Agile business continuity management (part 1)
Consider the significant investment — time, money, effort, and resources — that we pour into building resilience. All of this requires a revaluation of our strategies to save time, effort, and resources wherever possible. It is about optimising our resilience efforts, focusing on essential components like business continuity management (BCM), which forms the backbone of resilience. Hence, the concept of ‘agile business continuity management’ emerges — a critical aspect of resilience that demands our attention and one which could save an organization time, effort, energy, and money.
In order to test this assumption, I decided to talk to three industry experts: Helen Lipscombe, a resilience professional based in the UK, Ratna Pawan, a senior operations risk and resilience professional based in Canada, and Anand Sampath, a risk professional based in India.
The diversity in perspectives enables a comprehensive exploration of agile business continuity management, reflecting varied experiences and insights.
What is agile business continuity management?
First of all, it is important to define agile business continuity management. With this in mind, the experts shared what they consider to be key factors of agile business continuity management, including:
- A dynamic approach: Agile business continuity management emphasises flexibility and adaptability, allowing for the evolution of business continuity plans based on ongoing assessment and adjustment.
- Customer-centric collaboration: Rooted in agile principles, agile business continuity management prioritises collaboration and stakeholder input, departing from traditional, linear planning methods.
- Organizational agility: Agile business continuity management requires both swift plan execution during crises and a culture of agility within the organization to adapt quickly to changing circumstances and maintain efficiency in response and recovery efforts.
Helen: When considering agile business continuity management, I envisage a dynamic approach within organizations. It involves experimenting with different methods, being adaptable, and recognising what initial plans may evolve. It's about implementing activities, assessing their effectiveness, and making adjustments as necessary. Drawing from my experience working with diverse organizations, I emphasise the importance of understanding each organization's culture and context to tailor the business continuity approach accordingly. In essence, agile business continuity management entails flexibility, leveraging expertise, and aligning strategies with specific environments.
Ratna: In my understanding, agile principles originally applied to IT transformation or application development projects in order to prioritise customer-centricity and collaboration. This iterative approach aims to enhance efficiency by incorporating stakeholder inputs throughout the process, as opposed to traditional waterfall methods.
I feel that these principles can also be adopted for business continuity management, which is an environment where the threat landscape evolves rapidly. In this fast-paced environment, traditional business continuity plans may no longer be sufficient so we need agile frameworks to swiftly adapt and maintain efficiency. This requires a shift towards more dynamic processes that can quickly pivot to meet changing demands.
Anand: I view agile business continuity management from two perspectives.
- Firstly, it's about the organization's ability to swiftly enact its plans during crises. This hinges not only on the quality of the plans themselves but also on the organization's agility in executing them. In many cases, predefined plans may not perfectly fit the current situation, requiring quick decisions to adapt and implement relevant actions.
- Secondly, agility should be ingrained within the organization's culture, ensuring a rapid response to all hazards (sometimes known as an all-hazard response).
From this discussion, it is clear that agile business continuity management can encompass the need for both agile planning processes and the organizational agility to implement these plans effectively without delay. Both aspects are essential for seamless response and recovery.
Narrowing this down further
After hearing these initial responses, there's a need to explore these insights further. Combining the perspectives offered — where agility is synonymous with speed, collaboration, and user-centricity — it's evident that the agile concept, characterised by rules and principles, resonates with our global struggle to optimise time, resources, and efforts, including human capital.
When delineating business continuity management, I segment it into three distinct phases: pre-crisis, during-crisis, and post-crisis continuity.
Agile principles seem naturally suited for the pre- and post-crisis phases. During the pre-crisis phase, agility allows for quick, iterative, and collaborative planning when aligning strategies with user needs – so it is possible to save time, effort, and costs when developing the business continuity plan. However, during a crisis, when the need for a swift response is critical, there is a paradox where quick decisions could prove detrimental. Herein lies the challenge: balancing agility with the need for a measured response to ensure correct protocols are followed, and staff are aware of the role they have to play.
