Russell Williams, Principal Consultant in Daisy’s Business Continuity Management team, asks the industry some difficult questions…
As business continuity and resilience professionals we find ourselves in unprecedented times. Both the landscape of the organisations we work with, and the communities we live in have potentially changed forever.
I, like a number of my professional network, have been asking questions like, ‘Where do we go from here?’ and, ‘What do people need us to be now’? The answers to which are not always readily understood or forthcoming because we don’t yet know what our post-Covid world is going to look like. We still have some way to go before we level off at the fabled ‘new normal’.
Wherever we find ourselves, and whatever challenges are presented to us, I believe there are some fundamentals that we should not forget or do away with, but neither should we be afraid to move with the times.
They are good practices for a reason
More than ever, the methods we use as a discipline are relevant. Now is the time to use our tried and tested techniques, whether that is the Business Continuity Institute’s ‘Good Practice Guidelines’, or the Disaster Recovery Institute International’s ‘Professional Practices’, to take stock of where we find ourselves now, and make sure we are best placed to meet the new challenges we face. These processes and techniques are good, or best practices for a very good reason.
There is, and always should be, a dialogue around moving with the times. The ongoing debate amongst our ranks about the usefulness of the business impact analysis (BIA) is a prime example of this, and both sides of the ‘argument’ get quite heated about it – to paraphrase Shakespeare “To BIA or Not to BIA, that is the question”. I would argue that your BIA is a great tool to understand your criticalities, dependencies, risks, and objectives – all of which are likely to have shifted. What better way is there to understand how your business has changed, and how your business continuity and resilience programmes may need to be adapted as a result? Unfortunately however, some of our ranks will overcomplicate BIA, placing an unnecessary burden on their stakeholders and themselves, to which I would say make it as simple as possible; capture what you need and nothing more in order to achieve the objectives you set out.
Let’s not forget that our industry bodies, the BCI and DRII have been around for 26 and 32 years respectively, and the processes, guidance, and standards that they have helped create and develop mean something. They have been built up by professionals from around the world using years of expertise and experience, and shaped and reshaped as a result an ever-changing landscape of threats and real life events, whether that be 9/11, SARS, The Asian Tsunami, The Fukushima Nuclear disaster or thousands of smaller-scale events that happen all over the world every day. You do not have to follow these guides or standards blindly or slavishly but adapt and apply them to your new circumstances. They will still work.
Tried and tested vs new solutions
We have all seen a massive surge to move to solutions that enable our workforce to work flexibly – predominantly from home. This has undoubtedly changed many people’s working lives forever, largely for the better. Over recent years we have also seen a widespread shift to cloud-based solutions. These shifts, whether they be over a longer period or, as was the case recently, sometimes overnight, present their own set of challenges and risks. As advisors and subject matter experts we should be working with our stakeholders to understand what this means to them, from both a day-to-day working situation, but also as solutions that are used for recovery. One worrying move is the trend to throw away solutions like workplace recovery, and I argue that this is a decision that we should take cautiously. Some organisations have now decided that they can do away with these solutions entirely, and with the consequent savings get themselves a pat on the back from their finance team. But when you take some time to look at the risks involved in replacing these solutions with a 100% working from home strategy, things don’t always add up. There are many roles that can’t or shouldn’t be undertaken from a largely uncontrolled environment like someone’s home. Security, compliance, health and safety, physical and mental well-being could all be issues when implementing work from home policies. In some cases, I believe a hybrid of the new and the traditional is the right approach, new tech like smart homeworking solutions to address the new challenges, and traditional solutions such as workplace recovery to provide a deeper resilience.
Another example where tech could help is software. As a business continuity or resilience professional, managing a programme where people are now more dispersed than ever is going to be a challenge, so having a tool to manage that effectively from the centre could prove extremely beneficial.
Whichever solutions you chose, make sure it meets your requirements and is not just a knee-jerk reaction. Don’t be afraid to move forward with new tech, but do not throw away tried and tested recovery solutions either – they still have a place, it might just be a different place.
Make hay while the sun shines
If we can’t make a case for business continuity and resilience now, we never will. During the last few months, many organisations found themselves wanting, so are going to want to do better. Others really saw the benefit of the time and effort they put into their planning because it gave them a platform from which to start, and while they will have undoubtedly had to adapt to the circumstances they found themselves in (in the face of ever-changing and conflicting advice), they had a head start. There has never been a greater understanding of the benefits of what we do, or the pitfalls arising from not doing it, so we should use that to ensure that we better prepare our businesses, our clients, and most importantly our communities and the public bodies that support them, for whatever comes next.
Where are we now?
Perhaps the question to ask ourselves at the moment is not, “Where do we go from here?” but instead, “Where are we now?” As we have seen, we are not yet aware of what the “new normal” will be, but we have some indications which are already helping to shape our approach to future planning, and we are learning more every day. And in the meantime, however unpleasant recent times have been, we should capitalise upon the focus COVID-19 has brought us and leverage the lessons we have all learned to further strengthen our position as a strategic function in the future and in a stronger position that when we started.