Business Continuity and Crisis Management - Essay Example

?Business Continuity and Crisis Management Table of Contents Table of Contents 2 Introduction 3 What is BCM? 5 Critical Appraisal of Drivers of BCM 6Stages in BCM Implementation 8 Preconditions for Effective BCM Implementation 11 Benefits of Implementing BCM in an Organisation 12 Challenges Presented by Business Environment to BCM Implementation 13 Factors Involved in Effective Crisis Management 16 Critical Analysis of BCM in an International Context 17 Conclusion 18 References 19 Bibliography 23   Introduction Organisations exist for the sole reason of providing services to their customers. In the course of providing services to their customers there exists a probability of certain disruptions that might impact them to such an extent that they might not be able to serve their customers. It is for this reason that organisations undertake functions for prevention of disruptions, try to stay prepared, undertake risk management, crisis management, recovery processes and emergency responses. They also decide on processes that can ensure speedy resumption of business and manage resources for this purpose based on their understanding of their business environment. These functions serve as the organisation’s protection from future predicaments. Efficiency and effectiveness is achieved through the integration of these functions (Shaw, n.d.). There are several factors that affect business continuity namely networking reliability, data availability, scalability and availability of operating systems, application availability and reliability of server hardware. It is imperative for a business to continuously operate, ensure data availability at all times and display agility in accessing the data. The advancement in information technology has made it necessary to achieve business continuity on the basis of ‘continuous computing’ technologies. This is the reason that Business Continuity Management (BCM) and Crisis Management has become an integral part of the information system of an organisation (Nijaz & Moon, 2009). Most businesses do not prepare for unexpected breakdowns in advance or even if they plan, it is often outdated. Good continuity is reflected through advance planning thereby paying attention to minute nuances so that when an emergency situation arises then there is no reason to panic. Most organisation lack this kind of detailed planning as they tend to concentrate only on Information Technology (IT) and carry out too much of business analysis. Planning and simplicity in BCM ensures acceptable service levels for key processes in the business. BCM involves preplanning and coming up with alternative solutions. BCM is essential for the long term survival of the business (Hotchkiss, 2010). What is BCM? In the words of Shaw and Harrold, business crisis and continuity management can be defined as “the business management practices that provide the focus and guidance for the decisions and actions necessary for a business to prevent, prepare for, respond to, resume, recover, restore and transition from a disruptive (crisis) event in a manner consistent with its strategic objectives” (Shaw, n.d.). BCM entails maintaining and developing a total plan for business continuity which ensures the business’ survival in case any disruption occurs. BCM involves development of plans based on the analysis of business impact, plan execution and regularly updating the plan to discover new risks, threats and business situations (Hotchkiss, 2010). BCM involves evaluating and understanding the risks faced by the company, assessing the impact of an unexpected situation on the organisation and accordingly making decisions regarding the extent to which the organisation should prepare for an unforeseen crisis situation (Matthys, 2010). Critical Appraisal of Drivers of BCM Every organisation in today’s world needs to bring about strategic changes in response to the changes occurring in their economic environment. These changed are driven by various regulations namely government regulations and compliancy regulations. Organisations need to put in place guidelines for disaster recovery, planning for disaster recovery and services for resilience. Hardware components like virtual servers, backup servers, power supply units, remote backup devices, co-located hardware and spare network components of computers constitute elements of a recovery plan for disasters. Information security is the other driver for BCM. Hacking has taken place even in big organisations namely in CNN, in Amazon UK in 2007, in the Belgium government in 2008, in CERN in 2008. However, BCM is not a concern only for the IT department in an organisation (Matthys, 2010). The various external drivers of BCM include the customers, government, auditors, regulators, insurance companies, investors, suppliers, legislations and corporate governance. The key customers and the investors in a company need to be protected if any contingency arises. Compliance with business continuity management is essential not only within the company but for external stakeholders as well. It should involve the whole