Way back, in the early days of Business Continuity (BC), we struggled to distance BC from Risk Management. One of the main battles was over Scenario Planning. We fought long and hard to replace Scenario Planning with what is now known as the All Hazards Approach. In principle, it doesn’t matter what the cause of the disaster is, it’s the impact of the disruption that will determine how quickly business operations will be restored and hence, we shouldn’t write threat-based BC plans.
I thought the battle had been won, on the BC side at least, so imagine my surprise to find that not many other BCM practitioners think like me. This became evident to me at the Linus Chairman’s Breakfast seminar on August 21st.
A message from the Chairman of the BCI
David James-Brown, Global Chair of the BCI, delivered a presentation that, in part, summarised the BCI Horizon Scan 2015 Survey Report. This Report consolidates the assessment of near-term business threats and uncertainties and is used to inform BC planning assumptions for the year ahead.
Challenging BC norms
As a follow-on to David’s presentation, I challenged the underlying principle of the Survey Report, which suggests that BC practitioners should drive their organisation’s BC capabilities and plans in direct response to the reported threats, emerging trends and uncertainties. To me that sounds risky – the Survey doesn’t guarantee that the threats identified are the only possible cause for your organisation to suffer a significant disruption. There are other causes that you can think of, and of course, there are the black swans – the ones you can’t think of.
The All Hazards Approach
My Soap Box presentation included research on a BCM definition of All Hazards. I was disappointed to find that all definitions I found were structured for Emergency Management usage. Looking at the BCI GPG, ISO22301, NFPA 1600 and other references highlighted the difference between Risk Assessment and Business Impact but the underpinning philosophy of All Hazards was missing.
To be clear, I absolutely support the philosophies of BCI GPG and ISO22301, etc. However I feel the practitioner would have far greater clarity about these philosophies if it was underpinned by a clearly articulated definition of All Hazards. I presented the following three definitions as examples and while we all agreed the wording needed some finessing, I believe there was a general consensus that there is benefit and merit in promoting All Hazards for BCM.
The three definitions I offered were:
- An infinite number of threats result in a finite number of impact-driven continuity strategies.
- More detailed version: An infinite number of realised threats (i.e. incident) will cause a finite number of resources to become unavailable, resulting in operational disruption. The response and recovery model for restoring those resources and continuing business operations is driven by the impact of the disruption and not influenced by the cause of the incident.
- Adaptation of a definition by Bruce Esplin : The ‘all hazards’ approach to Business Continuity Management involves a recognition that all realised threats cause similar disruptions and that many of the capabilities and procedures required to deal with disruptions are generic.
I welcome your thoughts and suggested wording. If there is enough of a ground swell, I’ll take this to the BCI and ISO for consideration.
Linus joins the Business Continuity Institute Hall of Fame
Following the Chairman’s Breakfast on the 21st of the August, the annual BCI Australasian Awards were held in Melbourne.
For the third year in a row, Linus won Continuity and Resilience Provider (Service/Product) of the Year for Linus Revive Business Continuity Software. Following this outstanding achievement, Linus is pleased to announce that we have been invited to join the Business Continuity Institute Hall of Fame, which recognises those individuals or organisations who have excelled within the global Business Continuity community.
Linus will be inducted into the BCI Hall of Fame at the BCI Global Awards Gala Dinner in London on 10th November 2015.
Our award-winning Business Continuity software, Linus Revive, provides you with everything you need to respond and recover from any disruption, covering all aspects of the BCM Lifecycle.
To learn more about how your organistion can holistically manage your BC processes, contact the Linus team today.
1 Horizon Scan 2015 Survey Report – Business Continuity Institute and BSI, P5
2 Victorian Emergency Services Commissioner 2000 – 2011