As we transition to the post-crisis phase, agile principles resurface in wrapping up, reviewing what happened, and understanding how these learnings can be implemented in future.
Below, the respondents discuss agility and debate where it becomes essential in the delineated business continuity management process.
Ratna: In the midst of a crisis, the agility of everyone involved becomes crucial. We must expand the definition of agile to encompass the ability and agility of all stakeholders to assess, respond to, and manage incidents effectively and efficiently during a crisis. In today’s world of ‘polycrisis’, where multiple events may take place simultaneously, traditional crisis management approaches may falter. It’s imperative for business continuity practitioners and risk managers to adapt rapidly, collaborating with various stakeholders and external entities to either evade or mitigate the impact of these crises.
During a crisis, the best laid-out plans may prove insufficient, leading to a phenomenon known as ‘crisis paralysis.’ Such scenarios demand a holistic approach, requiring collaboration and agility among stakeholders to effectively mitigate risks and minimise impacts. By embracing agile principles, including collaboration and adaptability, organizations can navigate through these complex crises more effectively.
Helen: This middle phase of an incident is crucial as it bridges planning with response execution, leveraging agile approaches to cultivate flexibility and collaboration within the organization. Through training and education during the planning phase, we equip teams to adopt an agile mindset in their response efforts.
It’s essential not to confine agile practices solely to the planning and post-crisis phases. Doing so would limit our ability to adapt and respond effectively. Instead, we must recognise that plans are not static. They serve as a foundation, but responses must remain fluid and adaptable to evolving circumstances. Agile practices empower teams to review and adjust responses in real-time, leveraging new information to optimise outcomes.
The importance of collaboration
In order to increase the chances of success when building an agile approach, certain favourable conditions can be developed within an organization’s culture.
Anand: During the pandemic, many business continuity plans were rendered irrelevant as events unfolded beyond their scope. Companies that successfully navigated the crisis did so not solely based on their plans, but due to the resiliency ingrained within their teams and organizations. This was achieved by having a mature business continuity management and resilience programme which was part of business-as-usual. Agility is more than just a checkbox in a plan. It's a cultural attribute that enhances the likelihood of success in plans and beyond. While it may not be explicitly stated as 'agile business continuity,' the agility within an organization plays a pivotal role in responding effectively. In customer-facing scenarios, agility prompts immediate engagement with customers. For example, if a vendor senses customer dissatisfaction, they contact the customer proactively (before the customer lodges a complaint formally) and then wors to fix the issue in parallel with the root cause (rather than waiting for full investigations first – which could take a long time).
Multiple streams of effort are often necessary, driven by the inherent agility of the organization. Therefore, agility should complement plans rather than being treated as an isolated component. e.g. creating business continuity plans that are flexible and used as guidance documents rather than rigidly following them. Any deviation from the original plan should, however, not be based on individual’s requirement but agreed after discussions within the CMT. And, once the crisis is over, this deviation must be reflected in BIAs and plans as soon as possible (e.g. not waiting for annual review cycle or waiting for multiple changes before a document is updated).
Following up on Anand’s points that integration and collaboration are important characteristics of agility in an organization, Helen expands more upon what this looks like in practice as well as how these attributes align with business continuity practices.
Helen: Reflecting on my experience at a previous organization, I believe the aspect of collaboration and engagement ingrained within our business continuity management processes seamlessly aligns with agile business continuity management. Throughout my business continuity management journey, fostering collaboration has been integral, whether it's through involving various stakeholders in the business impact analysis (BIA) and continuity planning, conducting training and exercises, or simply building relationships across different business units.
This emphasis on collaboration resonates with the essence of agile business continuity management, as it seeks to cultivate a culture where everyone takes ownership of resilience and business continuity. Additionally, the practice of 'stop and review,' though not explicitly outlined in traditional business continuity management cycles, has always been implicit in our approach. Embracing change and flexibility within plans is vital, even if it challenges the expectations of some stakeholders.
Ultimately, integrating these aspects into an agile framework means acknowledging the importance of having a plan while remaining adaptable and open to adjustments. Agile practices emphasise the need for regular checkpoints to assess and modify strategies as needed, aligning closely with our existing processes.