value chain and not just key suppliers. Insurers of a company also need the assurance that BCM has been properly implemented in the organisation. In case proper BCM has not been implemented in the organisation then insurers set their fees at a level depending upon the risks involved. Moreover, when a crisis situation occurs then the amount paid by the insurers is very small as compared to the damage suffered. A company which does not have proper BCM may lose its prime customers and its reputation may be marred (Matthys, 2010). There exist several legal and regulatory issues that impact the planning for business continuity. Legislation, regulation and internal control are the three types of controls that drive BCM. Internal controls include processes, appraisal system, budgets, rewards, administrative systems, and mentoring. The internal controls vary across various organisations. The legal and regulatory issues are a part of the macro environment and serve as control systems in influencing the organisation to prevent, respond and emerge from a disruptive situation. The regulatory and legal control systems serve as mechanism for external control. Controls have an impact on the organisations actions. Control systems ensure that goals and objectives are met in terms of tackling complexities, adaptation to the complexities in the environment, reducing costs and increasing efficiency and maintenance of standards (Elliot & et. al., 2009). Stages in BCM Implementation The various stages in BCM implementation can be categorised as infancy, growing and mature stages. In the infancy stage, the organisation carries out exploration and justification for having a business continuity plan. The organisation at this stage looks for support to adopt a business continuity plan and to establish a BCM model. In this stage, the benefits of BCM are communicated at all levels in the organisation. During this stage, a detailed understanding of BCM is developed, detailed technical knowledge related to business impact analysis, recovery strategy and risk assessment is developed. During the growing stage, the organisation carries out approval of resources that are required for setting up BCM. In this stage, gradually the employees start appreciating the benefits of BCM. The growing stage involves a lot of planning, documentation and analysis. A planned schedule is developed for the employees so that they can undergo the necessary training. The training may be of an advanced level or may be basic or intermediate. These training sessions include a detailed understanding of test strategy and business continuity exercises and tests are executed. The trainings also render technical knowledge on how to perform the recovery tasks. Skills for project management are enhanced. This is done to ensure the maintenance and development of business continuity plan. During the maturity stage it is ensured that the employees of the organisation have already passed through rigorous business continuity exercises and tests. At this stage, it is ensured that competence level is maintained and the employees should have in-depth knowledge. The training sessions in this stage include briefing or a refresher course, carrying out an annual business continuity test, orientation program for new employees, annual awareness program and training is imparted to develop the ability to translate and relate to changes (BCM Institute, 2007). The very first step in business continuity management involves identifying the key activities involved in the processes within the organisation. It also involves deciding on the consequences if a key activity is unavailable and finally plans are designed to ensure that the process works smoothly without any disruptions. The plans simply lay down the course of action if a disruption occurs at certain point in the supply chain. The organisations’ course of action in case of damage might be repair of the damage or introduction of entirely new operations. These plans are referred as business continuity plans or disaster recovery plans or contingency plans or simply disaster plans (Waters & Waters, 2011). The BCM process can be divided into six steps starting from initiation of BCM to controlling and monitoring it. The steps are namely initiation of BCM process, defining the BCM requirement and strategy development, risk assessment, preparing the business continuity plan, executing the plan, reviewing and monitoring the plan. During the initiation phase the need is recognised, sponsor is obtained, approval from senior management is obtained, a BCM team is formed, budget is decided and resources are arranged. In the second stage, the long-term aims are decided upon based on the strategies of the organisation. The foundation for BCM is decided at this stage depending on the organisation’s outlook towards risk. In the next stage, risk assessment is done by identifying the vulnerabilities in the organisation’s supply chain and also identifying the critical operations. ‘The business impact analysis’ is also carried out at this stage which involves analysing the impact of the absence of a key operation. At this