Business continuity is much more than making plans to deal with disasters and disruptions. It’s now an integral part of a broader resilience effort—not just during a crisis, but continuously, through all the ups and downs of normal operations.
For many business professionals, if you ask them what business continuity is all about, they’ll likely say it’s about plans and disruption response.
And while that’s a part of it, most successful business continuity programs have a much broader mandate. Today’s business continuity programs involve a combination of capabilities—mitigation, response, communications, and recoverability—that tightly integrate with your organization’s goals and objectives, and when taken together, deliver operational resilience.
Today’s business continuity programs involve a combination of capabilities—mitigation, response, communications, and recoverability—that tightly integrate with your organization’s goals and objectives, and when taken together, deliver operational resilience.
Beyond being equally focused on decreasing disruption frequency and responding effectively, another pivot from traditional business continuity is focusing much more on the effect of disruption on your customers’ needs and expectations, the effect of disruption on the broader market, and relationships with third parties.
Further, effective business continuity actually evolves into operational resiliency when you also shift your thinking away from probability—will we experience a disaster or disruption?—to an approach that concludes disruption is inevitable.
Evolving From ‘If’ to ‘When’
As we’ve seen during the COVID-19 pandemic, where many organizations had to respond to more than one incident simultaneously, increasing threats across all vectors mean we now need not an “if” approach to continuity but a “when” approach.
This shift in focus is a tenant of operational resilience, both short- and long-term.
And modern supply chains are no longer just about compliance, which often takes the form of asking for surveys on business continuity activities. As our customers’ demands and expectations for services and delivery change, we need to look past business continuity planning as indicators of capability and instead employ processes that ensure third-party performance guarantees and capabilities that feed into your organization’s overall operational resilience.
Of course, no amount of business continuity maturity ensures we can predict or react favorably to every threat we may encounter; however, the most effective business continuity programs are based on horizon scanning, risk assessments, business impact analysis, strategy determination, planning, training, and exercising to make operations as bulletproof as possible.
Just to be clear, risk assessment is not singularly focused on identifying threats; rather, it’s the search for the hidden cracks that could lead to an increased frequency of disruption or unacceptable consequences.
Hidden cracks may be single points of failure or a lack of recoverability. Regardless, risk assessment outcomes include identification of capabilities to decrease disruption frequency, as well as improved capabilities to ensure recovery objectives are met.
Operational Resiliency Thinking
The introduction of operational resiliency thinking not only advances business continuity practice, but it also addresses many of the issues the COVID-19 pandemic exposed.
Operational resilience thinking introduces and emphasizes adaptability, as well as capabilities to look well beyond the next day, week or month. This philosophy emphasizes looking further ahead than we often did in the past, to address issues if a disruption persist for months—or longer.
Another important connector between continuity and resilience is the unification of teams throughout your company. Specifically, it’s about organization-wide engagement and buy-in, leading to the creation of a culture of continuity or resilience.
Traditionally, many organizations are structured around siloed data, tasks, and departments, which has long hindered preparations for an effective response to disruption, as well as prioritizing closure of the most strategic “hidden cracks.” Breaking those barriers—from the executive level down to employees responsible for day-to-day process execution—helps meet resilience objectives.
But you can take this one step further.
Operational resilience emphasizes the end-to-end, with some fairly significant points of emphasis. By expanding your business continuity program to address product/services and also the markets in which you operate—as well as customers, delivery channels, and supply chains—you are better positioned to prioritize issues that get in the way of the right level of resilience.
Having a picture of the end-to-end helps prioritize improvement opportunities and better respond to disruption.
For example, when you’re evaluating your most critical operations as part of your business impact analysis, if you establish a connection to your products/services and customers, it can give you better understanding various critical paths, and key points of failure end-to-end. By understanding the end-to-end—and identifying and optimizing mitigation, response and recovery capabilities—you’re essentially engineering resilience into your organization.
Pairing the strategic nature of operational resilience with business continuity offers an opportunity to connect the strategic and tactical. The knowledge gained by pairing these efforts also creates better business cases to invest in resilience because resilience gaps easily map to product and services, as well as customers and marketplace.
Measuring resilience based on customer pain and product/service availability also resonates much more powerfully with senior leaders when compared to measuring by the readiness of processes and resources.
Days of simply performing business continuity tasks, or documenting business continuity plans to meet compliance expectations, are long gone. Today, to ensure true operational resilience, we must evolve to focus on measuring key risk indicators and addressing gaps that stem from this more strategic form of measurement.
Now is the time to have meaningful conversations about ratcheting up the strategic nature of disruption preparation.
