Revamping the business continuity profession: a response
- Published: Tuesday, 09 May 2017 07:36
Recently, Continuity Central published ‘Revamping the business continuity profession’; an article in which Charlie Maclean-Bristol looked at challenges faced by business continuity professionals and offered his suggestions for revamping the discipline. Here, David Lindstedt and Mark Armour, developers of the Adaptive Business Continuity methodology, offer their response to the article:
David Lindstedt: Naturally, most folks starting to embrace Adaptive Business Continuity will agree that traditional business continuity methods are not working and it's time for a change. I totally agree that ‘resilience’ will not be the ‘savior’ of business continuity. As Charlie correctly points out, resilience is an inter-discipline, not a discipline on its own. A business continuity practitioner could run it, but so could anyone from any of the inter-disciplines like ERM, EM, IT DR, etc. The chief concern with resilience will always be: what are the boundaries to what gets included (individual personal psychology to environmental sustainability to the entire content of a MBA program?) and how do you measure its effectiveness?
Mark Armour: I'm afraid I have a different take on Charlie’s piece. I agree with the premise that business continuity has ‘lost its mojo’ but I disagree that the profession is in literal decline. Based on my personal observations, and even some preliminary data I’ve seen, the numbers in our ranks are now on the increase after several years of stagnation. Charlie reasons that we must make changes in order to begin increasing our numbers again. In truth, we started seeing a reduction in business continuity’s ranks shortly after the global financial crisis. This was a direct result of cost-cutting measures that affected nearly all industries and not due to the reasons cited. We are now starting to see an increase in hiring within the business continuity and disaster recovery disciplines so there is no real problem to solve in that regard.
As far as the specific issues, I don’t believe it is true that remote work capabilities have eliminated the need for premise planning. I’m afraid people are still going to be asked to come onto the job site for some time to come and strategies to keep them productive will also be necessary. I do agree that today’s technology is starting to render disaster recovery efforts superfluous. The reduced cost of recovery now means we can replicate our entire computing environments and dispense with the costly effort of prioritization. I don’t, however, know anybody in our profession who would “wait around until the cloud provider fixes the problem” if they ever lost their technology systems. Manual workarounds and recovery exercises will still be necessary until we can completely eliminate all risks associated with running technology systems. Lastly, I’m afraid I will need a lot more convincing before I embrace the idea that business continuity software is a solution to anything except for building careers in business continuity software administration.
David Lindstedt: Charlie writes, "For me, business continuity is not really all that difficult conceptually. As long as you have a robust, tried and tested methodology, it doesn’t take very long to learn to implement a BCMS [business continuity management system] successfully."
Here is where the big disconnect between Adaptive BC and Charlie's recommendations appear to be. I believe that we do NOT have a "robust, tried and true" methodology. We have a set of individual ‘best’ but not PROVEN practices. There is: no underlying model that unites these practices; no data to show which activities are effective and to what degree; no measures or metrics to indicate success and value of these practices; and not much engagement or enthusiasm from those who must participate in the process. In fact, the discipline cannot even answer this crucial question: if an organization undertakes a formal continuity planning program, to what degree are they more likely to survive a disaster? (Is it any wonder we do not get much respect from the c-suite?!?)
Adaptive Business Continuity tries to address these failings (and more). The problem of the business continuity professional "stumbling about trying to find a purpose for the field and their job role" is NOT going to be solved by slightly expanding the daily activities of the business continuity professional. It must be solved by reformulating the nature of the business continuity discipline itself. Everything else is a band-aid. Therefore, if we define business continuity as ‘the continuous improvement of an organization's capabilities to recover from an uncontrolled physical and/or staffing loss’, we work to both protect and improve the discipline. With this understanding, working inside of a context of improved approaches in other disciplines that can be brought to bear in our discipline, we can significantly strengthen the profession and help prove the value of its professionals.
Mark Armour: Let’s look at Charlie’s logic from a different perspective: “As long as you have a robust, tried and tested methodology, it doesn’t take very long to learn to implement a BCMS successfully.” I agree with this statement. However, I have two fundamental problems with it: 1) legacy methodology is NOT tested, and 2) one can implement a BCMS successfully using existing practices but that does not ensure that said BCMS delivers value to the organization.
To paraphrase David’s previous response, Adaptive is moving away from the inappropriately named ‘best practices’ towards what we like to call proven practices. Over time, it is possible to actually measure program effectiveness and determine, based on factual and objective data, what methods actually deliver value in the form of organizations that are better prepared to deal with disaster and disruption. To my other point, legacy business continuity methodology is, indeed, written for the purpose of implementing a BCMS, NOT for the purpose of building organizational recoverability. Current practices are inwardly focused and seek only to define a set of activities and deliverables the result of which, we hope, will make for better overall preparedness. Conversely, Adaptive Business Continuity puts the focus on the organization, seeking to build a better prepared company or community. From an Adaptive perspective, the steps needed to implement a formal BCMS are secondary.
David Lindstedt: it is wonderful to see thought leaders such as Charlie Maclean-Bristol posting and providing inspiration. Regardless of what exact approach one decides to use, it's important to continue to raise the real issues within the profession and provide recommendations on how to fix them! Let's keep the conversations going.
Mark Armour: Here, here! Although I disagree with some of what Charlie has to say, I wholeheartedly agree that we are desperately in need of change and more thought-provoking pieces like this are a step towards making such change a reality.
For more information about Adaptive Business Continuity go to www.adaptivebcp.org