The chicken or the egg?

What came first: business continuity or crisis management? It is similar to the centuries-old conundrum of the chicken or the egg. The following article is not a definitive answer to the mystery of ‘dark art’ business continuity (BC) paradoxes. It forms purely an argument, observations and experiences built up over many years; a simple starting point, offering a viewpoint providing ‘food for thought’, an opportunity for reflection and for a considered and balanced application of BC to individual working environments of the readership.

Case study

As an example, I am using a business to demonstrate individual perspectives providing a somewhat reflective exercise, with an underlying question as to whether it could be symptomatic across the UK. Maybe I will let you decide.

I arrived at a meeting and signed in. I was offered a welcome coffee and then the fire alarm went off. Now I was standing outside in the cold.

I was surrounded by several people drinking coffee and updating #whatsbook with the latest events of their lives. I asked a guy without a mobile phone whether this was a regular event and he said about a month ago a disgruntled employer smashed a call point and we have regular fire drills.

The evacuation was well-rehearsed, staff wearing fluorescent jackets with clipboards ticking off names and after 15 minutes we were allowed back into the building to resume our duties.

I signed back in (nice touch) when the premises manager wearing a new bright yellow surcoat with ’Observer’ clearly visible, introduced himself. I was ushered into his office and offered a second cup of coffee. On his desk lay a comprehensive compilation of fire risk assessments, health and safety risk assessments, and supporting documents to support my assumption of compliancy with statutory legislation and regulations.

As I feared, the drill was for my benefit.

However, what had been demonstrated to me during the first 30 minutes since my arrival, albeit very impressive, was not what my client had commissioned me to assess.

I had to ask him, do you have a premises business continuity and/or crisis management plan should the building become un-occupiable, as a direct result of a real fire or similar event?

When you say business continuity what exactly do you mean? To which my standard response was ‘the capability of an organisation (in this case your premises) to continue delivery of products and services at acceptable predetermined levels following a disruption’ (Business Continuity Institute – Good Practices Guidelines 2018).

How many of the readership considers that this is an unrealistic scenario?

My client had commissioned me to look at business continuity and ‘what if’ scenarios and make an initial visit to undertake a temperature check and provide written feedback of outcomes and recommendations.

The premises manager to his credit was calm and collected, whilst I was drinking more coffee, he did produce a BC premises plan and task sheets.

However, it did not truly reflect the business, occupancy, design of the building, or current services; there was no audit, review, exercise, training or validation, with limited response team actions; and there was a telephone contact list which was out of date (people had moved on in five years).

The building was ‘critical infrastructure’ providing a call centre on the third floor, accommodating 120 staff with seven separate business functions and 24/7 access. The fallback premises in case of an event was sold off two years ago; no one thought it advisable to seek an alternative or in fact inform anyone.

My verbal feedback to the client was regrettably comprehensive, using the well-trusted model of asking what happened, what went well, what went wrong, what would you do differently?

What would you do?

The whole ethos of my business is ‘Simplifying Business Continuity Complexities’, dispelling the myths of BC being a dark art.

There are synergies between all risk-assessment processes, whether that’s fire or health and safety or business continuity or threat assessments; they do not differ enormously and there is an opportunity to join them all together, be open minded and form a Joint Risk Assessment of Business Services, Products and/or Activities – an end-to-end process.

All business have or should have a risk register (or suitably named alternative) included within the ‘live’ document. This should be ‘all-risks’, even business continuity, joining all the workstreams (or dots) together, continually thinking outside the box and of reasonable next steps to mitigate overall risks to business functions. It’s that simple.

It’s no good your supply chain ensuring a second supplier of Mrs Miggins’ widgets in a critical process if you have no plan for an alternative building if compromised, or having an effective and well-rehearsed fire evacuation, which by the way is a BC exercise, if you have no fallback premises or actions if it was for real.

All risks should be mitigated risk, as they could result in loss of reputation, contracts, business failure and possible closure – money and livelihood!

