Q1. Although BCM is over 20 years old, there are organizations which are still not familiar with the system. What are the reasons for this?
I would say business continuity dates back to Noah’s Ark. There was a risk of flooding and a business continuity plan - load the animals two by two. This demonstrates resilience which in my opinion is the ability to absorb shock (float the ark) and bounce back (continue life on the planet). So there is nothing new about BCM and apologies for using a religious example to prove my point. But is there anything new about the non-believers saying, “It will never happen to us” and not taking the risk or the contingency arrangements seriously. The reason why, is people think those of us who build arks (these days called business continuity practitioners) are absolutely mad… right up until the time the torrential rain starts and they start getting wet which is always just too late.
Q2. Some executives believe that in times of recession BCM is a luxury and not a necessity. Others claim that BCM is expensive and complicated. What would you respond to them?
BCM doesn’t have to be either expensive or complicated. Nothing is more simple than looking at vulnerability and considering what should be done. I would argue this is more important in recession than any other time since the margins between survival and failure are even tighter. If this is not a necessity I don’t know what is. That is the benefit of planning, we don’t continue blindly on a path of destruction because we are resistant to change; we can take control, we take the initiative and avoid the pitfalls ahead.
Q4. What arguments would you use to convince the BOD of the system’s benefits?
Do your research and find out what they want to achieve. Tell them the destination before they start the journey. This is what they get for their money and how long it takes. Present strategically in alignment with the Board. Ask rather than tell. You have two ears and one mouth, it is prudent to use them in that order. Do your research on what the neighbours have got and more importantly what the competition have got.
Q5. Can you please comment on the following statement: “BCM is Basic Common Sense Management”?
My problem is that BCM is often not presented as common sense. Quite often I see scare tactics of terrorism and earthquake, fire and flood, pestilence death and destruction. I see statistics of “RTO, RPO, MTPD, MBCO, Risk vulnerability times likelihood, residual risk, statement of applicability, policy governance, audit and assurance, resilience and cyber, ISO22301 and BCMS giving competitive advantage with budgets for exercises and a business case for a generator and a secondary site...” Aaaarrrggghhhhh! What practitioners need to do is stop confusing and start simplifying. When approaching the BOD use the language and style they understand NOT the language and style another BCM practitioner would understand. Common sense is remarkably rare in this regard.
Q6. In Greece, the majority of companies are SMEs and 99% of them are not familiar with BCM. Although they are the engine of the real economy, at the same time they are more vulnerable to severe unexpected events and immediately impacted by them. How can an SME enhance their resilience? Would you recommend an SME to start a BCM project and how? Are there any tips and quick wins?
Chapter 3 of “BC for Dummies” is entitled “Quick wins and easy victories”. I know this well because I was the author. There are a whole host of quick and free activities that can be achieved by any small business, indeed any household to increase protection and prepare for contingencies. Do the basics first. Look at preventative measures for fire, power, plumbing, security. Back up data or print out staff, suppliers and customers contact details and send them to you parents to keep off site. Look at the reserves of stock kept and whether” just in time” logistics is too lean. Look at insurance cover, capital adequacy (do we have enough money in the bank to pay our bills for the next 3 months), compliance – could we fall foul of any regulations? Practice an evacuation or invacuation. Talk to your staff about fault reporting and their role in prevention and what are their ideas for a safer more resilient workplace. Do some cross training and multi-skilling of your staff and keep a note where you can get reinforcements and replacements from; such as a recruitment agency that you have already done your due diligence on.