Business continuity and crisis management - Essay Example

 Business Continuity and Crisis Management Business Continuity Management (BCM) refers to a holistic framework that organizations use to identify risks and exposures to potential internal and external threats. (Stephenson, J. 1999). According to British Standard Institute, it also includes a range of processes that organizations need to adopt in their business cultures such as contingency planning, disaster recovery planning, crisis management planning, and business resumption among others to curb future uncertainties. BCM plays an important role in every organization that uses it. One major aim of having a BCM program on any business to is to give it the capacity to have a quick and effective response to global crises such as cyber attacks mostly through data breaches, natural disasters and ensure the business interests of the organization are protected. (Blyth, M. 2009). What this means is that BCM is not only about crisis management, but it also includes disaster and business recovery, incident and emergency management. The ISO 22301, which is a system of business continuity management, places emphasis on a few areas that are crucial in BCM. First, it suggests that there is a great need to have an understanding of the needs of continuity and preparedness. Moreover, there is need to understand why it is necessary to establish a BCM policy and objectives in an organization. It adds that the effectiveness of the entire process relies heavily on this understanding. Secondly, there is need for an organization to implement and operate controls that can manage its overall continuity risks. It therefore, suggests that it would be meaningless to have a BCM policy when the organization is not ready to implement it. (Bajgoric, N. (n.d.). Thirdly, the organization should constantly review and monitor the effectiveness of the BCM program to ensure it is working according to its goals. Finally, the regular assessment of BCM will lead to objective measurements that are important in continual improvement. With the rising cases of global crises such as terrorism, natural, technological, and manmade disasters, and many others, Business Crisis and Continuity Management (BCCM) programs have become indispensable for organizations. The process is important in giving guidance and focus for organizations with regards to their decisions and actions that are necessary for its success in mitigating some of the global crises it might face. It helps prepare organizations, whether, private or government agencies to have an effective response that allows them to recover and restore the normalcy of their operations. (Wallace, M., & Webber, L. 2004). This means that organization needs to have some level of competency, authority and excellent leadership that accepts and integrates the provisions of the program to be able to implement them effectively. According to Dumas (2013), A Business Continuity and Crisis Management (BCCM) is ideal for every organization regardless of the cultures that its employees hold. It goes without saying that in every organization, people have different beliefs as far as uncertainties are concerned, there are those who have doubts that things are not likely to go wrong when the business is big and successful. Others, on the other hand think that things can go wrong any time despite how solid and successful the business or organization is. With research and case studies on events such as BP oil spill and the Volcanic Ash supporting the fact that anything can happen at any given time, businesses need to generate some level of resilience by adopting the BCCM as a way if preparedness to tackle such catastrophic eventualities. (Wallace, M., & Webber, L. 2004). They are also doing this to keep providing their clients with satisfactory services and gaining their trust and confidence. BCM programs are a bit similar for most organizations whether they are for profit, non-profit, or private. They have the same principles that are meant to help the organizations maintain their capabilities to keep giving their clients the kind of products and services that can keep them glued to the companies. Hamilton & Webster (2012) articulate that every organization will strive to stay in business so as to keep their clients satisfied even in the face of adversities and disruptive events that may even threaten the future of the entire organization. Even if organizations prepared different BCCMs with different titles, it is worth noting that they are all aimed at ensuring continuity, which is a strategic responsibility for every business and organization. Nearly every organization has a manager whose biggest concern at any given moment is the disruption of their business infrastructure or that of their partners that may pose a big threat to their business and potential financial risks. It is therefore, imperative that they seek more resilience either individually or collectively to protect the business and the supply chain. (Watters, J. 2013). According to a report by KPMG, the risks of global , more so terrorism, have presented many organizations and business across the world with a collective challenge. It adds that firms, especially those that deal in finances should stick together so as to wade through the hard times ahead. The survey, that was commissioned by HM Treasury, Bank of England, and the FSA, was to assess the UK's financial sector’s BCCM. The report indicated that more than 60 of the financial service providers in the UK are taking part in the Resilience Benchmarking Project aimed at coping with operational disruptions like the current global crises that may no doubt cause disruptions