The business world is facing a period of rapid change with various emerging technologies, especially artificial intelligence and machine learning, expected to fundamentally change the structure of organizations and society. How might these developments impact the business continuity profession? Charles Boffin makes some suggestions...
Everyone agrees that business continuity will be changing over the next few years and into the foreseeable future; but, as with any other changing landscape, the future is never a specific of finely shaped object: it is a vision. For business continuity, the end vision is a fully resilient environment which means that things don’t fail and, if they do, they are resolved immediately with no loss of service. This general view of the future of our profession is fine as we build our technological credentials and capabilities, but there are three prime movers involved, and each requires a different response:
1. External factors that can be forecasted
This covers issues such bad weather, demonstrations and civil unrest, economic factors, viruses (human!) and other aspects where we can see events unfolding or likely to happen in a given place. In these cases, responses can be planned and contingencies created.
2. Process failure
Things go wrong. Widgets fail. Loss of power, IT, access to premises. In our more resilient future, this issue has less of an impact. 'Always on' technology, cross-border operations/communication, secure home working are just examples of our more resilient future.
3. Unknown/Un-forecasted events
Examples include hackers and cyber attacks, terrorist activities, sudden events (e.g earthquake). In these cases, successful recovery depends upon issues such as a ‘fleet of foot’ response and the ability to react to unfolding events or chain of events where there is a constantly changing environment or challenge.
Response and resolution
Response will vary according to the event type and we will increasingly move towards forecasting and monitoring rather than a reactive ‘waiting for things to happen’ approach. However, the one constant we can be sure of is that there will continue to be both planned and ad hoc disruptions and there are some common threads when dealing with these:
- Machine learning and the growth of artificial intelligence will mean that more decisions will be made automatically, without the need for human intervention. At present, people are often the weakest link as we have to assimilate information, balance judgements, make decisions and then be prepared to vary the route chosen as the event unfolds. In the future, much of this rapid assimilation and decision-making process will be made by systems/machines with business continuity teams taking much more of an overview role.
- Information access will be greatly improved. This is about quality of information (i.e. what is affected, how it is affected, what the impact is, what the operational implications are etc?) and means of access (different media/channels – mobile devices, cloud etc).
- Core system resilience will continue to improve. The reliance on work area recovery sites will continue to diminish as technology provides different and better ways of dealing with disruptions. Alternative strategies include working at home; working from other offices; and providing service alternatives to clients whilst recovery is executed: all in all a more robust process.
- Events will become ‘self-build’, flexible processes, capable of covering a multitude of sins: the nature of the event will be created as it unfolds - e.g. geography, impact, processes, plans, people, recovery strategies, actions …
This move to resilience will also be underpinned by more uniform and planned methodologies when assessing risk and impact as part of the end-to-end business continuity planning process:
- Process frameworks and template activities will allow organizations to pre-populate much of the methodology so end user input will be minimal;
- Improvements in technology will enable communications and invocations to be smarter, slicker and more timely as events unfold.
What does this mean for plan owners?
Often organizations focus at the macro level when looking at resilience and this is entirely appropriate when considering the corporate approach and development route map. But, the vast majority of practical activity remains at the ‘sharp end’ with plan owners in their many guises active during all phases from development, through maintenance and into practical plan use in time of need.
This important user base - the owners of plans within their departments or business teams - will start to see changes. These will appear over the next few years as organizations build their resilience capabilities and technology progresses:
- There will be less work in the build phase and thus less of an intrusion on day-to-day activities. The focus will be on approving or amending pre-formatted business continuity instruments (BIA, plan, risk assessments) rather than having to build from square one.
- Access to plans on multiple devices with single view of the event. Information will be available in different formats on different devices with greater degrees of accuracy and the ability to share information with colleagues much more effectively. This will results in better and more timely communication at all levels.
- Test and exercise processes will become less time-consuming and more ‘learning experiences’. This will involve the use of new technology such as VR (virtual reality) to support both training/education and formal plan exercises.
- Less manual input to recovery processes as automation and machine learning enables and manages the core recovery routines and decisions.
- A wider view of and access to relevant information during an incident – real time injects with availability of social media and third-party data sources e.g. weather reports.
- Improved reporting and knowledge of events and activities as the invocation/response progresses.
Fundamentally, there will be greater integration with business as usual activities i.e. BCM becomes part of the norm.
The big question
Finally one big question. Will there be a day when all activity is automated to avoid disruptions, whatever the cause? The answer for me is ‘yes’, although the major challenge (threat?), as Stephen Hawking quite rightly points out, is not the efficacy of process but the societal implications of handing over such processes to machines who can learn and improve/evolve.
Remember, this future is not that far away and, given the ever-reducing new tech development cycles, we are already seeing evidence of this future now and this will only continue at a pace.
Charles Boffin is CEO of ClearView Continuity.