stage, options are also decided on for handling the emergency situation. The options include avoidance, transfer and acceptance among others. In the next stage, the business continuity plan is formulated. Managers at this stage have a clear understanding of the vulnerabilities of certain key operations and how to handle these vulnerabilities through BCM. The business continuity plan presents the details of BCM implementation. The business continuity plan contains statements regarding when the activation of BCM will commence, it describes events that can be considered as a serious emergency to start off a BCM response. The BC plan includes organisational responsibilities and roles and also includes procedures for understanding the scope and actual effect of an emergency. The BC plan sets down the procedures for activation of a recovery team and assignment of separate recovery team for each key business activity. It includes procedures for backup data retrieval, responses to emergency, public relations, and moving operations to a secured location among others. Once the business continuity plan is formulated then the next step involves putting it into action. When a crisis occurs then the BC plan is executed. The final step involves monitoring the success of BCM and identifying the flaws so that necessary correction steps may be undertaken (Waters & Waters, 2011). Preconditions for Effective BCM Implementation Most organisations simply reply on BCM professionals for effective BCM implementation. However, it is essential that ‘preparedness’ should exist at all levels in the organisation. BCM specialists have a unique responsibility to sense a disaster in advance and take precautionary measures. It is extremely important to select these professionals carefully. The formulation of proper business continuity plans is essential for effective BCM implementation. The BC plan should carry out impact and need analysis, response specification, selection of strategy and finally plan testing (Butler, n.d.). Benefits of Implementing BCM in an Organisation Organisations are gradually realising the benefits that can be obtained through implementation of BCM. BCM provides a supporting structure for developing the resilience of the organisation and improves the organisation’s response to a crisis situation so that the interest of the stakeholders and the reputation is protected. BCM helps in improving the organisation’s performance in the long run. Other than the primary benefit of helping an organisation recover from a crisis situation, BCM has several peripheral benefits as well. Due to BCM implementation organisations are better prepared to face the unforeseen situations and they develop a better understanding of their business. It has been revealed from a report of the business continuity institute that amongst 221 companies that had adopted BCM, 77% could recover faster from a crisis situation. 55% out of 221 also claimed that they had been able to achieve cost savings (Kogan Page Ltd & Workplace Law Group, 2011). Companies have realised that identification of risks can help in reduction of exposure. BCM helps in developing a better understanding of the business by the dependencies and the critical factors in the business. The implementation of measures for risk reduction helps in improving resilience of business operations. The downtime is also reduced through the creation of alternative processes; BCM helps the organisation to comply with the legal and regulatory requirements (Hiles, 2011). Challenges Presented by Business Environment to BCM Implementation BCM implementation in an organisation is at times impaired due to certain constraints. Often difficulties arise in the establishment of business continuity plans. At times, businesses fail to realise the magnitude and the consequences of the disaster. It is often seen that business continuity plans that stress too much on details fail to be more effective. Organisations face difficulty in adopting a realistic approach towards disaster management. The primary challenge to BC implementation lies in information systems’ recovery. In many organisations, the focus is on IT recovery in isolation from other business processes. Often organisations employ the services of specialist in disaster recovery. These disaster recovery service providers offer their service in syndication to many clients with the result that when a crisis situation arises then the recovery is delayed as services are provided in a queue. There exist certain personal problems as well to effective implementation of business continuity management. The business continuity plans assume that all employees would be available soon after a disaster to carry out tasks assigned to them. However, in actuality many employees might not even survive and it is not possible to predict exactly the response of the employees. It is extremely important to communicate to employees regarding the business continuity plans and instill confidence in them regarding the organisations ability to emerge from the crisis and utmost attention should be placed on employee welfare and their stress and trauma