Business continuity is the key discipline that sits at the heart of building and improving your resilience as an organisation, yet it is often noticeable by its absence within Charities. It is a tried and tested methodology that organisations should adopt as part of your overall approach to managing any potential disruption that would impact upon your organisation’s operational capabilities, i.e. upon your ability to carry out your normal charitable business.
The potential disruptions facing an organisation can be wide ranging in terms of cause and effect. They may, for instance, be attributable to the effects of a severe weather event (e.g., flooding damage, a power cut or inability to travel), a cyber incident (e.g., a cyber hack or malware incident that results in data loss or the disabling of your IT systems), or an unprecedented series of events affecting all aspects of your business continuity such as all organisations have experienced during the ongoing Covid-19 pandemic. Business continuity management helps you as an organisation to identify your priorities and to come up with solutions to address any potential risks and vulnerabilities to your charitable business.
Business continuity is arguably one of the most important business terms in widespread use today, especially in a context of increasing unpredictability attributable to a range of natural and man-made factors. It establishes the processes and systems that are needed to enable you as an organisation to withstand and recover from any disruptive event including major ones. Recent history has shown that these events are becoming potentially more prevalent and arguably more difficult to predict. The world in 2020 has seen unprecedented challenges with socio-economic and geo-political changes aligned to Covid-19 events. These have shone a spotlight onto the resilience capabilities (as well as exposing significant gaps and vulnerabilities) of organisations to meet the challenges presented, whilst maintaining their operational capability.
Effective business continuity planning supports the strategic objectives of your organisation and pro-actively builds your capability to continue business operations in the event of any type of disruption. Business continuity is a live and continual process within any organisation, that has clearly identified components (see diagram below). These can help you to set out a logical and easy to follow step process to ensure the currency and effectiveness of your plans, whilst encouraging a culture of continual improvement to become more efficient and effective in your charitable business operations.
The business continuity process establishes six basic steps which, when combined seamlessly within an organisation, helps you to progress towards achieving comprehensive organisational resilience with the associated benefits such as protecting your core functions, reputation, and revenue.
Step 1. Planning and Analysis
A fundamental aspect of the business continuity process is that it helps you as an organisation to gain an understanding and appreciation of your core function, what activities across your operations enable the delivery of that core function and how to protect those core activities during disruption so as to prevent or at least reduce any resultant damage and/or loss (whether economic, physical, reputational, etc). The analysis phase helps you to identify how best to approach the development and implementation of your plans to ensure continuance of your activities during any disruptive incident.
Step 2. Training and Exercising
Plans are only as good as the knowledge and understanding of those expected to implement them. If business continuity is undertaken as a standalone process within an organisation and kept within the knowledge base of a select few, they will be of little or no use. Therefore, the business continuity process necessitates and assists in the establishment of a robust training and exercising programme to enable your organisation to embed a culture of learning across your staffing profile. This is to ensure that everyone knows what to do, as well as when and how to do it, should your organisation suffer a disruptive incident. Equally, the business continuity process encourages the regular exercising of your related plans to ensure their currency and accuracy such as in relation to your planning assumptions which can change over time.
Step 3. Incident Response
In case you are confronted with a sudden impactive disruptive incident, as an organisation you need to be ready and able to respond quickly to mitigate the associated risks and reduce the amount of time that you are affected by the disruption. The business continuity process helps you to identify key roles and responsibilities needed to respond successfully to any disruption, in particular to reduce its potentially negative impacts upon your organisation. Notably, it serves as a useful tool for establishing effective leadership and communications strategies, and identifying key resources required to ensure an effective response.
Step 4. Incident Management
The poor management of disruptive incidents can impact negatively on you as an organisation, especially if you have not established sound strategies which support their efficient resolution. The business continuity process also helps you to better understand the complexities of managing a disruptive incident. This includes mapping your organisation’s interdependencies with key stakeholders and partners and providing a robust framework to ensure continuance of your core function. Such an approach is important for reducing negative impacts, not only upon your business operations, but also potential reputational damage as the organisation moves towards business recovery following the disruptive incident.
Step 5. Business Recovery
Moving as seamlessly as possible from incident management to the effective recovery of your organisation’s business will be foremost in the objectives set within your plans. The business continuity process equips you with important tools for clearly identifying and assessing the impact of a disruptive event, which in turn will ensure that you take the correct mitigating measures in response. The process can further help you to identify realistic and achievable timeframes in which to manage the disruption and to develop strategies which enable the recovery of your charitable business.
Step 6. Learning
At the centre of the business continuity process is the importance of ensuring that as an organisation you are continually learning and developing to increase your organisational resilience. This includes ensuring that you learn from previous disruptive events - what went well and what did not - and that the risk assumptions informing your business continuity plans do not remain static, rather evolve to reflect an often rapidly changing risk landscape (e.g., new forms of cyber threats, alternative ways of working with accompanying new risks such as home-based working). The business continuity process facilitates the establishment of a culture within your organisation that seeks to capture and implement such key learning. This is important for ensuring that your planning and analysis phase is kept current and valid, which in turn informs all other aspects of your business continuity planning.
In summary, the proactive management of business continuity within your organisation provides you with a clear structure for understanding and preparing for the unknown. Its associated methodology and process are important tools for helping you ensure that, irrespective of the challenges faced (whether pre-planned or not), the impact of disruption does not stop or severely impede your organisation’s core function. When confronted with potentially overwhelming impacts - such as occurred during the recent Covid-19 lockdown period – all organisations can benefit greatly from having in place a well thought through and tested business continuity plan which can help you to take informed decisions during often highly stressful periods. For instance, to determine whether and when to recoil and resume normal function or focus on surviving. Business continuity enables you as an organisation to scan the environment and horizons in which you operate and to create effective survival strategies in the event of encountering disruption. The business continuity process also enables you to strike an appropriate balance between resource limitations and the need to plan and prepare for disruption.
Business continuity is relevant and applicable to all organisations regardless of your size, complexity, type, and location. If you do not already engage in business continuity planning sufficiently or even at all, then it would be highly advisable and prudent for you to engage proactively with this process. It could prevent or at least reduce the adverse impacts of disruptive events, such as those experienced during the ongoing Covid-19 pandemic, to your charitable business operations. It could even make the difference as to whether your Charity not only survives but thrives in a context of likely increasing uncertainty and currently unforeseen disruption.
Some of the key concepts and principles mentioned here have been informed by the Business Continuity Institute’s ‘Good Practice Guidelines’ (2018).
Nick Gregory is a GSDM (R4C) Associate with organisational resilience expertise, including in business continuity.