to the business. (KPMG). The BCM helps in assessing the threats that an organization may be exposed to and helps it design proper response triggers that can keep them in business. Some of these threats are incidents that are serious and pose threats that have the potential to completely shut the operations of an organization. Continuity and Crisis Management (BCCM) is supposed to give an approach that is structured to develop an appropriate continuity strategy as well as preparations and testing of any business continuity plans that an organization may have in place (Regester, Larkin, & Regester, 2008). The current global crises may come in various forms, some may be civil, for instance the 7/7 London and the 9/11 New York attacks. Others may be natural, such as hurricanes, and other pandemics. There are also economic (large business failures, chemical shortages), and technical disasters. (Robinson, D. (2015). When these disasters strike, they may be sudden or gradual and may cover a small or a large area. The effect may be felt by every sector, from private, public to other agencies. It is at such times that these organizations can use the plans they had developed to respond to such emergencies. An organization may need more than one emergency response plan, they need a Business Continuity and Crisis Management (BCCM) to sustain their responses to the needs of the public and the stakeholders. From this, it is clear that a BCM is not only an emergency response measure, but it also aims at helping recovery activities after disasters. Organizations should not wait for disasters so as to try and rescue a few things to save their faces. For instance, the 9/11 and the 7/7 New York and London bombings respectively raised questions on the readiness of the US and UK organizations to handle large scale disasters. It is after these attacks that these organizations felt the immense pressure to cooperate and be ready for any eventualities. Since then, they have kept business continuity high on every board. Even though most businesses in the UK saw the need to have response measures to crises after the 9/11 attacks, it is only the UK government and its agencies that took more measures to curb future calamities. (Kumar, S., & Liu, J. n.d.). The 7/7 bombing, however, made more organizations to have resilient measures as priorities as it was seen that there were more global threats that could have potential harm to businesses. As such, organizations no longer ignore the fact that their values, employees, reputation, and shareholders are all at stake. What we learn from this is that BCM in the United Kingdom was shaped by two major events, meaning it took place in two different phases. The first phase, which was after the 9/11 attacks pushed the government to centre its response on emergency and crisis management. The second phase, which was the post 7/7 attacks, on the other hand, led the government and businesses to emphasize more on the continuity of businesses when such crises take place. Let’s draw a few more examples from the United Kingdom and look at the Millennium bug, flood events, and the Fuel Blockade of 2000. These raised important questions about the complexity and total lack of any framework that was focused on preparing as well as responding to national, regional, and local disasters. It is these that saw the creation of the Civil Contingencies Secretariat (CCS) established to assist with such responses. (Robinson, D. 2015) What we can deduce from these events and the kind of responses that businesses and the government had is that there is a structural change and reformation in the country that are meant provide more effectiveness as far as disaster management is concerned. Still looking at the 9/11 New York attacks, we realize that it is an incident that highlighted the vulnerability of critical infrastructure around the world to terrorism. Most governments have since them focused on providing security of such buildings to keep them safe from such manmade attacks.( Kumar, S., & Liu, J. n.d.). Business Crisis and Continuity Management (BCCM) has seen a lot of changes with time. The rapid changes in the recent years have seen many BCM programs that are more of by-products of enterprise management of risks or as part of service level agreements that are customer-driven. However, BCM is yet to find a place to call a permanent home in most organizations. For years, BCM has tried moving out of information technology (IT). It is worth noting that IT has retained the IT Disaster Recovery programs in various cases. It is unfortunate that the progress to finding a home for BCM in organizations has not been very steady. A survey conducted by the BC Management in 2009 reported that it is likely that BCM will be part of risk management, operation, or even a separate BCCM program that will be equal or greater standing above the traditional risk management departments. This explains why CIOs who are forward-thinkers have been engrossed in lobbying to retain BCM within their organizations as its profile keeps rising. One of the major challenges that BCM's migration from IT has been facing is finding the personnel with the right skills to effectively run the program in the organizations. (Watters, J. 2013). Another challenge is making the program fit organizationally. Experts argue that BCM may not fit risk management even though it might be intuitive to try and place it there. One argument against this is the fact that risk managers have a slightly different role from that of BCM. More often, they deal with issues that may be of high frequency but have low severity, for instance liability claims and workers’ compensations. But BCM deals with many serious issues and that is why most organizations have seen the need for value proposition for the process. (Business Case Failure. 