must be considered. During the initiation stage of BCM, approval is obtained from the top management so that proper resource allocation is done to the BCM process by them and necessary support is available from them. This commitment may be difficult to maintain over a long period of time. Organisations which are not guided by legislations and regulations may face difficulty in obtaining support from the top management. Economic, cultural and psychological factors have an important role to play in this regard (Hill & Burgess, 2003). Mitroff had identified several defence mechanisms that organisations resort to deny their susceptibility to crisis and which discourages top management from adopting BCM. The defence mechanism may be in the form of denial whereby organisations feel that the crisis will befall only others. It may be in the form of disavowal whereby they believe that the impact of the crisis on them will be insignificant. In idealisation, organisation believe that crisis does not affect good organisations, in grandiosity, the organisation believes that they are so strong and powerful that the crisis cannot harm them, in projection the organisation holds the belief that in case crisis happens it would be because somebody is trying to inflict harm, in intellectualisation they believe that chances of a crisis are meagre and precise measurement is required in terms of outcomes expected and occurrence frequency. The attitude towards BCM is also affected by cultural differences. Business tradition in Japan is such that they do not believe in spending money to protect themselves from unforeseen disasters. BCM is a discretionary expenditure and thus when an organisation has budgetary constraints, the first expenditure that is curtailed is BCM. Many organisations consider that insurance cover is sufficient to protect themselves from disasters. The interest regarding BCM increases immediately after a disaster and gradually declines. This was evident from the way in which the ‘Y2K’ problem was handled. The interest towards BCM after the September 11 terrorist attack was high only for a year. According to the financial services authority, “While there is no doubt awareness of BCM has increased since September 11, the level of awareness is still an issue in a number of firms” (Hill & Burgess, 2003). Factors Involved in Effective Crisis Management Fink had identified four distinct stages of crisis namely prodromal crisis stage, acute crisis stage, chronic crisis stage and crisis resolution stage. Effective crisis management involves identifying the early signs of crisis, although, it may be difficult to identify in the prodromal stage. However, once the organisation has passed into the acute crisis stage then recovery will be difficult because damage might have already begun. The preparedness of the organisation and the effectiveness of their response determine the extent of the damage. The chronic stage is a recovery stage where the organisation identifies their weaknesses and learns from their experience. In the crisis resolution stage, the organisation resumes their functions and comes to normality. Effective crisis management is possible through a continuous and structured learning process that will enable the management to handle crisis better (Paraskevas, n.d.). Effective crisis management requires knowledge of the company’s ability to withstand risk and its products. When the company’s products are introduced into a new market then new risks are involved and these must be addressed. The organisation should have knowledge of their customers. Key risk factors should be identified and ways to mitigate them. Although precaution are taken but the crisis yet might occur and thus the organisation should remain prepared to deal with it. Effective communication is also a very important factor for effective crisis management (Azmi, n.d.). Critical Analysis of BCM in an International Context The aftermath of 9/11 was that companies had realised that they needed to maintain a backup data centre away from their primary data centre and needed to improve on their recovery plans. Companies like Merrill Lynch had carried out decentralisation of their IT system after the attacks. Companies had also realised that they needed to consider their company as a whole and not just concentrate on IT. Prior to the 9/11 attacks companies thought that BCM was a waste of resources, According to a report by Info Security News magazine, an effective BCM can help in loss reduction by 90% in case of a catastrophe (Naef, 2003). Several instances in the past have made it clear that BCM is crucial for an organisation. In January 2001, electricity failures in Silicon Valley resulted in loss of enormous data by Hi Tech companies (Gibb & Buchanan, 2006). Conclusion Thus, it can be concluded that BCM helps in the long-term sustainability of the organisation. In the present uncertain business environment, it is crucial for organisations to implement effective BCM. It helps them to stay prepared for unexpected crisis situations. The need for BCM is driven by strategic changes in the business and economic environment. There