Transitioning to this agile approach may pose challenges, particularly regarding the existing organizational culture and practices. One challenge could be the culture change required to get everyone to think about resilience and business continuity and own that as a concept. Another lies in assessing the organization's current collaborative dynamics and its ability to swiftly respond to changing circumstances. Evaluating these aspects is crucial in identifying areas for improvement.
Addressing these challenges requires effective leadership and a strategic approach to change management. It involves identifying the right individuals within the organization and leveraging their influence to drive cultural shifts towards greater collaboration and agility.
While introducing agile concepts to business continuity may seem daunting, it's worth noting that agile methodologies are widely recognized across industries. Leveraging this familiarity can facilitate the adoption process and mitigate resistance to change.
Ultimately, success hinges on engaging key stakeholders and fostering a shared understanding of how agile principles can enhance business continuity practices. By aligning efforts and leveraging existing agile knowledge, organizations can effectively navigate the transition to agile business continuity management.
Facilitating an agile approach
Adapting to agile principles and frameworks means more than just being flexible when applying business continuity management. Therefore, in order to tackle the above challenges, it is important to understand what changes might need to happen withing your organization to facilitate an agile approach.
Ratna: As a consultant, my counsel to organizations navigating this terrain would be multifaceted. It's paramount to shed outdated models and embrace agility in business continuity management. The ability to pivot swiftly and decisively is no longer a luxury but a necessity in today's dynamic landscape.
This calls for a shift in how it is conceptualised and operationalised. Gone are the days of rigid, preordained plans. Agility must permeate every facet of business continuity management, from strategic planning to implementation and beyond.
Transitioning to agile business continuity management requires more than just implementing new principles, it necessitates a cultural shift within the organization. Agility, fundamentally, is a mindset that most touch every aspect of operations.
First and foremost, I would emphasise the importance of engaging and educating all stakeholders within your organization. People are the driving force behind any successful transition, and their commitment is essential for embracing agile business continuity management effectively.
Moreover, we must reevaluate existing processes and frameworks to align them with agile principles. This entails a holistic approach, targeting not only individual behaviours but also organizational structures and methodologies.
To put flexibility and adaptability at the forefront, continuity plans must be dynamic and continuously evolving based on feedback and changing circumstances. Integration with both internal and external stakeholders is vital, ensuring that diverse perspectives are considered in decision-making processes.
Securing an ongoing commitment
As explored above, implementing agile business continuity management requires commitment, collaboration, and culture change within an organization. However, this journey must also integrate with other ongoing programmes and operations within the organization.
Anand: It's clear that our organization faces a fundamental challenge: any initiative, including business continuity management, must seamlessly integrate with our ongoing operations without detracting from our core mission. This challenge is compounded by the multitude of concurrent initiatives competing for attention and resources within our organization.
While the concept of agility is not new to us, as market dynamics continually force us to adapt, the real test lies in how we can translate this understanding into meaningful action within our business continuity management framework. Consultants often introduce jargon and complex frameworks, but the key lies in simplicity and effectiveness. Agility should not be an abstract concept but a tangible part of our solutions.
Moreover, agility should not be viewed as a standalone initiative but an inherent quality across all organizational programmes and processes. It's about defining what agility means for us and aligning it with our core values. Whether it's focusing on value, flexibility, adaptation, or innovation, agility should be ingrained in our organizational DNA.
Therefore, when communicating the vision and potential benefits of agile business continuity management to stakeholders, we must emphasize how agility aligns with our organizational values and enables us to navigate uncertainties effectively. It's not just about introducing a new programme but about embracing a mindset that empowers us to thrive in a rapidly changing world.
When deploying any kind of large-scale change within an organization, it is critical to understand the perspective of the wider industry, any available data on what this change may mean, as well as best practice on how to deliver this change effectively. These steps can make the changes more sustainable in the long-term and increase the chances of effective adoption.
