There has been a plethora of articles and conferences in recent times debating the threats that businesses face, the horrendous consequences of not dealing with them and generally castigating management for not taking Business Continuity seriously. This article is not going to add to that debate but rather pose some questions about the very nature of Business Continuity Management (BCM) in an organisation. By Lyndon Bird of the Business Continuity Institute.
Firstly I would like to pose a few questions:
1. When you are considering a major strategic change to your business processes (e.g. outsourcing, off-shoring, rationalisation of production facilities, supply chain optimisation) who do you involve in the decision process?
2. When you are considering a major strategic change to your products and services, what is the basis for your decisions and how are the risks evaluated?
3. If you have a Business Continuity Manager, where does he or she fit in the organisational structure?
The answers to those questions will give a very good indication of why BCM (despite enormous media interest in calamities) fails to really make the progress that would be expected in commercial organisations. The annual Chartered Institute Management survey for 2006 shows virtually no change in the percentage of companies embracing Business Continuity since 1998. Remember that was before the millennium bug threat, foot and mouth, fuel blockade, SARS, 9/11, train bombings, worries about a pandemic, numerous natural disasters, war in Iraq, and home-grown terrorists.
If this list of real threats does not persuade commercial companies to embed Business Continuity into their organisations from shop floor to boardroom, then probably no horror story will.
I suspect many CEOs and senior managers would answer the first two questions without any reference to a Business Continuity Manager. The same people are likely either not to have a full-time BCM function in place; or, if they do, it will be well hidden in some specialist area like IT or Risk Management. Yet surely no one would deny that the decisions covered by these questions are the most critical, far-reaching and business threatening if they go wrong.
In other words the issues put your Business Continuity at risk much more than loss of an office block, a data centre, or even critical personnel. They can ruin your reputation, market share and credibility overnight. So the conclusion is that most companies use Business Continuity to protect against operational problems, but not to provide input to strategic decisions.
Exploring just one particular area, Supply Chain Management, makes clear the weaknesses of this approach. Supply chain optimisation creates enormous cost-saving and quality improvement opportunities. It is the one area from which business believes it can still squeeze extra value, with globalisation as the key. However. within the BCM world, Supply Chain Business Continuity is also a hot topic. The main conceptual drivers have been the lessons learned from the Y2K activities, when many corporate projects identified significant (and previously unknown) single points of failure.
In addition, the supply chain has become completely global, and production or shipping problems in one part of the world could easily impact on businesses thousands of miles away in a matter of days. Finally, achieving major procurement, inventory and logistics cost efficiencies by better managing the Supply Chain has become essential to being competitive, so inherent risks have to be taken.
Given this picture, it is easy to see why Supply Chains are a major risk to Business Continuity, but surprising to see how little Business Continuity Managers are involved. I believe that top managements in many organisations see the benefits of Supply Chain optimisation as a ‘no brainer’, and conveniently delegate the risks to a Risk Committee. In most cases the Risk Committee will not even involve a BCM professional.
Many CEOs might choose to ignore the views of the latter professionals, assuming that they will be risk-averse and non-commercial in their thinking. It is easy to see why this might happen. BCM traditionally looks to eliminate single points of failure, and to spread activities around so as to improve resilience and provide adequate resources to deal with unexpected contingencies. Superficially this would seem to suggest multiple suppliers, geographically spread facilities, and inventory levels suitable to cover for supply interruptions. This message is not likely to be popular with buying, distribution or financial managers, each eager to embrace business partnerships and single-sourcing, larger and larger fully automated distribution centres, and just-in-time delivery.
This problem only occurs becase Business Continuity Managers are generally not operating at the correct level. If they are part of the senior management team with clear strategic responsibilities for input into and ultimate implementation of Board Policy, then their vision has to be wider. Your current BC Manager might not be viewed as having the right calibre to take this step up, but that is only because you probably have probably not defined the job correctly and have therefore not resourced it appropriately.
However, even at basic level there is much that BCM can do to help reduce the risk of failure with strategic changes. For example, the risks involved with ‘single points of failure’ are almost entirely preventable, and only arise through lack of a good Business Impact Analysis. They result not just from having a single supplier for a product, which in itself might be entirely appropriate in some circumstances, but from lower down the Supply Chain. What is more important to determine is the raw material or unique component that will affect all current or potential suppliers. Knowing this for your critical products and services is vital. It is then often possible to design out the risk by changing the design or the specification.
Longer supply lines mean more chance of disruption and less time to make alternative arrangements. When anything goes wrong there can be immediate and serious ramifications, and people need to know what to do, where to go, who to contact, and what strategy to implement. Does this sound familiar? In other words, you need a tested, communicated and understood Business Continuity Plan for the ‘End to End’ Supply Chain.
A wide range of other risks which arise from extended supply chain management need to be addressed, not least intellectual property rights, including counterfeiting, black and grey market competition, and even commercial espionage. As part of product development and supply chain design, think of the risks involved and how you can manage them out at the concept and design stage.
Don’t be surprised when things go wrong, but know your process will manage the unexpected. BCM is not about clever technical solutions or voluminous documented procedures; it is really about process reliability and continuous improvement – topics close to the heart of any ambitious CEO.
Taking an even wider perspective, I am often asked about the role of BCM in managing the impact of climate change on business. BCM is traditionally about dealing with serious but unexpected incidents at very short notice with limited available resources and confused sources of information. Climate change is anything but unexpected or unpredictable. It will take many decades for its worst consequences to happen, and it has potentially the entire resources of the world to solve it. Better still, if scientists are to be believed, we could take actions now that would solve the problem, or at least mitigate the impact and prevent the worst consequences happening.
However, if you accept the cliché that every problem is an opportunity, companies that provide the green solutions will become the successful companies of the future. Technology might have caused much of the problem, but it is only technology that can solve it. When you are talking business change on this massive scale you are also talking serious Business Continuity Management.
Lyndon Bird is Technical Services Director of the Business Continuity Institute, which has 3,500 members in over 80 countries promoting the art and science of Business Continuity Management Worldwide.
The articles published here in the Thinking CEO are internet updates of the latest management knowledge and practice, which have been commissioned by Sovereign Publications for their bi-annual magazine, CEO Today, and will appear later in the first 2007 issue of this publication. To contact Sovereign and CEO Today, go to:
http://www.sovereign-publications.com/ceo-art.htm
read all 70 gurus with one feed read all Read all media
