“Embedding BCM in the organisation’s culture” forms the outer edges of the BCI’s Business Continuity Management Lifecycle1. It encompasses all the steps required to implement a business continuity program. Rightly so. It’s probably the most difficult and arduous requirement of any business continuity program, but it is an essential element. An organisation’s ability to respond to, and its capacity to recover from, a business disruption is directly linked to the level of business continuity understanding and experience within the organisation.
In this article, I draw on my experiences working with companies, such as London Underground, to implement and maintain business continuity programs. I discuss why it is so important to take heed of the BCI’s advice, and suggest ways in which you can strengthen business continuity capability in your organisation.
Too often the driver for implementing a business continuity plan (BCP) is the need to meet the requirements of a regulatory body or the demands of clients and stakeholders. The plan is created. Check. There is an annual review. Check. A test of some kind. Check. Boxes are ticked. But when that disaster occurs, be it a temporary denial of access to a building or a much greater event where life is lost, and infrastructure is destroyed, will a plan that ticks all the boxes be enough? Will your organisation be able to respond appropriately?
The idea of embedding business continuity into an organisation’s culture is by no way unique to this discipline. Significant work has taken place in the field of incident response over the last decade, and can be evidenced by the speed in which many organisations that conduct high risk activities deal with emergencies.
Response to the London bombings
Having witnessed the London Underground response to the London bombings, I can attest that the effort spent creating robust procedures, educating the workforce, and developing specific in-house skills to respond to such an event, pays off.
On 7th July 2005 after a series of bombs had been detonated across London’s transport system, I watched as an entire organisation immediately respond to a horrendous incident, and then quickly focus its attention on the recovery of its core business – running a train service. As images of injured people appeared on the internet and television, all levels of the organisation were immediately assessing the impact to our customers, our staff, ourselves and our organisation. There are heroic stories of train operators saving lives and helping survivors. I witnessed an entire organisation feel great pain and then, despite the hurt, resolve to respond as best it could, and to recover its services as quickly as possible.
Why was the level of response so great? Certainly the intensity of the incident itself affected everyone at a very human level and so it was natural that people felt a strong desire to assist in every way possible. But I cannot ignore the influence of the organisation’s culture on the way it responded. Throughout London Underground there is a certain pride associated with the history of the organisation. This includes the delivery of the train service, as well as an innate understanding of the importance of that service to London as a whole. Of course there were many other factors that drove the organisation’s response – government direction, executive leadership, rehearsed plans, a robust command and control structure and trained responders. However, without that motivation and without the people to take direction, to follow plans and to respond quickly and deliberately, the outcomes for London Underground may well have been quite different.
A closer look at business continuity planning
So let’s return to BC planning. Do you have a valid BCP in place within your organisation? Do the people in your organisation understand what’s in the plan and how that plan will work in the event of a disruption? Do your staff know what you expect of them during this time? Are your staff capable of responding to the potentially chaotic and stressful environment of a disaster, where the availability of information is sporadic, and the outcome unknown?
The more your staff (at all levels of the organisation) know and understand your BC arrangements, the more efficient their response, and thus your recovery, will be. If individuals are aware of what a disruption might feel like, and the discomfort it can create, they may be more able to adapt if a real disruption occurs. If your people know the basics, they will be able to respond creatively, yet appropriately, to the situation at hand. They will know who will be making decisions. They will understand why the decisions are being made. They will feel empowered to respond in the right way.
People and change
If we were to dissect and analyse a business disruption we could simply call it “change”. Of course it is, typically, change that we don’t want nor expect. When change is implemented across an organisation it is usually planned and communicated. When organisational leaders decide to effect change, considerable time is spent preparing people for what the change will look like and explaining why it is so important. Understanding levels of resistance and creating ways of enabling staff to cope and embrace that change drives the methods in which it is delivered. Understanding how your organisation will respond to unplanned change should drive the approach you take to implement a BC program throughout your organisation.
The reaction of staff to a disruption can be similar to the way they will respond to organisation change – especially when it is not wanted. People will move through all the emotions and reactions that we know occur (e.g. denial, frustration, anger and resistance). Eventually, depending on the nature of the event, there will be acceptance. New routines will be created and applied. People will adapt to new environs, or return to old ones. The quicker people get to this point of familiarity, the easier managing your recovery will be.
Business disruptions, no matter how big or small, will create stress in your organisation. We know that stress can significantly impede our comprehension levels, our decision making and our relationships. As uncertainty and fear of the unknown can contribute to anxiety levels, take the time to educate your staff about your BCP. Provide opportunities for people to understand their role during a disruption and you will potentially minimise the impact on their ability to continue to perform by negating that ‘unknown’ factor and reducing some of the stress that is inevitable.
Demonstrating the importance of the plan – leading the organisation through the BC process is an essential step. Organisational leaders need to set an example to the rest of the business. Your leaders exist at all levels, across business units and in each department. Build their capability and knowledge so they will be better placed to provide leadership throughout a disruption. According to a study of the response to Hurricane Katrina by the Centre for Creative Leadership2, crisis leadership does not just come from the top of the structure, or from within formal structures, it also emerges informally. Given the vast range of skills to be a crisis leader, it makes sense to harness and develop this capability in all parts of the organisation. As a leader you will set the direction for the organisation, and, as in your day to day business, you will need others to carry the mantle and implement those objectives.
Identify individuals who have the ability to take all the positive attributes of a leader and be able to effectively apply them under the intense pressure of a crisis. Provide them opportunities to hone these skills through training and experience-based learning. Empowered leaders who understand the plan and have enough knowledge and understanding to process ever changing information; to delegate; to listen; to motivate; to adapt and to encourage flexibility in others, will help smooth the transition that a disruption requires.
As BCM for London Underground, I was responsible for implementing BC across the corporate sector of the organisation. During my time there we had to respond to, and recover from, a wide variety of disruptions: gas leaks, fires, water ingress, supplier failure. From these experiences, I realised that if the organisation and its people didn’t understand their BCP and what it was trying to achieve then the recovery from business disruptions would be more painful and difficult than it needed to be.
Many organisations that I work with now will, I’m sure, agree with me. By engaging all levels of the organisation, by delivering regular communications, testing and training, and through the experience of rehearsals and real disruptions, they have witnessed a change to the way in which their organisation responds: with speed, with confidence and to great affect.
Just having a business continuity plan in place is not enough. People require education, support and information. They need to see leadership support for the BC program and they need to know as much as possible about the experience of a disruption. As people understand the logic behind BC and they can see its enormous benefit to the organisation they will demand more. More testing. More knowledge. More understanding. Thus ensuring a greater level of preparedness and thus a greater capacity to recover when the time comes.
Written by Jodie Wentworth
Senior Consultant, Business Continuity, RiskLogic
1. The Business Continuity Institute Good Practice Guidelines 2010, BCI
2. Stepping into the Void, Centre for Creative Leadership, 2008