Ratna: In today's dynamic business landscape, organizations are increasingly recognising the importance of agility, even if they may not explicitly use the term 'agile.' Consultants play a crucial role in providing this broader industry perspective, offering valuable insights and statistics that can drive decision-making.
By leveraging external viewpoints, organizations can gain a more comprehensive understanding of the risks and opportunities they face. Sometimes, these external perspectives can shed light on aspects that may be overlooked when solely focusing internally.#
Therefore, incorporating insights from consultants and industry data can greatly enhance an organization's ability to navigate uncertainties and seize opportunities effectively.
Anand: It's crucial to leverage established best practices, as organizations often lack the time to reinvent solutions that may already exist elsewhere.
Summarising part 1
While the concept of agility is well-understood and recognized, some organizations might require a degree of cultural change to fully embrace the possibilities of an agile approach.
Many of us view this as yet another initiative in organizations already burdened with numerous programmes. Furthermore, there's scepticism about the applicability of agility in business continuity management, especially considering its origins in software development where the benefits of speed and collaboration are more apparent during the development phase.
The same level of agility may not translate directly to business continuity management operations during a crisis, where time constraints and the nature of the crisis may limit the effectiveness of agile methodologies. Indeed, there's a concern that in the pursuit of agility, organizations may rush decision-making processes and overlook critical aspects of business continuity practice, leading to potential mistakes. Agility in business continuity management planning may not necessarily affect the time constraints and nature of the disaster during a crisis.
We will explore this in further detail in part 2 of this article series exploring agile business continuity management.
Contributors:
-
Helen Lipscombe
Resilience professional
-
Ratna Pawan
Senior Operations Risk & Resilience professional
-
Anand Sampath
Helping organizations with risk management, MD & CEO, Udbhata Technologies
More on
About the author
Daman Sood
International Resilience Trainer & Consultant
As BCI’s Continuity & Resilience Contributor (Global, India & South Asia) Winner 2021, Continuity & Resilience Contributor (Middle East) Winner 2020 and Global Finalist, Merit Award (Global) Winner 2012, Business Continuity Manager of the Year (India) Winner 2009; ILAs’ Global Outstanding Leadership Award Winner 2021; DRII’s Lifetime Achievement Award 2021 Finalist; Finalist in Parivartan Sustainability Leadership Awards 2014, and with over 35 years’ experience in the Industry, I am and Independent Trainer & Consultant. Earlier I worked with Continuity & Resilience (VP, Practice Head, CIO, COO, Advisor); Steria (Head Business Continuity Management - UK, India & Head Green Activities – India; TCS for over 20 years in various roles and positions. I have rich experience in Organisational Resilience, Environmental Sustainability, Business Continuity Management, Risk Management, Crisis Management, Business Excellence and Consulting (BCM, Green IT, Quality/ Process/ Malcolm Baldrige) and Training. I am a Technical Expert & Lead Auditor for ISO 22301 (Business Continuity Management System). I am also an Energy Management Expert (ISO 50001). I am Accredited Tutor for BCS “Foundation Certificate in Green IT” course. I have been a BCI Approved Instructor (2012 – 2021) and a member of the BCI’s Speakers Bureau. I am IEEE Ambassador, Fellow of the BCS (British Computer Society), Fellow of the BCI, Senior Member of IEEE. I am also a member of AIMA (All India Management Association) and Member of DMA (Delhi Management Association). I am a Life Member of the CSI (Computer Society of India). I have served clients in various industries and sectors like IT/ IT-eS, Banking, Finance, Insurance, Retail, Manufacturing, Automobile, Pharma, Real Estate, Marine, Trading, Government, PSU, Telecom, Aviation, Energy/ Oil & Gas, Media, Power etc. I have delivered over 500 talks/ workshops in national and international events. I am an expert in Disaster/ Crisis Simulation Exercises including for the top management of organisations in different countries and industry sectors. With over 9500 hours of training+teaching experience, I am a Certified International Trainer and Certified Corporate Trainer. I am also a Qualified Independent Director. My services cover standards like ISO 22316, ISO 22301, NCEMA 7000, BS 11200, ISO 31000 etc.
