How Important is it to Develop a Business Continuity Model Strategy - Essay Example

?Business Continuity Business continuity management (BCM) seeks to ensure that organisations are able to withstand a disruption on normal operations.Elliot et al. (2000, p. 27) reported that the BCM originated in the United States banking system during the 1970s and 1980s following a concern that a failure in information technology would have grave commercial consequences. According to Elliot et al. (2000, p. 36) recovery from disaster forms a part of the overall BCM process. Towards achieving business continuity, Tammineedi (2010) recommends a simple 3-phase system consisting of pre-event preparation, event management, and post-event continuity. However, there are other systems or business continuity models that are more elaborate. For the Institute of Internal Auditors, business continuity management is a “process by which an organisation prepares for future incidents that could jeopardise the organisation’s core mission and its long-term viability” (2008, p. 3). Some of the incidents that can affect an organisation include fires, earthquakes, and pandemics (Institute of Internal Auditors 2008, p. 3). Meanwhile, the key components of business continuity management are management support, risk assessment and risk mitigation, business impact analysis, business recovery and continuity strategy, awareness and training, exercises and drill, and maintenance (Institute of Internal Auditors 2008, p. 3). For business continuity strategies, the Institute of Internal Auditors (2008, p. 3) has identified that the business continuity strategies that can be adopted include the following 1. Manual work processes when computer systems are down; 2. Outsourcing when work can be performed by external companies, competitors, or secondary vendors; 3. Recovery solutions for data; 4. Employment of alternative staffing or mobilisation of other staff members who can perform certain job functions; and 5. Use of alternative facilities. In contrast, the Department of Health of the United Kingdom has a more proactive perspective to business continuity. For the Department of Health of the United Kingdom (2011), the objective of business continuity management is to “counteract interruptions to business activities and to protect critical business processes from the effects of major failures or disasters”. Business continuity management covers “controls to identify and reduce risks, limit the consequences of damaging incidents, and ensure the timely resumption of essential operations” (UK Department of Health 2011). The business continuity model adopted by the United Kingdom Deparment of Health is a 10-point model consisting of the following: 1. Project initiation and management; 2. Risks evaluation and control; 3. Business impact analysis; 4. Developing business continuity strategies; 5. Developing and implementing procedures for emergency response and operations; 6. Developing and implementing business continuity plans; 7. Building awareness and training programs; 8. Maintaining and exercising business continuity plans; 9. Formulating public relations and crisis co-ordination plans and response; and 10. Coordination with authorities. Forrester Research (2006, p. 2) defined business continuity mainly in terms of workforce continuity and defined it as “a strategy that provides for connecting a dispersed workforce to the applications, data, and communications they need in instances where pandemics, strikes, natural disasters, or other events prevent the workforce from reaching a corporate facility”. For Forrester Research (2006, p. 3-4), just like Tammineedi (2010), business continuity involves three phases: business impact analysis, local threat assessment, and business continuity plan development and maintenance. In the Forrester Research’s first phase or business impact analysis, the enterprise must identify the most critical business operations and resources (2006, p. 3). According to Forrester Research (2006, p. 3), the critical resources cover information technology, human resources, business partners, suppliers, and service providers. During the phase of business impact analysis following a disruption or incident, the enterprise must define their target recovery time and recovery point objectives (Forrester Research 2006, p. 4). In Forrester Research’s second phase, the local threat assessment must characterise the organisation threat profile by identifying the specific threats it must protect itself from, including threats like power and network failure. Finally, in Forrester Research’s third phase or the business continuity plan development and maintenance phase, the enterprise must harden its security and must include a strategy for testing, implementing, and maintaining plans (Forrester Research 2006, p. 4). Some organisations view business continuity primarily in terms of minimising risks and improving resilience. In particular, the Dartford Borough Council (2006) defines business continuity management as the task of minimising risks to an organisation or delivery of its services in the event of a disruption. For the Dartford Borough Council (2006), the disruption could be external to the organisation like bad weather, fire, or terrorism. At the same time, the origin of the disruption can also be internal like that resulting from a failure or disaster in the organisation’s system or even in the form of a loss of a key staff member. At the same time, according to the Dartford Borough Council (2006), improving or making the organisation’s resilience is the primary goal of business continuity management. To be good in business continuity management, the Dartford Borough Council (2006) recommended that one must examine the critical processes and resources of a business. The Dartford Borough Council emphasised that the purpose of business continuity management is to restore key business systems and processes within agreed timeframes. It is the notion of “restoration of key business systems and processes within agreed timeframes” that appears to distinguish business continuity management from the normal business management. Related to this, the restoration of key business systems and processes appears to constitute the minimum goal of business continuity management. It is the restoration of key business systems and processes within agreed time frames that constitutes as the critical phase in the restoration of normal business operations. The Dartford Borough Council’s notion of business continuity management emphasises the relation of business continuity management to risk management. According to the Dartford Borough Council (2006) managing risks to enable the continuation of business constitute effective management and is the best way to ensure business continuity. The Business Continuity Model that the Dartford Borough Council (2006) follows involves a five-state process: 1) understanding the business particularly the risks and priorities; 