially called ISO 22301 “Societal security - Business continuity management systems - Requirements” the new standard will officially replace BS 25999-2 which will be withdrawn on 1st November 2012. Don’t panic though as a transition period has been put in place. Further information can be found in an article on Continuity Forum.

The new ISO specifies the requirements for setting up and managing an effective Business Continuity Management System (BCMS) for any organisation, regardless of type or size.

ISO 22301 specifies the requirements to:

• Identify crucial risk factors already affecting your organisation
• Understand your organisation’s needs and obligations
• Establish implement and maintain your BCMS
• Measure your organisation’s overall capability to manage disruptive incidents
• Guarantee conformity with a stated business continuity policy

ISO 22301 is available to purchase and download from the BSI website for £50 (members) and £100 (non-members). You can download the standard from the following link: http://shop.bsigroup.com/en/ProductDetail/?pid=000000000030207716

Stephenson Resilience looks forward to providing information and services in relation to the new standard in the coming weeks.

This morning I read an excellent post by Ken Simpson about a BCI lecture by Dr Robert Kay of Incept Labs.

The BCI lecture focused on providing more depth and discussion around a recent research report and introducing the idea of organisational resilience to a new audience. The research paper ‘CEO Perspectives on Organisational Resilience’ is exactly that, the result of interviews with over 50 CEOs to explore what resilience means to them, how they think about it and where it falls in their range of priorities.

In Ken’s post about other points raised by Dr Kay, he notes:

While our disruption is within the realm of the risks we have anticipated and the plans we have developed, then the core discipline of execution applies, not the step off into the realms of resilience. Adapting is what you have to do if you don’t have a plan, if the plan doesn’t work, or if you never thought about the risk/disruption that has occurred. Adapting is not following a procedure or pre-detailed plan.

So to explain what this 1st order and 2nd order are all about…

In 2008 Woods and Wreathall use the analogy of how organisations and materials cope with stress and strain to think about organisational resilience as adaptive capacity. They identify two regions, the first – the uniform response region, when an organisation copes using its existing capacity and capabilities; this is 1st order adaptive capacity and I would argue this is also the space of Business Continuity Management (BCM).

The second region, the extra region, occurs when the organisation can no longer cope using its pre-determined plans or business as usual resources, and must innovate and develop new ways of working. This is 2nd order adaptive capacity and Woods and Wreathall argue that only this emergent adaptation can be labelled as resilience.

Reference

Woods, D. D. and Wreathall, J. (2008) Stress-Strain Plots as a Basis for Assessing System Resilience. in Hollnagel, E. et al. (Eds.) Remaining Sensitive to the Possibility of Failure, Vol. 1, pp. 143-158, Padstow: Ashgate

BCM vs. Resilience, its sounds as though Harry Hill will at any minute shout FIGHT! In fact BCM and resilience are not in competition of at odds, they are inextricably linked.

Business continuity is to resilience what sugar is to cake – BCM is just one ingredient. It is important however to recognise that BCM is just one of the tools which organisations can use to achieve resilience.

BCM on its own is highly operational and is concerned with how you can continue to do business. Resilience is strategic and integrates many different disciplines to avoid disruption where possible and respond adaptively and competitively before the case for change becomes desperate.

Business continuity is a process (something you do) and so it is easy to standardise. Resilience is a cultural ability or organisational aim (something you are) and so is very difficult to standardise. All organisations achieve resilience in different ways, it’s up to each organisation to find their balance between resilience and efficiency and to continuously tweak and maintain it.

My thoughts then turn to all of the BCM departments which have recently re-badged themselves as Resilience Teams. If they have all adopted a strategic focus, integrating previously disparate disciplines and are now enabling their organisations to adapt to conditions as they emerge, oscillating between pre-planned responses and adaptive innovation – I’ll be very surprised.

Just something to think about as we move through 2012 and consider whether talking the resilience talk is enough!

How does your resilience measure up?

If you are going to the Business Resilience in the Supply Chain conference this Wednesday, stop by the Stephenson Resilience exhibit at stand 6 and learn about how you can measure your organisation’s resilience.

The BRiSC 2011 conference will be held on 14th September and is not to be missed, for further information or to book a place, visit the BRiSC 2011 website.

Also come along to our stand to see the goodies we have to give away

To arrange a chat with Stephenson Resilience or for further information email info@stephensonresilience.co.uk or call 01582 227872.

Aimed as a high quality, low-cost event this conference is affordable and informative. Places are still available, so jump onto http://www.brisc2011.com/ to book your place.

This years speakers include a mix from both academic and practitioners and shall be chaired by Robin Gaddum, a fellow of the BCI. So expect some interesting, relavant topics at this years conference. For further information on this years speakers see http://www.brisc2011.com/speakers.asp

If you are coming along to the conference please come and visit us at us at stand number 6.

