Business Continuity Management Issues - Essay Example

Business Continuity Management (BCM) has evolved over the years from what was earlier known as Disaster Recovery or Risk Management. Herbane (2005) acknowledges that BCM was evident since the time of cave men; though the extent and degree to which its implemented varies. In the current scenario recovery is insufficient and the goal is continuity (Hecht, 2002). In the 1990s, Disaster Recovery was mainly associated with Information Systems but BCM stretches far beyond this. As the name suggests, BCM means business should continue despite calamities or breakdowns. This study will evaluate the events or the reasons, which led to the businesses seeking more than recovery of data; it will highlight the key elements that differentiate BCM from Disaster Recovery. Recovery implies to recover something that has been lost; the recovery may be in part or in full. Continuity, on the other hand suggests business carries on as usual and the impact of failure may be minimal, if at all. BCM deals with the threats that confront any business. Insurance may cover the cost of the fixed assets but cannot cover the opportunity loss or the market share that any business may lose (Smith 2002). The September 11 terrorist attack on the US, the cases of Anthrax virus infiltrations, frequent hackers breaking into the corporate systems, and natural disasters like Tsunami and Hurricane Katrina, may capture the headlines, but almost 90% of the crises are “quiet catastrophes” according to Smith. It is these catastrophes that damage the organization’s brand and reputation. Research too indicates that the shareholder price value increased of those companies who managed to successfully handle the crises compared to those who could not handle the situation well. In 1989, a large volume of case studies were published, covering mostly crises that had occurred in the 1970s and 1980s. Throughout this period, as the two fields gradually consolidated, the formation of three mindsets was developed. Namely, the technology mindset during the 1970s, which was limited to assuming that crisis, was initiated solely to computer systems and facilities. Moreover, in the 1980s organizations adopted an auditing approach which was broader in scope but did not comprehend the full picture. The inauguration of the following decade saw the development of the value based mindset, which is concerned less with compliance, regulations, or technology failure than with the needs of the business itself. The success of a company lies in its ability to continue business despite the catastrophes. The BCM gives the company a competitive advantage and is in fact being included as a standard term in contracts. BCM cannot eliminate the causes of the events but can control the effects of the events and assures recovery from disaster (ICFAI, 2006). According to the research firm Gartner, 40% of the firms struck by disaster would go out of business within 5 years. Hence, BCM is absolutely necessary and its importance can be understood only when the disaster strikes. Business continuity deals not merely with recovery but the ability to manage the situation and restore normalcy. Disaster recovery has become proactive, which prepares the company and its people to avoid any interruptions and continue functioning normally. The events of September 11 have forced the corporate executives to reconsider their continuity plans. The globalization, e-commerce and cyberspace scaling new heights everyday, new corporate collaborations taking place, increase in the pace of business activity, and the international political risks, send warning signals to the CEOs to scrutinize the threats including the continuity of business (Alonso and Boucher, 2001). Slow reaction cause longer downtimes, which companies can ill afford. Losses mount as downtime increases. Businesses had become cautious even after the 1993 attack on the WTC and the preparations made for the Y2K. Hence, many companies during the September11 disaster could prevent critical data loss (Alonso and Boucher, 2001). September 11 emphasized that businesses needed formal preparations in place, whatever be the magnitude, and whatever the chances of any disaster (ICFAI, 2006). At the same time this incident also demonstrated that although high impact, low probability events could occur, recovery is possible (Public Safety and Emergency). Buildings were destroyed and blocks of Manhattan affected, but businesses with good continuity plans managed to survive. This endorsed the efficacy of BCM and more companies realized the urgency. The learning outcome of this disaster included plans must be regularly updated and no threat ignored; telecommunications are essential and alternate sites for IT backup should not be situated close to the primary site. The Business Continuity Institute (2006) states that effective BCM is built on seven P’s – program, people, processes, premises, providers, profile, and performance. The Institute has developed a five-stage BCM process, which has been widely accepted and incorporated into a British Standards Institute Publicly Available Specification (PAS 56). The five stages include understanding the business (assessing probable risks), formulating BCM strategies, developing and implementing a BCM response (response to challenges), establishing a BCM culture (continuity culture in the organization), and maintaining and auditing BCM (ensuring the plans are regularly updated conforming to the changes taking place in the organization). With risks mounting on