exist several legal drivers, internal and external drivers for BCM which include customers, investors, suppliers, auditors, regulators and insurers to name a few. It is also driven by legislation and regulation. BCM implementation occurs in three stages namely, infancy, growth and maturity stage. In the initiation stage, the key activities are identified; approval from top management is obtained. Gradually, the business continuity plan is formulated, risk assessment is done, plan is implemented and then the effectiveness of the plan is monitored. The formulation of a proper business continuity plan is a prerequisite for effective BCM. BCM implementation has several benefits. It does not simply protect an organisation from crisis but also improves the resilience and performance of the organisation. BCM implementation is a challenge for organisation in the ever-changing economic and global environment. Effective crisis management requires organisations to identify risk factors, identify crises early and take necessary precautionary measures. Several catastrophes either man-made or natural in the past have caused lot of damage to organisations. It is in view of this fact that BCM is gradually gaining a lot of importance. Organisations are now realising the importance of BCM implementation and no longer consider it a waste of resources. References Azmi, R. A., No Date. The Transaction’s Risk Management Process. Crisis and Risk Management for Companies. [Online] Available at: http://www.google.co.in/url?sa=t&rct=j&q=effective%20crisis%20management%20in%20an%20organization%20site%3Aedu&source=web&cd=4&ved=0CDcQFjAD&url=http%3A%2F%2Fwww.pitt.edu%2F~super7%2F23011-24001%2F23871.ppt&ei=bA1YT_vPG8XQrQfugN2BDA&usg=AFQjCNGQkc0TYZabuZaVsHYgXaxvpNfZqA [Accessed March 07, 2012]. BCM Institute, 2007. Managing & Sustaining Your Business Continuity Management Program. BCM. Butler, B., No Date. Specialization Vs. General Infusion. Business Continuity Management: A Positive Perspective on the Design of Resilient Organizations. [Online] Available at: http://www.google.co.in/url?sa=t&rct=j&q=conditions%20for%20effective%20business%20continuity%20management%20site%3Aedu&source=web&cd=1&ved=0CCsQFjAA&url=http%3A%2F%2Fstaging.weatherhead.case.edu%2Fevents%2Fpositive- design%2FPositionPapers%2FBrian_Butler_BCM%2520as%2520Positive%2520Design%25208-05).doc&ei=HBtYT7i8JsPqrQfH89jtCw&usg=AFQjCNEgL6gNV2PZPykhrcWY0Rb1WzxOA [Accessed March 07, 2012]. Elliot, D. & et. al., 2009. Business Continuity Management: A Critical Management Approach. Taylor and Francis. Gibb, F. & Buchanan, S., 2006. Introduction. A Framework For Business Continuity Management. [Online] Available at: http://people.exeter.ac.uk/gaharris/bem3015/bcm.pdf [Accessed March 07, 2012] Hiles, A., 2011. The Definitive Handbook of Business Continuity Management. John Wiley and Sons. Hill, R. & Burgess, S., 2003. Issues Relating to the Business Continuity Management Process. Issues in Business Continuity Management. [Online] Available at: http://www.irma-international.org/viewtitle/32006/ [Accessed March 07, 2012] Hotchkiss, S., 2010. Business Continuity Management: In Practice. BCS, The Chartered Institute. Kogan Page Ltd & Workplace Law Group, 2011. Health and Safety, Premises and Environment Handbook 2012. Kogan Page Publishers. Matthys, E. A., 2010. Business Continuity Management. Benefolio. Naef, W. E., 2003. The Business Continuity Management Process. Business Continuity Planning - A Safety Net For Businesses. [Online] Available at: http://www.iwar.org.uk/infocon/business-continuity-planning.htm [Accessed March 07, 2012] Nijaz, B. & Moon, Y., 2009. Introduction. Enhancing Systems Integration By Incorporating Business Continuity Drivers. . [Online] Available at: http://surface.syr.edu/cgi/viewcontent.cgi?article=1005&context=mae [Accessed March 07, 2012] Paraskevas, A., No Date. Crises and Crisis Management. Crisis Management or Crisis Response System. [Online] Available at: http://oxfordbrookes.academia.edu/AlexandrosParaskevas/Papers/78147/Crisis_management_or_crisis_response_A_complexity_science_approach [Accessed March 07, 2012] Shaw, G. L., No Date. Introduction. Business Crisis and Continuity Management. [Online] Available at: http://www.gwu.edu/~icdrm/publications/ShawTextbook011105.pdf [Accessed March 07, 2012] Waters, C. D. J. & Waters, D., 2011. Supply Chain Risk Management: Vulnerability and Resilience in Logistics. Kogan Page Publishers. Bibliography Blyth, M., 2009. Business Continuity Management: Building an Effective Incident Management Plan. John Wiley & Sons. Gallagher, M., 2002. Business Continuity Management: How To Protect Your Company From Danger. Trans-Atlantic Pubns. Harvard Business School, 2004. Harvard Business Essentials: Crisis Management: Master The Skills To Prevent Disasters Harvard Business Essentials Series. Harvard Business Press. Regester, M. & Larkin, J., 2008. Risk Issues and Crisis Management in Public Relations: A Casebook of Best Practice. Kogan Page Publishers. Reid, J. L., 2000. Crisis Management: Planning And Media Relations For The Design And Construction Industry. John Wiley and Sons. Read More