We Just Did a BIA and Risk Assessment… Now What?

How to Perform an Effective Business Continuity Gap Analysis

Following a business impact analysis (BIA) and risk assessment, best practices indicate that an organization should identify business continuity strategies that allow the organization to treat risks and recover business activities in accordance with management-approved requirements. This seems like a simple task on paper; however, in practice, many organizations struggle to do this, and instead jump straight to documenting business continuity plans. In doing so, these plans fail to include the resources and strategies already in place, or the organization fails to acknowledge and address coverage gaps. This leads to a lost opportunity to identify new risk treatments or recovery strategies, ultimately resulting in plans with no real capability to respond and recoverContinue reading

I’ve Been Assigned Executive Responsibility for Business Continuity – Now What?

15 Key Questions Executives Should Ask to Better Understand the Program’s Current-State and Next Steps

So, you’ve just been assigned responsibility of your organization’s business continuity program.

I’m sure many thoughts are running through your head right now, ranging from “What is business continuity?” to “What do I need to do first?” (among others). However, you’re in the right place to find answers to these questions, and many more. Continue reading

Ebola – What Business Continuity Professionals Need to Know

You’ve all seen the news – the sometimes (perhaps often) inaccurate and exaggerated presentation of ‘facts’ and race for ratings has started. We’re by no means downplaying the seriousness of the situation – Ebola is extremely serious and should be treated as such. However, causing panic isn’t going to do anyone any good. Rather, a focus on knowledge building, preparedness, and communication with stakeholders, senior management, and employees should be your top priorities right now.

As such, the sole intent of this article is to provide guidance on what actions business continuity professionals should be taking at this point, as well as resources to better understand the situation. Continue reading

Risky Business (Part 1): Managing Third-Party and Supplier Risk

Business continuity planning is inherently cross-functional with a necessity to address risks to an organization’s product and service offerings, as well as the resources necessary to meet obligations.  As organizations increasingly rely on a global network of suppliers and service providers, business continuity practitioners have the responsibility to understand and analyze these relationships and lead strategy identification efforts to protect their organization when faced with a third-party disruption.

Developing and implementing business continuity strategies and risk treatment options related to third parties can be a difficult endeavor because strategies may seemingly contradict an organization’s strategic efforts to leverage single-source suppliers, make supply chains “lean”, and reduce stored inventory levels. However, business continuity practitioners must provide top management with the information needed to balance strategic initiatives with the need to reduce single points of failure and protect an organization should a resource become unavailable.

This perspective discusses the tools available to identify and document third-party resources and methods by which risks can be presented to top management for review and action. Continue reading

Leading Response and Recovery Teams (Part 1)

In our experience, one of the most difficult roles to fulfill in any business continuity program is the team leader responsible for a cross-functional response and recovery team (often called a crisis management team, a department business recovery team, or an IT disaster recovery team).  This is because the team leader faces three significant challenges:

  1. These teams are cross-functional, which means every person brings their expertise, as well as their opinions and personal agendas for response and recovery; Continue reading

What is Business Continuity?

Business continuity means working to decrease the likelihood of a disruptive incident and preparing your organization to continue the delivery of its most essential products and services if a disruption were to occur.

In other words, in the event of a disruptive incident, business continuity helps ensure that everyone – from response personnel through the general employee population – can answer these three questions: Continue reading

Treating the Causes of Bad Business Continuity Plans

Faults & Fixes: Bad Plans

Developing strong business continuity plans characterized as actionable, relevant, and simple to execute can be a very difficult task for many organizations. In other articles, Avalution examined the different types of business continuity plans, what information should be included, and how organizations can focus on the basics to develop effective plans. One trend that our consultants see across industries is that as business continuity programs mature, planning approaches inevitably change, often (and unfortunately) becoming more complicated and burdensome over time. As plans become overburdened with complex requirements, simplicity, quality, and effectiveness suffer.

This perspective examines the six typical symptoms of “bad plans” and their common root causes, and provides suggestions on how organizations can develop plans described as actionable, relevant, and simple.  Continue reading

Sources of Corrective Actions

Part of Avalution’s Conforming to ISO 22301 Series

This perspective is the eighth in a series to discuss key elements of the ISO 22301 business continuity management system, including value-adding elements of the standard or requirements that could “trip up” an organization during the certification process.

Today we’re going to take a look at ISO 22301’s requirements regarding corrective actions.

Continue reading

How, When, and If to Implement Business Continuity Software

Business continuity planning software can add significant value if it complements a strong program that has management support, competent personnel, and the information necessary to establish requirements, identify strategies, and document plans. While software will not “do business continuity planning for an organization”, it can provide an already-built and structured approach that automates what could otherwise be a manual internal process, freeing practitioners to focus on program maturation.  That said, not all software is right for every organization, so it is important to ensure any selected software is a right fit BEFORE trying to implement it.  Many organizations approach software selection anticipating that the software vendor will show them what they need or tell them what features best fit their program; however, without first understanding the program’s current state, needs, and capabilities, odds increase that organizations will select software that does not align to the current state program and could thus require significant additional customization or result in ineffective use.

This article discusses common business continuity software myths and selection issues and provides recommendations on factors to consider before deciding to pursue, select, and implement a business continuity planning software solution, so that you can get the most value from whatever option you select. Continue reading

Program Roles & Responsibilities in a Business Continuity Management System

Part of Avalution’s Conforming to ISO 22301 Series

This perspective is the seventh in a series to discuss key elements of the ISO 22301 business continuity management system, including value-adding elements of the standard or requirements that could “trip up” an organization during the certification process. Continue reading