While there is no general definition for ‘Agile' project management, it can be seen as using a collection of lightweight approaches and methods in order to handle complex challenges. Benedict Gross believes that some of those concepts can be transferred to business continuity management; and to the BIA in particular.
A business impact analysis (BIA) is an auxiliary product. There may be limited value in the analysis by itself, but it’s an essential tool to answer the two questions which, if not answered correctly, can be very expensive: Which processes and activities are so crucial to the organization that they must be covered by a business continuity plan (BCP)? And what hidden dependencies could diffuse through activities and resources and make seemingly insignificant things a priority for BCPs? The analysis should also define some business continuity requirements - things such as timeframes, resources and those capabilities that are necessary to continue operations after a disruption.
The question most companies are unable to answer
By compiling a BIA, business continuity professionals pose questions that most companies are unable to answer. What are the essential activities for the company's success and how are those activities interlinked? Despite decades of optimisation programs, lean-management initiatives and digitalisation strategies, all these efforts have not generated much transparency in this area. At the same time, business models are becoming more fluid and organizations have to react by constantly adapting their processes and structures in attempting to keep up with changing environments and moving targets.
Contrasting approaches
In practice, we come across two different approaches and expectations when it comes to performing a BIA and then generating a BCP. They can be contrasted as the deterministic approach and the pragmatic approach.
Determinism, formalism and regulation are boundaries in our economy - the same as pragmatism, complexity and incompleteness are a part of our reality.
In the deterministic approach, it’s possible to analyse the processes and resources of an organization with a BIA, then to formulate parameters and requirements for BCPs. This deterministic method is common amongst traditional companies that have a static core business, such as banks or insurance companies. The deterministic approach is also fostered by the strong formalism and documentation requirements in regulated markets such as the finance industry. Unsurprising, critique says it would be too bloated, bureaucratic and not flexible enough to hold pace with changes in organizations and their processes.
The pragmatic approach accepts complexity, volatility and incompleteness as characteristics of organizations and the environment that they are operating in. The pragmatic world is generally found in younger companies and digital businesses, but increasingly also in those traditional enterprises where external regulation is not overly strong, but the needs for reliable services or deliveries are high. Production industries and automotive suppliers, for example, can fall into this latter category. Such organizations prefer having a lean BIA and fast working BCPs, rather than striving for formal and well documented completeness. They also accept that all plans and analyses will be under constant development.
There is no need to favour one approach or the other. Determinism, formalism and regulation are boundaries in our economy, the same as pragmatism, complexity and incompleteness are a part of our reality. Business continuity management itself - as a young and fast developing discipline - will advance and gain from work in other management areas and scientific contributions. The pursuit of non-linearity might be a promising direction for development. This article is to help stimulate some ideas in this area.
Management in complexity
Imagine a BCM project in a medium to large size company operating in a technology-driven and customer-centric segment, like retail, finance, healthcare, insurance, telecom, manufacturing, or any other modern company. The project manager tries to describe and analyse a comprehensive process model of the organization during a BIA. After this first stage of analysis, aspects and tasks for each phase of continuity planning are laid out in a project plan, consented to by stakeholders, then budgeted and assigned. Finally, the project will be executed by working through the plan until all BCPs are published and fully understood by all concerned parties. The project successfully completed all sequences. But what are the chances that the BIA is outdated even before the last BCP is drafted? The organizational environment is likely to have changed in the project duration.
Business complexity is not an environment in which to employ methods that rely on a linear and sequential approach so, “First make a plan and then stick to it,” may no longer be a helpful proverb. Here, the very human needs for closure, for detail and completeness, can often conflict with the constantly changing nature of living and vibrant organizations. This lesson has been learned by many large software projects that have either run late, over budget or completely failed. What has emerged is a different approach to complete projects. ‘Agile’ has become a paradigm to embrace complex development tasks in dynamic environments.
The lesson learned from failed projects is agility
The Agile approach puts working results, satisfied customers and sustained teamwork at its very centre. It’s a contrast to the plan-driven and heavy-loaded project management approaches that often lead to the creation of monsters of paperwork during the planning stage, which is then followed by unwieldy processes. A combination that ultimately paves the way towards failed efforts and disappointing results.
While there is no general definition for 'Agile' project management, it’s more like having a collection of lightweight approaches and methods in order to handle complex challenges. Some of those concepts can be transferred to business continuity management. Here are some ideas worth considering:
1. A Minimum Viable Product (MVP) is a version of a product that has a basic set of features, just enough to give it to customers in order to learn from their feedback and needs. For a BIA this would mean aiming for the first prioritised process to be identified and parameterised in its business continuity requirements and then to start working on a first BCP - instead of investing too much effort in an elaborate analysis, while hesitating in developing BCPs before the final analysis is finished. It probably will never be complete.
2. Incremental design and continuous integration mean producing small but working results early, then trying and testing them in a larger context in order to learn quickly from feedback and failures before, for example, the next BCP is drafted.
3. Iterative development allows for constant business impact analysing in multiple recurring time intervals. Each BCP requires an analytic part and fills the organization’s process map laterally and in depth. At the same time, it generates the implementation and testing of new BCP insights and uncovers dependencies with relevance for the BIA.
4. Self-organizing teams are a great way to provide responsibility and motivation for those people who know most about the system that is to be analysed. Instead of dominating methods, processes and timings of the BIA, the BCM project manager could start with asking these fundamental questions to the experts in the organizational structure under review: ‘What do you think are processes and activities that should be protected by a BCP?’; ‘How would you uncover any interrelations and dependencies?’. And importantly, once they are able to answer those questions, let them implement their ideas.
5. Another key-lesson from Agile projects is to question the projects methodology itself on a regular basis, something which could be as regular as every two weeks. Learning should not be restricted to incremental results, but also reflect how the processes and methods are created.
This selection of five practices can be seen as an inspiration for an Agile approach to BIA and BCP. It isn’t a ready-made recipe, but a motivation to challenge and evolve the methods employed in business continuity management today. The starting point is to acknowledge the pluralistic nature of complex organizations might not be open to deterministic methods when describing both their general and detailed functioning. An Agile approach can allow for complexity in the subject and pragmatism in the process of BCM. If the future BIA is Agile, it may well be incomplete by default.
The author
Benedict Gross is a business continuity management expert with, PwC, Business Continuity & Resilience Management. Find him on LinkedIn at https://www.linkedin.com/in/benedict-gross/