2014). As I mentioned earlier, organizations have different cultures and it is these that inform the decisions regarding value propositions. Some of the things that managers should look into while structuring such value propositions include adding new sections when preparing reports such as loss and other incidents. These are meant to show what could have occurred if there were no mitigation and continuity measures in place. Executives should also review the current BCM programs to find out whether they focus on facilities, people, or technology. This will require the management to determine the day to day benefits that the organization gets from such measures. Such reviews are meant to find out whether the organization still stands to benefit even in the absence of a disaster. Waxman (2013) points out that a BCM best practice to have a documentation of the process improvements and any other benefits that they come with. BCM normally takes a close look and why and how things happen, especially for the current organization processes. This explains why organizations normally do a routine identification of better ways of that can accomplish the goals during the BCM life cycle. It goes without saying that it is important to articulate the risk that may come when an organization does not have an effective BCM program. (Business Case Failure. 2014).This should not be assumed as common sense because in most instances, BCM programmers will assume that the executives have an understanding of what to do at any given time of the consequences of not having such a process and the interruptions it may cause. It should, therefore, be noted that the executives have long been out of active operations for long and there is likelihood that they have forgotten or are unaware of the recent changes in the industry. The executives should be on the front line in promoting BCM as a process that saves cost. While this might seem as putting one’s eggs in one basket, well, it is one of those rare instances that you have to put your eggs in one basket and keep a watchful eye on it. Having an effective BCM program can greatly position organization to more resilience and more savings. (Baranek, S. 2010). The program should be managed by the business and this management should mirror the overall management of the organization. From this, you can realize that there is no exact place to report BCM. As a matter of fact, the people who should manage the program should be those who are closest to the impact of the risk. It is, however, difficult for organizations that have a decentralized system of management to try managing a BCCM program using a centralized system and have a successful implementation. Still on the changes that BCM has undergone over the years, it would be remiss me not to mention the fact that it is not only ‘where’ that has changed, ‘what’ with regards to BCM has also seen a significant shift with it programs getting more influence from standard practices as well as individual certifications. (Elliott, D., & Swartz, E. 2002). This is not to forget the fact that the ‘what’ has also expanded and now includes diverse types of risks. It is worth noting that more managing directors and executives are getting more interested in BCM programs. What this means is that they are taking the management of the risk exposure of their businesses seriously. For instance, from the year 2005, most of the larger companies have been setting a new trend in terms of improving the level of pandemic preparedness. As a result, BCM programs have expanded to cover more than the traditional disasters. (Mcguinness, M., & Marchand, R. (n.d.). Another significant shift in BCM programs is the rise of standards that seek to control what should be considered as an acceptable BCM program. As it stands, there are a number of such standards that are currently vouching for the attention of the most influential organization worldwide. There is NFPA 1600, BS25999 and another new standard by American Society for Industrial Security (ASIS). The Public Law of the United States under the Department of Homeland Security is charged with finding a suitable standard and appointing as the National Preparedness Standard (Hughes, Scott & Golden, 2011). One can only hope that the growing number of standards, especially in the United States, will bring up more discussion over what should constitute a good BCM program. However, it goes without saying that this will create more confusion. The above changes only suggest one important thing, that it is the time for organizations to be more responsible for BCM. It is an effective way of reaching the organisation’s leaders with new proposals on the importance of managing risks. (Baranek, S. 2010). With the growing influence that the standard are having on BCM in the US and worldwide, one can only hope that there will be a range of options for organizations on the kind of BCM that their managers prefer. It is unlikely or maybe unfair to ignore the impact that the social media has on the BCM programs in this discussion. As it stands, social media now holds the key as far as transforming business continuity management is concerned (Hughes, Scott & Golden, 2011). Most importantly, it can be used in communication practices and crisis or incident management. Gartner Inc. Predicted that more than 75% of organizations that have BCM are likely to have public social media services as part of their crisis communication strategies. Most companies bought Gartner Inc.’s advice and immediately sent their professionals to assess the opportunity