2) developing the business continuity strategies; 3) developing disruption response plans based on the business risk profile; 4) establishing a culture of business continuity; and 5) auditing, modifying, and improving the business continuity plans. Another point of view on business continuity management is from Mason (2007). Mason (2007, p. 11) stressed that business continuity is part of a three-phase response to an incident in which the overall objective is recovery or a return to a back-to-normal operation as quickly as possible. An incident takes place known as a “disaster” or crisis at time zero to which there is an incident response from the organisation. The first stage or incident response must take place within minutes or hours during which casualties must be handled, the damages contained and assessed, and a Business Continuity Program (BCP) invoked. Also within minutes to days, however, the second stage or the Business Continuity Program must take place simultaneous with the ongoing incident response. The Business Continuity Program involves contacting the staff, customers, and suppliers. According to Mason (2007, p. 11), the immediate objective of the Business Continuity Program is to restore the critical business process and rebuild lost work-in-progress. A part of the Business Continuity Program must continue even as recovery or resumption of normal operations has commenced. This is logical because the back-to-normal operations may be proceeding with some of the pre-incident organisational capacities diminished and, therefore, the Business Continuity Program must be able to provide the contingencies for the scenario. The recovery/resumption of back-to-normal operation constitutes as the third stage of the response to the incident. As mentioned earlier, the incident may be a disaster or a crisis. Figure 1. Three main phases involved in business continuity Source: Mason 2007, p. 11 Mason (2007, p. 11) pointed out that for business continuity management to work better, it is important to embed business continuity management in the organisation’s culture. For Mason (2007, p. 11), embedding business continuity management in the organisation’s culture involves a five-step process: 1. Understanding the organisation; 2. Determination of the appropriate business continuity strategy based on an understanding of the organisation; 3. Formulation of a business continuity response plan given various types of possibilities; 4. Implementing, maintaining, reviewing, and improving the business continuity response plans; and 5. Going back to the first step of the cycle to understand deeper the organisation so that the execution of the succeeding steps of the cycle can be improved. On the other hand, Hillenbrand (2007, p. 2) prefers to locate business continuity in relation to disaster recovery planning and pointed out that that there are actually seven phases of business continuity and disaster recovery planning. According to Hillenbrand (2007, p. 2), these seven phases are: 1. Business impact analysis (BIA) and risk assessment; 2. Project initiation phase; 3. Design and implementation phase; 4. Implementation phase; 5. Testing phase; 6. Maintenance phase; and 7. Execution. According to Hillenbrand (2007, p. 2), the complete planning cycle involve in business continuity and disaster recovery planning takes from three months to one year, depending on the size and multiplicity of businesses of an organisation. The Hillenbrand seven stages approach to echoes the Botha and Solms (2002, p. 4-5) similar seven stages approach to business continuity planning involving project planning, business impact analysis, business continuity strategies, continuity strategies implementation, continuity training, continuity testing, and continuity plan maintenance phases. In addition, the Botha and Solms (2002) approach emphasised on the concept of a cycle in business continuity planning during which the details of a business continuity plan should be modified based on experience. In addition, the Botha and Solms (2002, p. 3) concept of business continuity planning considers the endeavour in relation to recovery from disaster and planning for contingencies. One good example of business continuity plan is in Dalton (2007). The business continuity plan covers response or business continuity in the event of a pandemic influenza. It includes a plan on how to prevent panic, how to access antiviral and vaccines, and how work and business can continue in the event of a pandemic outbreak. The plan also covers how communication can be undertaken in case of a pandemic and how food supply can be maintained. One weakness of the plan, however, is on the lack of details. Hopefully, the details of the business continuity plan are in the main documents as Dalton (2007) provided only an overview of the business continuity plan. In conclusion, there are several variations on what constitutes business continuity. Despite variations, however, we can identify a common perspective. The common perspective in business continuity is to continue the basic operations of a business given an incident that can mean to be either a disaster or a crisis. Business continuity is expected to be operative based on a time frame. The ultimate objective of business continuity is to restore normal business operations. In promoting business continuity, some organisations emphasises pro-activeness and anticipation. Others, however, go further and advocate the mainstreaming of business continuity into the organisation’s culture. References Botha, J. and Solms, R., 2002. A cyclic approach to business continuity planning. ISSA Conference Documentation. Available from: http://icsa.cs.up.ac.za/issa/2002/proceedings/A006.pdf [Accessed 10 March 2011]. Dartford Borough Council, 2006. Business continuity. A brochure. Dartford Borough Council: Emergency Planning Group. Dalton, C., 2007. Business continuity management and pandemic influenza. NSW Public Health Bulletin, 17 (9-10), 138-141. UK Department of Health, 2006. Business continuity management. Available from: http://www.igt.connectingforhealth.nhs.uk [Accessed 10 March 2011]. Elliot, D., Herbane, B., and Swartz, E., 2000. Business continuity management: A test of continuity between economic sectors. Risk Management: An International Journal, 27-38. Forrester Research, 2006. Workforce continuity: Keeping people productive during a workforce disruption or disaster. Cambridge: Forrester Research, Inc. Hillenbrand, B., 2007. Lessons from the frontline. Available from: http://www.continuitycentral.com/feature0478.htm [Accessed 10 March 2011]. Institute of Internal Auditors, 2008. Business continuity management. Florida: The Institute of Internal Auditors. Mason, J., 2007. The BCM life cycle. Business Continuity and Risk Management. A Supplement of Media Planet, 12 February. Tammineedi, R., 2010. Business continuity management: A standard-based approach. Information Security Journal: A global perspective, 19 (1), 36-50. Read More