Validation - The only time you’ll be able to blow up a building and get away with it
In the final instalment of this series in which Resilience professionals take an in-depth look at the Good Practice Guidelines, Elizabeth Britton-Jones discusses the validation stage of the BCM lifecycle and why for her this is the most exciting phase.
For me, this is the most exciting phase of the BCM lifecycle. The world is your oyster in terms of limitless creativity in exercising and testing your response plans, solutions and structure to ensure they are right for your organisation. As well as ensuring this - it’s also a great opportunity - and maybe the only opportunity you’ll get - to mess with your senior leaders...what’s not to love?
Validation can come in many forms; varying from organisation to organisation and dependant on the budget you get for this activity, it can feel very different. However in my experience, what seems like a challenge for everyone is getting your colleagues and top management to sacrifice their time to exercise something they think will never happen. Tricky business.
Don’t be a lone ranger
Your BC function cannot be insular - you do not only need buy-in from Top Management. For true organisational resilience you need buy in from all areas of your business, and it’s our job to be the conductor of this.
I like to think resilience resembles a family: a family is your support network, you can always count on key family members for whatever your problem may be to bounce back to your normal self as quickly as possible. It’s important to research your organisational family tree and understand who is out there and who will support you when times get tough.
For me, there’s two types of family members…
Your immediate family:
Your immediate family, or in BC terms what we like to call our “Resilience Channel”. These are the departments or colleagues who stand to attention straight away, who will go out of their way to lend a hand and they’re usually only a phone call away (they don’t ignore you when they see who’s calling!). Take time to understand who these are in your organisation - these colleagues are key.
Our Resilience Channel consists of the following:
• Trading safely & legally
• Data Governance
• Cyber Security
• Fire Health & Safety
• Corporate Security
• Whistleblower
• Travel Safety
• Modern Day Slavery
• Plan owners
We love our immediate family and what we also love about them is that they also give us access to our extended family.
Extended Family:
Our extended family are usually only bothered about our business when they need to be - they don’t always answer the phone, however, as they are part of the family they feel obliged to attend all family events, and most of the time just turn up for the free booze, or in our case the famous “BC Biscuit”. These are usually our tactical teams, who are hugely important so we must keep them engaged to strengthen those family ties. (You can even go a step further an get a family crest! Having one banner for your Resilience Channel allows the flow of communication to be easily identifiable for your organisation: readership will increase, and communications are less likely to be missed).
Why am I talking about the importance of your organisational family? Without a clearly defined engagement process you will struggle to get buy-in for successful engaging exercises, huddles and meetings which ultimately lead to insightful output – because no one will turn up. Without this, we will never be able successfully validate and “continually improve the overall level of organisational resilience” as the GPG states.
Know yourself before you engage your audience
We class BC as a service proposition, we are here to support our customers. By adopting this mindset, we are able to quickly step out of our “BC professional” shoes to truly understand what our colleagues need, want to learn, and what is going on in their worlds, giving us the ability to shape an exercise for the most benefit, output and learnings for continuous improvement.
The GPG explains validation is achieved through a combination of 3 activities – I’m going to focus on my favourite: Exercising.
Developing an Exercise Programme
Who & When?
Exercising and testing should be embedded into your BCP. With this in mind, to keep us on track we have adopted our exercise programme into our Governance tracker. Our Governance tracker is a visual working document which we have a meeting every Monday to review; it’s important to have this weekly MOT (Moment of Truth) to keep us honest with our Governance as a whole. This also helps us establish who we need to exercise and when to ensure we give ourselves enough time to plan and more importantly give our colleagues enough notice.
How?
There are a multitude of ways you can go about establishing a theme for an exercise which the GPG expertly outlines. My advice would be, be creative, however keep your credibility. It’s important not to pick something from thin air - do your analysis and research, planning is imperative.
Just ask & really listen – Again, this is why engagement and knowing your organisational family tree is so important; we ensure we have a clear BC induction for all new senior leaders, as well as ongoing 121’s, we attend huddles and team meetings to ensure we have ample opportunity to tease out any worries and any big future happenings in our business which could benefit with an exercise before launching.
Horizon scanning & PESTLE Analysis - The perfect way to find out what the top risks and vulnerabilities are in the industry. We review the BCI Horizon Scan Report and complete our own PESTLE analysis and Horizon scan annually for our organisation. We then benchmark this against others in the retail industry. This analysis gives us a solid foundation to what is relevant and topical to exercise based on perceived risk.
NO to READY, STEADY, GO!
Put yourself in your audiences’ shoes – if you dive straight in you may lose the crowd.
More often than not, we opt for a scenario or a simulation exercise, depending on the resource, timelines and colleague availability we have. However, before we start any exercise, we always create clear objectives. It’s important to allow everyone some time to digest the “why” and “how” it could happen to them before any exercise begins. In my humble opinion a context slide is one of the most important slides in the exercise – make it relevant, bring it to life.
To help structure and guide our colleagues during the exercise, we also draw them to a key set of “BC values” which we outline at the beginning. These values you can base on GPG PP3 as below:
• People
• Legal and regulatory
• Buildings & Facilities
• Reputation
• Finance
To conclude, as well as keeping BC engaging and alive, successful exercising can help you uncover overlooked gaps, shortfalls and uncertainties within your organisation. Validation is a key part of your BC lifecycle, fail to prepare and you prepare to fail, sometimes you don’t know what you don’t know, so why not have a bit of fun whilst figuring it out!
Read More
About the author
Elizabeth Britton-Jones
Business Continuity Manager