that lies in it. However, social media use in BCM could also pose serious challenges for organizations. Some of these include difficulty to maintain a credible and authoritative source of information, trying to enlist an active and effective participation of the public and the staff who are on social media, filtering, analysing, and applying the information that has been gathered from the social media platforms (Lahrmann, Winter & Uhl, 2011). At this stage, most organization’s BCM efforts focus on the opportunities and the risks that the social media and it would be a bad idea for BCM and crisis management specialists to ignore these platforms as they work on their BCM programs. In conclusion, it is important to point out that Business continuity and crisis management will take new shifts in the near future. This is informed by the rising number of global crises and the persistent advancement in technology. More companies will take measures to ensure the have a BCM program in place. Those that will ignore this area will mostly certainly be the biggest losers. References:Top of Form Top of Form Top of Form Bottom of Form Top of Form Bottom of Form Top of Form Bottom of Form Top of Form Top of Form Top of Form Bottom of Form Bottom of Form Bottom of Form Bottom of Form Bajgoric, N. (n.d.). Business Continuity Management. Continuous Computing Technologies for Enhancing Business Continuity Baranek, S. (2010). It is time to think about business continuity planning: Business continuity planning is not on the minds of many mold manufacturers, but it should be.(Business Management). MoldMaking Technology. Retrieved November 25, 2015, from Bernstein, Jonathan. (2011). Manager's Guide to Crisis Management. McGraw-Hill. Blyth, M. (2009). Business continuity management building an effective incident management plan. Business Case Failure. (2014). Project Recovery KERZNER:PROJECT RECOVERY,45-85. Business Continuity Management : How to Prepare for the Worst. (n.d.). Risk Management in an Uncertain World : Strategies for Crisis Management. Business continuity management is vital for economic resiliency.(2011). SMB Advisor Middle East. Retrieved November 25, 2015, from < http://www.highbeam.com/doc/1G1-254178806.html> Business Continuity Management. A Crisis Management Approach. (n.d.). Journal of Contingencies and Crisis Management, 47-48. Business Continuity Management: Building an Effective Incident Management Plan Course Guide Custom Set. (2012).  Bioterrorism Week. Retrieved November 25, 2015, from Crisis Information Capture Reports. (2012). Building an Effective Incident Management Plan Business Continuity Management, 285-356. Crisis Management Structures. (2012).Building an Effective Incident Management Plan Business Continuity Management, 111-140. Davies, W. (1960). The New Deal and business recovery. New York: Holt. Döscher, K. (n.d.). Quantitative investigation on recovery management in business markets. Recovery Management in Business-to-Business Markets, 99-178. Dumas, M. (2013). Fundamentals of business process management. Berlin: Springer. Bottom of Form Elliott, D., & Swartz, E. (2002). Business continuity management: A crisis management approach. London: Routledge. Hamilton, L., & Webster, P. (2012). The international business environment. Oxford: Oxford University Press. Hughes, Martin, Scott, Murray, & Golden, William. (2011). The role of business process redesign in creating e-government in Ireland. Business Process Management Journal, 12(1), 76-87 Kumar, S., & Liu, J. (n.d.). Is it all different now for businesses? An analysis of terrorist attacks on businesses before and after 9/11. IJDSRM International Journal of Decision Sciences, Risk and Management, 124-124. Lahrmann, G., Winter, R., & Uhl, A. (2011). Transformation management survey: Current state of development and potential of transformation management in practice. (360° - The Business Transformation Journal, 2011, 29-37.) Mcguinness, M., & Marchand, R. (n.d.). Business continuity management in UK higher education: A case study of crisis communication in the era of social media. IJRAM International Journal of Risk Assessment and Management, 291-291 Meyer, L. (n.d.). Lessons from Recent Global Financial Crises. Global Financial Crises, 17-23. Regester, M., Larkin, J., & Regester, M. (2008). Risk issues and crisis management in public relations: A casebook of best practice. London: Kogan Page. Risk Management for Government and Businesses: Cases 63–101. (n.d.). Risk and Crisis Management 101 Cases, 143-238. Rittinghouse, J., & Ransome, J. (n.d.). Business Recovery Phase. Business Continuity and Disaster Recovery for InfoSec Managers, 171-191. Robinson, D. (2015). The Long-term Outlook and Risks in Advanced Countries. Global Journal of Emerging Market Economies,7(2) 150-178. Snedaker, S. (n.d.). Business Continuity and Disaster Recovery Overview. Business Continuity and Disaster Recovery Planning for IT Professionals, 1-42. Stephenson, J. (1999). Battling the Millennium Bug . JAMA, 1368-1368. Wallace, M., & Webber, L. (2004). The disaster recovery handbook a step-by-step plan to ensure business continuity and protect vital operations, facilities, and assets. New York: American Management Association. Watters, J. (2013). Business Continuity Management. Disaster Recovery, Crisis Response, and Business Continuity. Watters, J. (2013). Business Recovery Strategies. Disaster Recovery, Crisis Response, and Business Continuity Waxman, K. T. (2013). Financial and business management for the doctor of nursing practice. Year 2000 computing crisis business continuity and contingency planning : Exposure draft. (1998). Washington D.C. 20013): U.S. General Accounting Office. Read More