Aws Al Khanjari eMBA IAP AVSECPM ACC coach
Professional Resilience Coach & Trainer | Organisation Resilience Expert | aws@assistplus.ae
Imagine this: you're an organisation that has implemented and obtained the required certification for ISO 22301 Business Continuity Management System (#BCMS). You've got all your documents in order, and you even conduct annual exercises and training for your staff. But despite all this, you still find yourself struggling to reduce the impact of an event that disrupted your operations. Why is that? The answer might surprise you.
When approached by an organisation seeking consultation and advice to audit, review, or conduct a gap analysis of their BCMS, I find that 70% have a complete BCMS system. However, most fail to ensure the BCMS is deeply incorporated into their system. In other words, their BCMS is built as a stand-alone system and is not integrated within the organisation with other systems with direct and indirect relations with their BCMS.
Before we discuss it further, let's set the stage right: BCMS is everyone's responsibility, not just the BCMS department. If the organisation fails to respond effectively to a disruptive event during an event, it is everyone's responsibility, not the BCMS department's. This fact needs to be made clear to the organisation so that it can accept what needs to be done to improve its BCMS.
The Concept of Integrated Business Continuity Management System (iBCMS):
Most organisations' BCMS failures are due to the lack of an Integrated BCMS. iBCMS is a comprehensive approach to managing business continuity, ensuring that all related processes are interconnected.
Key Characteristics of iBCMS:
1. Integrated System: iBCMS combines various organisational management systems, methods, and functions into a unified approach. This approach connects all the organisation's systems, policies, and functions, enabling a holistic BCM management strategy.
2. System Synergy: Identifies common denominators between systems and processes, effectively linking them to enhance organisational resilience and ensure seamless business continuity. By fostering these connections, the organisation can achieve a higher level of readiness to respond to disruptive incidents.
3. Proactive Preparedness: This proactive approach ensures organisational resilience by building robust continuity strategies before potential disruptions occur. It reduces the risk of unplanned downtime and provides quicker recovery from disruptions.
4. Resilience Enhancement: Mitigates the immediate impacts of disruptions and fortifies the organisation’s long-term adaptability. Ensures rapid adaptation and recovery to respond flexibly and resiliently. This ability to adapt quickly is critical in a rapidly changing risk landscape.
Traditional BCMS vs. iBCMS:
The traditional BCMS approach typically involves the following steps:
1. Policy and Program Management: Define the organisation's business continuity policy, establish a governance structure, assign roles and responsibilities, and develop a comprehensive program plan.
2. Risk Assessment and Business Impact Analysis (#BIA): Identify potential threats and vulnerabilities, analyse their impacts on critical business functions and processes, and prioritise recovery strategies.
3. Incident Response and Crisis Management: Implement plans and procedures to respond effectively to disruptive events, coordinate communication and decision-making processes, and manage crises.
4. Business Continuity Planning: Develop detailed recovery plans for critical business functions, including procedures for data backup, alternative work arrangements, and resource allocation.
5. Testing and Exercises: Conduct tests, simulations, and drills regularly to validate the effectiveness of business continuity plans, identify gaps, and make necessary improvements.
6. Maintenance and Continuous Improvement: Establish a process for ongoing review and update of the business continuity management system, incorporating lessons learned and adapting to changes in the organisation's environment.
However, this approach must often be revised because it's implemented as a stand-alone system. The iBCMS approach dives deeper and builds a network of interconnected systems that work together in synergy:
1. Comprehensive Gap Analysis: Conduct a gap analysis to identify similarities and differences between existing management systems, processes, and BCMS requirements. This step helps uncover redundancies and areas where integration can enhance resilience.
2. Planning and Alignment: Develop a detailed plan to harmonise the different management systems and processes, policies, and procedures, ensuring consistency and avoiding redundancies. This alignment ensures that all systems contribute to the overall continuity strategy.
3. Documentation Review and Consolidation: Review and consolidate the documentation, including policies, procedures, and records, to create an integrated management system documentation set. This consolidated documentation provides a single source of truth for all continuity-related activities.
4. Training and Awareness: Conduct training and awareness sessions to ensure all relevant personnel thoroughly understand the integrated management system and its requirements. This understanding is crucial for fostering a culture of resilience across the organisation.
5. Implementation and Monitoring: Implement the integrated management system, monitor its performance, and continually improve it through regular reviews and audits. This continuous improvement ensures that the system remains effective and responsive to emerging risks.
Implementing iBCMS: An Example
Consider a Business Impact Analysis (BIA), which identifies a critical role responsible for ensuring the availability and security of key activities, processes, and resources necessary for continuity. In a traditional BCMS, this position's responsibilities would be documented in isolation.
