Business continuity is an offensive as well as defensive business strategy – so why is so much focus given to the latter? David Honour comments.
When the term business continuity first started to be used, in the mid-1980s, it was very much the province of the business community – hence the name. This remained the case through the early 1990s, but in more recent times, essentially with the advent of the so-called Millennium Bug, the public sector started to turn its eyes towards business continuity. This process has continued inexorably and has brought many benefits. However, one result has been that the vast majority of business continuity thought-leadership initiatives in the 21st century have been public-sector driven. True, the financial sector has also been a huge-player, and other blue chip companies from other sectors have played their part, but such companies tend to be monolithic business structures which often operate more like a public sector organization than a fleet-footed and nimble entrepreneurial smaller business.
The result of the above has been that business continuity management has been largely formed and shaped by and for large organizations. And the result of this has been an almost exclusive focus on business continuity as a defensive / protective strategy.
The common definitions of business continuity management support the above statement:
Business continuity management is:
“An holistic management process that identifies potential impacts that threaten an organization, and provides a framework for building resilience and the capability for an effective response which safeguards the interests of its key stakeholders, reputation, brand and value-creating activities.” (Business Continuity Institute)
“A holistic management process that identifies potential impacts that threaten an organization and provides a framework for building resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities. The management of recovery or continuity in the event of a disaster. Also the management of the overall program through training, rehearsals, and reviews, to ensure the plan stays current and up to date.” (Disaster Recovery Institute International)
The focus is on building resiliency and response mechanisms with the aim of *safeguarding* stakeholders and key aspects of the business.
However, there is another aspect of business continuity management which has been neglected and which returns business continuity to its roots. This is business continuity as an offensive strategy; as a competitive strategy. This is where business continuity is seen not just as a way of protecting and safeguarding the business; but it is seen as a way of growing the business. As such it is a very strong lever for gaining executive board buy-in and for supporting budgetary claims.
There are two areas where business continuity can be used as a competitive strategy: pre-disaster and post disaster.
In a commercial world which is increasingly becoming aware of the need for business continuity; having a top-quality, tried and tested business continuity management structure in place helps your company stand out from others. This will become an even stronger competitive advantage over the next few years as business continuity standards take hold around the world and their associated accreditation schemes highlight those companies that have taken business continuity seriously. The time may come when companies will only be able to do business with the public sector, for example, if they can show that they are accredited to a business continuity standard. If this happens companies that are prepared NOW will gain a strong advantage over their competitors who are trying to play ‘catch up’.
Another non-disaster related benefit of business continuity management is that it can help to create a business which operates its systems to the optimum level. As highlighted in the definitions above, business continuity management involves creating resilient businesses; companies that are flexible and which can quickly identify and respond to challenges and threats. However, resiliency is not just a benefit in times of disaster. Resiliency can provide day-to-day business benefits; with hardened systems failing less often and production returning more quickly from day-to-day glitches than would be the case in less resilient businesses. In other words, business continuity management is about optimizing process availability; and this enables businesses to operate to maximum efficiency at all times.
The company that successfully operates a true business continuity management culture will have systems that are more effective; more efficient; more fully utilized than their competitors. Such a company will be able to maximize the return on investment it makes in business processes. It will be more productive, more reliable and an excellent partner and supplier. When it sets a deadline it will meet it. When it undertakes a project, it will deliver on time and on budget. In this way, business continuity management becomes necessary not because it means you will survive into the distant future; but because it will make you a better and more competitive business today.
It is well documented that an effective disaster response can help a company’s share price to increase and its reputation to become stronger. The definitive study in this area was carried out by Knight and Pretty (‘The impact of catastrophes on shareholder value’, 2000).
However, beyond this advantage there is another, more entrepreneurial, competitive advantage. The business that recovers most quickly from a wide-area disaster is the business which is able to capitalize on the situation. Disasters create new markets and open up existing ones. This may allow the rapid development and launch of new products (see http://www.continuitycentral.com/news02994.htm for a good recent example of this). Or, if your products and services are available when a competitor’s aren’t, you can gain temporary market share, which may become permanent if your products and services are at least as good as your competitor’s. Weakened competitors can be weakened further by effective business continuity coupled with good marketing.
That may sound cold-hearted and ‘against the spirit of business continuity’. But business is about competition. It is about being one-step ahead of the competition. It’s about building your company to be better and more capable in what it does than others around it. Business continuity can be one tool which enables you to do this.
Make a comment
David Honour is editor of Continuity Central.
Excellent article. In my DR/BC planning practice, I am continually distinguishing the difference between DR and BC to my clients, large and small. All see value in insuring that their technology environments are protected with a viable recovery schema. However, when one asks, “What are you going to do with your folks and their business process when the building burns down,” there is generally a long silence. As you so aptly pointed out, having a thoughtful plan provides shareholders the notion of security for their investment, and attributes to management that they are aware of the problem, concerned about the firm’s employees and have taken steps to protect shareholder’s value. A formidable competitive advantage in this day and age heightened threat. Please soldier on with additional articles like your recent one; I think any DR/BC professional should help his or her client to see and understand the full picture, and articles like yours assist this process.
Noel Castleman – CBCP
In response to the question "Business continuity is an offensive as well as defensive business strategy - so why is so much focus given to the latter?" It is very evident being introduced to disaster recovery planning in the late 1970s and contingency planning in the mid 80s that the promotion and commercialism in the continuity profession was always reaction. Listen to the words that are always talked about - notification, response, recovery, restoration, alternate sites, incident management, emergency response, etc. When was the last time in a board meeting or CxO meeting that the word continuity was used as a business solution to gain market share, streamline business functions, or acquire a competitor?