a daily basis, even the BCM has to be a continuous process. Plans formulated could be either generic in nature or specific. The generic plans are core plans, which encompass a wide range of possible disasters. Specific plans on the other hand relate to specific risks, sites, or services. Risk identification is a crucial area because this helps the organization to focus its resources in the right direction. In today’s contemporary business society the propensity of risk is immense and disasters can commonly result in an organisation’s demise. According to a study carried out by Deloitte and Touche (2004) the likelihood of a disaster occurring is 66%. Of this proportion, a further 19% of companies have suffered a disaster that caused their organization to cease operations for a significant period. Therefore, the need to instigate BCM is essential, to overcome predetermined or unforeseen risks. In spite of this BCM have been for the most part, overseen or at best inefficiently utilised by business strategists as only 50% of companies have implemented business continuity plans. The chief executive of the Business Continuity Institute states, “the damage to reputation from a mishandled crisis can diminish profits and market share”. The risks that have led to the evolvement of BCM have been classified as low, medium or high risks (Recovery-Disaster.info). A disaster is an occurrence that disrupts the normal functioning of the organization due to loss of data or loss of personnel. Loss of data can be intentional or accidental; it could also be the means by which data is transported or presented. Corruption of programs or network can upset the normal working schedules. Bombs or natural disasters need not necessarily cause this; it can be caused by a small hard disk erasure within the organization. Anything that interrupts the normal working of a company is a disaster. The RMJ Journal (2002) reflects that the bank risk managers too reassess business continuity risk strategies at both the operational and the credit risk levels. The banks have always played a leadership role in continuity planning by providing emergency financial assistance including funds to disaster areas. They shared the best practices in developing the Y2K plans. They demonstrated the elasticity of the industry in the aftermath of September 11. Despite these, banks are under pressure to re-evaluate their continuity plans due to recent global events, new business and service delivery models. Besides, companies are increasingly opting for service providers and vendors. The first step in re-evaluation is to determine how current the contingency plan is. The biggest challenge to the banks is to maintain the continuity plan on a relevant and current basis. At this point corporate culture plays a vital role. A comprehensive continuity plan improves reliability in operations as even small vendors run the risk of losses. Large corporate houses are dependent on small vendors and it is equally important that such associates too have BCM. No company can rely upon outdated methods. The technology infrastructure has to be examined and updated. Some companies began to look at recovery times in terms of minutes and hours as opposed to days. Recovery technology emerged, with products such as electronic vaulting and remote mirroring. Many large companies examined investments in redundant facilities. Regulations relating to business continuity increased, primarily in the financial services industry. Further, Y2K activities helped companies focus on the vulnerability of reliance on third-party vendors and suppliers. Modern management techniques use outsourcing which has helped to boost efficiency. A reduced headcount and less surplus stock invariably lessen the financial burden for many organizations. It may be noted that outsourcing increases dependency and the use of these techniques also reduce our ability to absorb the effects of any disruption. Thus, the importance of BCM cannot be ignored. Formulating strategies is not sufficient. Regular audits and upgradation can protect a company from being taken off guard. References: Alonso F & Boucher J (2001), Business Continuity Plans for Disaster Response, The CPA Journal, < http://www.nysscpa.org/cpajournal/2001/1100/dept/d116001.htm> accessed 27 January 2006 Business Continuity Institute (2006), Business Continuity, UK Resilience, < http://www.ukresilience.info/preparedness/businesscontinuity/index.shtm> accessed 27 January 2006 Hecht J A (2002), Business Continuity Management, Communications of the Association for Information Systems, < http://cais.isworld.org/articles/8-30/default.asp?View=Journal&x=73&y=4> accessed 27 January 2006 ICFAI (2006), Business Continuity Planning - Concepts and Cases, ICFAI University Press, < http://www.icfaipress.org/books/Busi_Cont_Planning_ConceptsCases.asp> accessed 27 January 2006 Public Safety & Emergency (2005), Catalogue No. D82-37/2003E-IN, < http://www.ocipep.gc.ca/info_pro/self_help_ad/general/busi_cont_e.asp> accessed 27 January 2006 Recovery-Disaster.info (n.d.), Define Disaster And Disaster Recovery, < http://recovery-disaster.info/?gclid=CLuhn-Ha6YICFQo6GAodiERjYA> accessed 27 January 2006 RMJ Journal, The (2002), Business Continuity Planning: A risk managers agenda for operational and credit risk management, < http://findarticles.com/p/articles/mi_m0ITW/is_6_84/ai_n14897077/pg_2> accessed 27 January 2006 Smith D J Dr (2002), Business Continuity Management: Good Practice Guidelines, < http://www.ccep.ca/bci/introduction.pdf> accessed 27 January 2006 Read More