To have three individuals or providers doing separate risk assessments and not talking to each other, with no feedback to risk management processes, makes no sense at all.

If you only learn one thing from reading this article, then identifying your ‘single points of failure or red bus individuals’ is a good start!

What did we do in the premises example above?

My client had already preempted my feedback, it was no surprise, which made the situation manageable. Doing self-assessments, initial checks and interviews with seven function leads was not a quick process. It was time consuming, not cost effective and thankfully rejected as an option.

My client had already scheduled a meeting with all concerned to take place the next day. Ideal, meeting hijacked. Emails recirculated with a brief amendment to the original agenda, i.e. ‘consideration of business continuity within your service function and across your teams’.

The next day, the whole of the meeting was centred on business continuity and crisis management, a Tactical Decision eXercise (TDX) based on my initial scenario of ‘we have lost the building due to a fire and you cannot return for a minimum of one month’.

Some managers read the email and came prepared, others were totally oblivious.

The TDX provided high-level answers to specific critical questions and you can underestimate the power of the exercise by getting the right people sat around the table with no emphasis on blame.

The outcome of the TDX is way past my word count for this article; I could write a small book.

What do you need for a Tactical Decision eXercise (TDX)

Simple and easy: a comfortable working environment, a goal, aims and objectives, a scenario, the right players, a facilitator, a white board, a scribe, tea and coffee and a hot debrief.

Exercise, exercise, exercise: examples can be to problem solve (in this case), develop, evaluate, validate, test to destruction, assure, check compliancy, an exercise is only limited to the imagination of the organiser(s).

Statutory responsibility

There is currently no statutory requirement to undertake BC or crisis management, but I can argue that Fire, Health and Safety legislation is BC, and that the whole Emergency Services sector is one big very successful BC planning process. The private industry has a lot of learning to do to catch up, and this is where transferrable skills can play a significant part, especially within a business crisis management situation – training, exercising and validation to name a few.

Just some side questions to reflect on when individual businesses or organisations tender for contracts: How many times have you been asked if you have a BC plan? Was your BC plan tested in the past 12 months? If you have, was it a tick in the box? How do contract companies know if it’s a good or bad plan? What training have they had on BC? What training have you had?

At network meetings, I chat to Financial and Insurance institutions, a very interesting sector. Although the sectors suggest that, when dealing with customers and clients as part of the initial process, BC is discussed, it’s not a mandatory requirement, just a recommendation before lending to or insuring a business. I consider this to be a gap or missed opportunity, I am not an expert, but if I was lending or providing insurance to an organisation or business, I would probably insist on a validated BC plan. After all I would have one eye on a return on my overall investment.

There are experts more informed than me, so it might be an idea to revisit your financial and insurance providers to reassure yourself that what you would consider as reasonable (i.e. loan, key person, share, life or business-interruption insurance) is suitable and sufficient to cover a business continuity event.

Whatever your role within your individual sector or working environment we are all BC practitioners in our own right one way or another. Just remember that and you can influence areas providing expertise by thinking outside the box.

Business Continuity is not a dark art and should be simplified to make it easier to practise, and the simplest way would be to join the dots.

BC planning and crisis management is only limited to the imagination of the individual practising it.

‘The only thing harder than planning for an emergency is explaining why you didn’t when that day comes’

This is not an academic paper, it’s just me trying to simplify and get the readership to reflect and I’m sure that there are BC practitioners banging their keyboards, but if you just reflect, think that maybe it could be me and proactively do something about it, or say I have already got that covered, then this article is a success for me.

Simple summary

In my simplistic viewpoint, business continuity and crisis management are the sum of the whole parts of the same chicken.

However, the ‘chicken or egg’ paradox was first proposed by philosophers in Ancient Greece to describe the problem of determining cause-and-effect. Now, a team of physicists has shown that, as far as quantum physics is concerned, the chicken and the egg can both come first. (‘University of Queensland’, September 4, 2018)

For further information, go to www.businesscontinuitysimplified.co.uk