In an iBCMS, this role is linked with the Human Resources (#HR) department to ensure:
1. Job Description: A job description for a critical role should comprehensively outline the essential skills, competencies, responsibilities, authorities, and accountabilities. These elements form a comprehensive picture of the vital role, ensuring alignment and clarity for candidates and stakeholders.
2. Alternative Roles: Identify an alternative position in case the critical role position is absent. This redundancy ensures continuity even when the primary role is unavailable.
3. Training & Development: Comprehensive training programmes are required to bring the alternative position's skill set to an acceptable level, enabling it to act as a replacement in case the critical role is absent. The role ensures sustained growth, adaptability, and performance excellence by aligning assessment outcomes with targeted training and development initiatives.
4. Rewarding Remuneration: As the individual occupies a critical role, it's essential to retain such positions by providing a distinct and rewarding remuneration package compared to other roles. This differentiated approach recognises critical roles' strategic importance and unique contributions, ensuring they remain engaged and motivated while reinforcing the value they bring to the organisation.
5. Notice Period and Succession Plan: If the criticalorganisation, a succession plan and people development strategy are in place role exits the. Furthermore, the notice period for the vital role shall be longer than the usual one month to ensure a smooth transition.
6. Software Link: Finally, the HR system is linked with the BCMS so that when a critical role leaves the organisation, the BCMS is informed, and the BCMS compliance indicator is adjusted accordingly by reducing it until a replacement is made available.
This is just one example. The same concept can be applied to critical suppliers and other vital components.
Integrating systems offers numerous benefits:
1. Enhanced Efficiency: Streamlines processes and eliminates redundant tasks by unifying organisational procedures and policies.
2. Consistency: This promotes a unified approach to risk management across all systems, ensuring that the organisation speaks the same language regarding continuity and resilience.
3. Comprehensive Visibility: Provides a holistic view of organisational risks and mitigation strategies, helping leaders make informed decisions.
4. Regulatory Compliance: Facilitates adherence to industry standards and regulatory requirements, reducing the risk of non-compliance penalties.
5. Cross-Functional Collaboration: Encourages information sharing and teamwork across departments, breaking down silos that often impede organisational resilience.
6. Adaptability: Enables organisations to respond promptly to evolving business needs, ensuring flexibility and responsiveness in the face of emerging threats.
Challenges in Integration:
However, the integration of BCMS with other organisational processes faces several challenges:
1. Organisational Silos: Overcoming functional divisions and fostering cross-departmental collaboration between BCM and other departments can be difficult due to entrenched ways of working.
2. Lack of Alignment: Lack of alignment between BCM processes, objectives, and priorities and those of other departments can hinder supporting the organisation’s overall resilience strategy.
3. Differing Methodologies: Differing methodologies, tools, and frameworks between BCM and other systems further complicate integration and coordination efforts.
4. Data Sharing and Privacy Concerns: It is challenging to securely and compliantly share relevant data, such as personnel information and succession plans, while maintaining confidentiality.
5. Resource Constraints: Limited resources, time, and budgets can hinder the effective integration of BCM with other processes, affecting implementation and maintenance.
6. Cultural Resistance: Differing organisational cultures and priorities between BCM and other departments can lead to a lack of buy-in or resistance to change.
Addressing these challenges is crucial for seamless integration and a more resilient organisation.
Conclusion:
Implementing an Integrated Business Continuity Management System (iBCMS) is crucial for building organisational resilience. By deeply integrating BCMS with other management systems and departments, organisations can streamline processes, enhance efficiency, and strengthen their overall risk management strategy. Despite challenges such as organisational silos and data privacy concerns, the benefits of a unified approach outweigh the difficulties.
Organisations must shift from viewing BCMS as a stand-alone system to seeing it as an integral component of their overall management strategy. By adopting iBCMS, companies can proactively prepare for disruptions, ensure seamless continuity, and enhance long-term adaptability.
Discover how implementing an Integrated Business Continuity Management System (iBCMS) can transform your resilience strategy. Learn why a traditional stand-alone BCMS isn't enough and how iBCMS can proactively enhance your organisational with Assist Pus, we understand the complexities of the process. Our comprehensive exxpert consultation ensure a seamless transition, providing support and guidance at every step.
Connect with Us for a Free Consultation Session:
📞 Abu Dhabi: +971 (2) 641 6751
📞 Dubai: +971 (4) 8790 747
📞 Mobile: +971 (50) 336 9484
📧 Email: info@assistplus.ae
🌐 Website: www.assistplus.ae
About the author Aws Al Khanjari
Senior Consultant & Advisor
eMBA IAP AVSECPM ACC Coach
a professional organisation resilience expert, coach and trainer.
Professional Resilience Coach & Trainer | Organisation Resilience Expert | aws@assistplus.ae
Comentários