Contingency and continua: achieving excellence through business continuity planning

Business Horizons, Nov-Dec, 1997 by Brahim Herbane, Dominic Elliott, Ethne Swartz

Through the use of "better practices," companies can form holistic and strategic approaches to disaster prevention and recovery and integrate them into their daily routines.

Recovering from disaster typically depends on the integrity of a firm's physical systems, assets, and processes during and after a crisis or disruption. The focus is usually to switch to alternative systems or locations and then return to existing revenue streams as quickly as possible. Not enough emphasis is placed on the human components of organizational protection and what managers can do to ensure greater prevention and protection of the business for the future. Because of an assumption that most disruptions are triggered by systems and hardware failures, the solutions tend to bear similar attributes, with little acknowledgment of the human contribution to both the disruptions themselves and to the implementation of changes to existing systems.

Business continuity planning (BCP) represents a major departure from these traditional disaster recovery (DR) approaches. It is an approach that seeks to assess and prepare for incidents that disrupt all business activities. As such, it has developed from DR methods and their focus on information technology (IT) hardware disruptions, but it covers a much broader scope. A suitable definition of BCP is planning that identifies the organization's exposure to internal and external threats and synthesizes hard and soft assets to provide effective prevention and recovery, while maintaining competitive advantage and value system integrity.

Organizations must increasingly take the view that competitive advantage should be based on a synthesis of both human and physical assets that come together to form part of a company's "unique" or "core" competencies. Such a view lends greater importance to the already critical role played by information systems (IS) and represents one of the most important human/technical interfaces in any firm. Moreover, with a trend toward tightly coordinated and collaborative supply chains in many industries, the protection of IS becomes a strategic concern for trading partners. Despite the best efforts of managers, changing current IS protection may prove difficult because of insufficient knowledge of "better practices" and the problems of changing practices associated with the use and protection of technology that transcend functional and hierarchical boundaries. How, then, do managers undertake the task of moving toward state-of-the-art BCP practices?

This article presents findings from the first phase of a 1996 study of BCP in the UK financial services sector, which includes banking and insurance firms. Although the IRA bombing campaigns on the UK mainland during the 1980s and 1990s highlighted the vulnerability of many organizations to disruption, the devices planted in London were specifically targeted at the high-profile financial institutions located in the capital. The significance of these incidents for the finance sector cannot be underestimated--an observation supported by our respondents, who identified bombings as a key factor in convincing CEOs of the importance of disaster recovery. The respondents, who were interviewed for the study, were executives of six financial firms and one consultant firm selected from a member list of the Finance Sector User Group of Survive!, which is a UK-based, industry-wide business continuity association for disaster recovery. All six of these executives held operational responsibility for the BCP process in their firms.

Valuable lessons can be learned from both successful and unsuccessful organizations as to the important managerial issues to be considered when embarking on such an important transformation. Through learning these lessons, managers can develop the most appropriate methods of implementing BCP--a change that is both essential and inevitable.

BCP and "Best Practice"

BCP adopts a total-systems view in identifying and understanding the often complex causes of business interruptions. As firms develop and grow into new markets, existing systems may not prove suitable for current and future operating requirements. Competitive emphasis might change; so might the human resource attributes of the organization, such as structures, employee skill sets, and training. In combination, these issues present many difficulties when one attempts to identify the potential causes of interruption, the type of response required, and the effects of the incident after recovery.

Transition periods, such as during change programs and reengineering efforts, can also hamper the task of efficient prevention and recovery. The changing nature of a firm's external environment--regulation and legislation, trading conditions, technology--adds further uncertainty and complexity to recovery planning. To this extent, approaches such as Porter's (1985) value chain have been used widely to help companies understand the behavior of cost base and to identify existing and potential sources of differentiation in processes, products, or services. Moreover, such an approach can provide a preliminary yet illuminating understanding of business continuity issues.