Breaking Down Silos – Using Common Criteria to Assess and Prioritize Risks

Breaking Down SilosAn isolated approach to business continuity (and risk management in general) is holding many organizations back.

Business Continuity is one of many disciplines that helps organizations to become more resilient – that is, to increase an organization’s capacity to adapt to evolving circumstances and survive (or even thrive) during periods of disruption or change.  Other related disciplines – such as Information Security, IT Disaster Recovery, Emergency Management, Enterprise Risk Management, and Physical Security –ultimately have the same strategic purpose.  The goals and objectives of the individual disciplines may be more focused, but if we, as practitioners of these disciplines, force ourselves to look outside the artificial walls we sometimes build around our responsibilities, we should find that we are striving for something bigger than we can deliver on our own. Continue reading

Strategy Connected Business Continuity: What is it, and Why is it Important?

Strategy Connected Business ContinuityMichael Porter once famously said “the essence of strategy is choosing what not to do”. While I am sure that Mr. Porter was not thinking of business continuity when making this statement, it is absolutely applicable to the implementation of a successful business continuity program. As the best way to drive business continuity program success is to properly scope the program by aligning it to the organization’s overall business strategy. This perspective aims to provide clarification on what exactly strategy connected business continuity means, as well as why it is important to all organizations considering the implementation of a successful, focused business continuity program. Additionally, we will explore conversation topics designed to “crystalize” the organization’s business strategy in a way that helps inform the scope and objectives of the business continuity program.

Continue reading

Business Continuity: The Importance of Thinking Both Strategically and Tactically

thinking-both-strategically-and-tacticallyAs I reflect on my first year as a business continuity professional, I contemplate what has made me successful to date. In my previous role of being an officer in the U.S. Army, I lived and breathed risk assessments and contingency planning (addressing a loss of resources). When I first started in the military, my focus was very tactical, ensuring that there was always a plan to replenish our basic supplies (e.g., bullets, food, gas, and water). These plans were very basic and more reactionary than anything else, but I always knew that as long as I had these resources, I could continue the mission. Continue reading

Business Continuity Plans: Resource Loss-based vs Scenario-based

Resource LossFor some reason, bad ideas often attempt to make a comeback – typically, after enough time has passed and the very reason they were discarded or abandoned in the first place is forgotten.

Bad ideas certainly are not exclusive to popular culture; in fact, articles and case studies litter the internet documenting both public and private organizations attempting to resurrect failed models and strategies in hopes that new capabilities or use cases will finally make a particular idea just as good in practice as it was in theory or on paper.

In the wake of several high-profile, unpredictable, catastrophic incidents (“Black Swan Events”) in 2012, Avalution received a number of requests to develop highly-specific, scenario-based plans from our clients. Planning for Every Scenario is “For the Birds” explains that Black Swan Events cannot be predicted, and advises that organizations that implement flexible strategies, applicable in almost any type of scenario to manage response and recovery, enjoy the highest levels of success when faced with a disruptive incident.

However, the demand for scenario-based plans seems to be back.

We understand why organizations may think scenario-based plans are a good idea; however, their appropriateness, utility, and long-term value is limited – much like line dances, vampire romance movies, and mullets.

Instead, in this perspective we’re going to use a case study to make the argument for a resource loss-based plan development approach. Continue reading

Risky Business (Part 3): A Supply Chain Continuity Case Study

Risky Business - Supply ChainMuda. It’s the Japanese word for waste and the enemy in modern supply chain management and manufacturing. Since the 1980s, lean thinking has revolutionized the way businesses operate by seeking to eliminate muda and free capital held in wasteful assets—that is, assets that do not add value to the overall process (e.g. excess inventory or underutilized equipment). Lean thinking is important and helps businesses to improve their processes and their bottom lines. It does however beg one key question that risk managers and business continuity professionals must ask: “how lean is too lean?” Wantonly cutting out all perceived muda to save money can actually have the opposite effect down the road. Organizations with global supply chains inherit significant risk due to the potential impact associated with a supply chain disruption.  In some cases, a disruption could threaten an organization’s ability to continue business or require large amounts of capital to recover. Organizations must fully examine their processes and supply chains to identify risk and make informed decisions on how lean is too lean.

This perspective—the third in the Risky Business Series—leverages a case study of the recent west coast dock worker strike to demonstrate the inherit risk of a supply chain that is too lean due to a virtual monopoly. This article also revisits evaluation and mitigation strategies from the first two Risky Business perspectives that organizations can use to reduce risk to an acceptable level. Continue reading

Business Continuity Strategy Design: An Overview of BCI Professional Practice 4

BCI_GPGs_SeriesThis article provides an overview of Professional Practice 4 (PP4) – Design, which is the professional practice that “identifies and selects appropriate strategies and tactics to determine how continuity and recovery from disruption will be achieved”. Strategy design activities are essential to translate outputs gathered during the analysis phase into actionable strategies that the organization can implement and refine over time to improve the ability to respond and recover from a disruption. Continue reading

Chaos in Cleveland?

ClevelandSETTING THE STAGE

This morning was a non-eventful morning.  I was sitting in my office, sipping on my coffee, and working on my monthly reports. Then, the manager of our office building entered our lobby.

The Michael Brelo case is nearing an end. Closing arguments have been heard and a verdict is expected shortly. The question is, when?

Our building manager was concerned, and rightfully so.

Our office is located directly across the street from the justice center where the case is taking place. Just a couple weeks ago, we sat witness to the riots and devastation in Baltimore, and, from our ongoing monitoring of the situation and media this week, our team is aware that the City of Cleveland is actively bracing for the possible impact and chaos that could result when the verdict is announced. Continue reading

We Just Did a BIA and Gap Analysis… Now What?

Sketch successful businessman concept, idea light bulbHow to Perform an Effective Business Continuity Strategy Identification and Selection Effort

Reader Note: This article is a continuation from Avalution’s November 2014 article titled: We just did a BIA and Risk Assessment … Now What? How to Perform an Effective Business Continuity Gap AnalysisIf your organization just finished a business impact analysis (BIA) and risk assessment, but has not yet performed a gap analysis, it may be helpful to read about performing an effective gap analysis before continuing on to this article.

Once an organization understands gaps between business continuity requirements (as defined in the business impact and risk assessment) and current capabilities, management can determine which gaps they wish to address through strategy selection – either through risk mitigation or resource-specific recovery methods.  Determining methods to decrease the likelihood of a disruptive incident reduces the potential that a risk will materialize, while identifying methods to respond to and recover from a disruptive incident decreases downtime and protects the organizations’ brand and financial position (among other assets). Continue reading

Risky Business (Part 2): Too Lean, Too Late

Risky Business - Supply ChainMany organizations today aim to make operations as lean as possible. But, in doing so, are these organizations unknowingly increasing the risk of operational downtime and excess cost? Due to streamlining operations and eliminating redundant activities or suppliers, one misstep or disruption (either internally or externally), can result in time-consuming and costly operational delays, or much worse, impact market positioning or even threaten the survival of the organization.

This perspective is part two of a supply chain risk management-focused series called “Risky Business”. In part one, Managing Third-Party and Supplier Risk, we discussed the importance of protecting your organization from risks associated with a dependence on suppliers (and service providers), as well as how to analyze potential impacts and prioritize these risks.

In this perspective we’ll discuss the specific business continuity strategies and risk treatment options available to mitigate the risk associated with supplier dependencies to an acceptable level. Continue reading