Exactly the point, hardly, if at all. We in the continuity profession are always reading information dealing with disaster, preparing for the incident that will happen some time in the future. Getting information from vendors and consultants that talk about preparedness, scenario planning, alternate sites, contacting those who you need when you need them, RPOs and RTOs. And then attending conferences that indicate that we, the professionals, should be talking with management about proactive approaches for preventing or mitigating incidents while planning for and implementing workforce contingencies.
I have yet to hear a consultant in 32 years tell me that by using business continuity management as a business benefit, the business will get a better return on investment, will be able to increase revenues, will finally streamline those business operations that are outdated and will be able to manage the data more effectively while cutting operating costs.
I believe that business continuity can be used to provide day to day business benefits, but I also believe that the continuity industry as a whole has to change and focus on promoting those business benefits. Until change happens in our profession, we will still be focused on selling defensive strategies.
Steve Schulze, CBCP
Excellent article and a great question to defreeze the mind of all the business continuity professionals around the globe. It's the same old story of moving from a reactive approach to a proactive approach. Why do organisations need to be prepared? What good could an organisation bring to its balance sheet at the end of the year if business continuity was done as per the expectations? And the point that all business continuity professionals make: how does my CxO see benefit coming out of business continuity strategies if an incident does not happen?
It’s interesting to know that we all try to convince management by saying that if you do business continuity, it will make the organisation better placed amongst the competitors. Do we all know who these competitors are? Are we able to quantify or equate the word competitive advantage to the dollar amount and present this to management? Do we know what business continuity strategies the organisation's competitors have put in place? Does this reflect in the annual review with our management? If we can answer these questions and ensure that management is aware of the opportunities that will come their way during the time of crisis the business can be in a better position in a pre- as well as post- crisis situation.
A case study around this could be:
"I buy Product A, let’s say a mobile phone from a telecoms company. This company had thought of building resilience into the product but had not known how their competitors had thought of building resilience into their product. The business continuity specialist for this company had a hard time convincing the management to build the resilience into the infrastructure because the management considered it to be an overhead expense. While using this cell phone I realise that the instrument doesn't work that well when used for long duration calls. I, as consumer of the product, live with it until I come across a friend of mine who has a cell phone which works absolutely fine when exposed to the problem faced by my cell phone. I prefer to change the product and use the other company's cell phone, called Product B. The manufacturer of this cell phone had known where his competitor's might be lacking and hence built enough resilience into the product. As they say the fire spreads and there's news in the market that Product A cell phones are bad and don't work well in long duration calls. Product B now sells like hot cake and generates a lot of ROI"
The moral is that the business continuity specialist for the organisation pioneering in Product B was more aware of the company's competitors and was able to show an increase in the dollar value amount to the management when the product was being designed. This comparative analysis helped the management to take a decision to build a product that can outshine all others.
It all depends on how far the vision of a business continuity specialist can go and how far the organisation is ready to think. My suggestion is to try to equate all the factors to a dollar value and show the positive numbers to the management. No one would want to make a product that doesn't work but are we able to show the management efficiently that if we don't build resilience right now, our competitors might outshine us and we can be out of business? That's one thought that would scare any CEO of the company. You would then find a business continuity review happening every quarter and follow ups also happening regularly. That to me would be the journey from being defensive to offensive and aggressive.
Sachin Dutta, ABCI
Fidelity India Risk Oversight – BCM
I would only agree with the author that unless the ‘business’ realises the value and the need for BCM as an enabler and not as a cost, the money spent on BCM is primarily driven and mandated due to regulation more than a strategic advantage! It is only a matter of time when BCM compliant companies may be preferred against others in the vendor selection process itself.
Excellent article; for some time I have promoted the commercial benefits of business continuity. I have two major clients who have attested to the fact that their robust business continuity planning was a key factor in winning major tenders.
In promoting the benefit of BCP I also get away from using the term 'disaster'. The word is entirely negative, means different things to different people, and the whole purpose of business continuity planning is to PREVENT a crisis turning into a disaster. The following quote, taken curiously from a women's magazine sums it up; "there is no such thing as a disaster; it is merely an inconvenience that can be resolved with a little patience and understanding"
Ben Thomas, MBCI
John Dawes, the captain of the British Lions Rugby Team quoted in 1971 before taking on the All-Blacks – ‘Get your retaliation in first' the message being :'do unto to them before they do unto you!!' and in essence, the proactive facet of BCM is exactly that!
As you so rightly say in your article, the focus has been about reaction, and really emanated from the DR approach of the early IT days - big beasties ticking in an IT room. The responses are well documented and the timescales etc appropriate for the time - however time has moved on and the dependencies on the core business components of people, ICT Technologies/ Applications, Workplaces and most importantly everyone's expectations of 'always available' means that classic recovery as a component of BCM is only just appropriate for some of the business's requirements.
As for the majority of the key business processes, loss there-off is just plain unacceptable as with one click/one call the client is 'long gorn', possibly for ever as the loyalty factor is almost a custom of the past!!
So, if the board is going public to demonstrate the governance controls the following proactive actions, as components of the BCM programme should be underwritten:
* Succession planning for key personal;
* Loss controls in place for all key buildings/complex's/technologies;
* Critical business processes and key depedencies identified and documented;
* Escalation procedures and decision criteria to move from business-as-usual controls into the exceptional BCM controls created and exercised;
* Company-wide understanding of all the above;
* Inter-linked to the reactive components of the BCM programme.
In conclusion, preparation is all, as in John Dawes quote, gaining the team’s support and understanding of the overall objective ensures the value of the proactive elements of BCM.
Mike Mikkelsen FBCI MCMA
Redan International Limited
•Date: 12th Jan 2007• Region: World •Type: Article •Topic: BC general
Rate this article or make a comment - click here
UPDATED 25TH JANUARY