See you there..

Knowing your organisation has achieved an excellent score with the Resilience Measurement Tool is great, but consider how useful it would be to know what your weaknesses are. Resilience is built through continuous change and improvement, through internal and external reflection. It is about being pro-active and adapting to the changing environment, not sitting comfortably knowing you are resilient. Your organisation’s environment is constantly changing, now more than ever – financially, environmentally, technologically, politically and the list goes on … being ready to flex and adapt is a key capability of a resilient organisation.

resilient -adjective

• (of a substance or object) able to recoil or spring back into shape after bending, stretching, or being compressed.
• (of a person or animal) able to withstand or recover quickly from difficult conditions

Referring to the extract from the Oxford Dictionary above if you’re an organisation, are you a ‘substance or object’, or a ‘person or animal’. Well, you are probably neither or a combination of the both. If you are a person resilient to a disease, you probably have a good immune system, which is helped by strong cells working together in unison. If you are a man mad object, you have been designed to meet a certain specification or requirement and will demonstrate some resilience under the conditions of your design. Organisations are run and maintained by people where the goal and requirements can change over time. While we would all like to think that our organisation is akin to a fine tuned athlete, this is not always the case. We must continuously pursue the organisation’s health, otherwise we will no longer be as fit and dynamic as we once were.  People in organisations do not always work naturally in unison like the cells of a human body. We must encourage the communication and processes within our organisations and ensure that resilience is not just procedural but cultural too.

Going back to the question “Do you want to know your organisation’s resilience weaknesses?” – Yes you do, even more than your strengths! Just like I mentioned above, to be an “athlete” organisation, you need to constantly check and test yourself. We recommend checking the balance of resilience in your organisation every 12-18 months by measuring your resilience, and running training and exercises across your organisation and across your supply chain, so that you can check that your resilience strategy is still aligned with your organisation’s objectives.

Discovering your organisation’s weaknesses can easily be done with the Resilience Measurement Tool. We can compare different departments and business units to identify whether they score high or low with against certain resilience capabilities. We can identify how well these capabilities have been embedded across departments and the whole organisation.

The Resilience Measurement Tool uses responses from staff across the organisation taking part in a survey, used as the ’intelligence’ for creating a custom report specific to your organisations needs. To find out more about measuring resilience click here.

Please feel free to comment or ask questions below.

Having downloaded and read the White Paper it is an interesting read, following up as a review to a fire experienced at their facility in Texas. The White Paper explores how having a Business Continuity Plan and planning for such an incident that took place, they could divert services to another depot, communicate with customers immediately and begin the recovery process.

During the implementation of their BCP, Pitney Bowes found the following 10 practices to be most critical;

1. Ensure employee safety.
2. Contact local emergency assistance.
3. Secure IT data center.
4. Secure client information and assets.
5. Contact corporate executives.
6. Notify customers.
7. Contact recovery partners.
8. Move to a secure location.
9. Communicate. Communicate. Communicate.
10. Begin restoration of services.

As is important in any Business Continuity Plan Pitney Bowes had exercised for a similar scenario months before.

A copy of the whitepaper can be downloaded here

Yes yes, every paper I read starts with the same sentiment. Sometimes they add a bit of the story of the evlolution of resilience, but after what must now be about 8-10 years of organisational resilience research, haven’t we moved on from that yet?

It seems like we are going around in circles because despite all of the definitions and approaches to resilience that have been published, even based on empirical research, none has been widely accepted or adopted. Although many important papers have been published which discuss examples of resilience, we are still scrabbling to find the seminal paper which will set out and define the basic theory of organisational resilience, which all others will acknowledge.

But where does this leave practitioners?….it leaves them with a lot of questions and not many answers! A  friend of mine who recently started reading about resilience, was convinced he was missing something. He could find lots of papers discussing what resilience is, but could not find any that would tell him how to do it. While there are a few that could contribute, I told him that what he was looking for probably didn’t exist yet.

Every academic or practitioner researching resilience seems to start from the beginning. In research, we all understand the need to go back to first principles and examine the concept at its ‘roots’ by when then, after reviewing all of the available resilience literature, why does everyone seem to reject what is already there, and try to define resilience all over again….why isn’t what’s already available good enough, and what are we looking for?

The challenge

To answer this question, over the next few weeks I’ll be blogging to try and identify some criteria for a definition and theory of resilience. Armed with this criteria we should at least be able to recognise a good resilience theory and definition when it comes along, if not be able to create it ourselves. It’s important to recognise that the challenge is not to come up with a theory and definition of resilience, not at this stage, but to develop criteria that tells us what a theory and definition of resilience should include or look like.

The is a challenge for all of us, and if reading this you think you might like to volunteer to write a guest blog on how you think we could identify, recognise or define a theory and definition of organisational resilience then please email amy@stephensonresilience.co.uk