Avoid becoming a security statistic by implementing the right controls
Empower your people, your strongest defence against cyber threats
Avoid becoming a security statistic by implementing the right controls
Empower your people, your strongest defence against cyber threats
Business Continuity Management (BCM) has long been recognized as one of the most practical ways for organizations to recover from catastrophic events.
BCM is well established as a management practice in developed countries. Standards like the erstwhile BS25999 and currently ISO22301 have found acceptance in large organizations.
However, organizations in the developing world have been reluctant to adopt BCM. Some of the key reasons that have led to lack of BCM adoption are as follows:
1. Lack of awareness: It is surprising that many professionals are unaware of BCM. Even if they have come across the concept, they are not really convinced about its utility.
2. Cost: The cost of creating a Business Continuity capability is quite prohibitive. Getting a BCM consultant on board to implement a BCM framework is not just expensive in terms of fees but also in terms of the amount of time the employees (especially senior management) have to give during the planning process.
3. Lack of expertise: The number of good BCM consultants is less. Getting a certified and experienced BCM professional is difficult.
Low BCM implementation rates indicate a crying need to simplify and reduce costs.
Low BCM implementation rates indicate a crying need to simplify and reduce costs.
If one analyzes the typical BCM Lifecycle, a significant amount of time and effort is spent during the Business Impact Analysis phase (BIA). Generally, a bottom up approach is followed wherein “Critical Processes” are identified by performing a BIA for all processes.
Consultants who estimate project costs find it extremely difficult to reduce cost of BCM implementation as this is the time it will take to cover BIA for all processes. Add to this the humongous amount of time required to be spent by senior employees of all processes and we have a significant time and effort requirement.
Cutting down on the BIA phase of the BCM promises to significantly reduce the cost of BCM implementation.
Cutting down on the BIA phase of the BCM promises to significantly reduce the cost of BCM implementation.
Lean BCM leverages inputs from senior management to significantly reduce time required for implementing a BCM framework. At every stage of the BCM lifecycle senior management inputs are sought and relied upon to make decisions.
The key phase in which these senior management inputs make the most impact is Business Impact Analysis. Senior Management typically has a clear idea of what processes are critical for the business. It is a good idea to get this information directly from them rather than go through the exhausting process of doing BIAs for the entire organization.
Once this information is obtained from senior management, BIAs can be done just for the identified 20-25% of the business processes resulting in a huge time and cost benefit, increasing the chances of a successful BCM implementation.
BIAs can be done just for the identified 20-25% of the business processes resulting in a huge time and cost benefit, increasing the chances of a successful BCM implementation.
BCM practitioners often argue that relying on these inputs for making the crucial decision of which processes are critical leaves a lot to judgment rather than objectivity of the BIA process. While this is true to an extent, the other option of conducting BIAs for 100% of business processes is a daunting process. Many organizations avoid BCM altogether due to this or the BCM implementation loses steam due to inevitable delays in completing the BIA phase. (Refer the banner graphic…”Operation successful but the patient is dead”)
To make this “Lean BCM” approach more objective and comprehensive, the following 3 steps could be considered:
1. Validate senior management inputs using information gathered about the organization from public and internal documentation.
2. Identify any dependent processes during the BIAs of the the identified processes and add them to the list of critical processes
3. Once the initial phase of identifying critical processes and planning their continuity is completed, embark on the next cycle of identifying the second level of critical activities. This iterative approach is essential till ALL activities performed by the organization are identified and planned for.
Given the reluctance of organizations to implement BCM due to huge time and money requirements, there is an urgent need to shorten the BCM implementation lifecycle. Leveraging senior management inputs can significantly reduce the time taken during the BIA phase. Secondary research about the organization can be used to make senior management’s judgement based inputs more objective.
(Note: This post is an attempt to provoke discussion. Please feel free to share your candid views so that the feasibility of this approach is properly understood)
(Keith Prabhu is a Member of the Business Continuity Institute. He is a contributor to the BCI Good Practices Guide 2013. He has been a judge for the BCI Global BCM Awards. He is the Founder & CEO of Confidis, an organization that provides services in the domains of Business Continuity Management along with other services. For assistance in any of these domains, please write to us at: info AT confidis DOT co )
