Adaptive BC has done a great job of stirring up the business continuity profession with some new ideas. At Avalution – we love pushing the envelope and try new things, so we were excited to learn more about the ideas in the Adaptive BC manifesto, as well as the accompanying book and training.
While Adaptive BC identified some real problems with the business continuity approaches taken by some organizations, their solutions aren’t for everyone (and not all organizations experience these problems). In fact, their focus is so narrow, we think it’s of little practical use for most organizations.
Business Continuity as Defined by Adaptive BC
From AdaptiveBCP.org: “Adaptive Business Continuity is an approach for continuously improving an organization’s recovery capabilities, with a focus on the continued delivery of services following an unexpected unavailability of people, locations, and/or resources” (emphasis on recovery added by Avalution).
As is clear from their definition and made explicit in the accompanying book (Adaptive Business Continuity: A New Approach – 2015), Adaptive BC is exclusively focused on improving recovery when faced with unavailability of people, locations, and other resources.
This approach – or focus – leaves out a long list of responsibilities that add considerable value to most business continuity management programs, such as (the quotes below are taken from Adaptive BC’s book):
- Evaluating and managing the overall risk associated with business interruption
- “Risk Management (RM) Belongs to an Entirely Different Discipline” and “RM Takes Time Away from Valuable BC Tasks” (book, page 12)
- Prevention of business interruptions
- “Preparing for Recoverability Is Not Prevention” (book, page 28)
- Survivability or resilience of capabilities
- “Recoverability Is Not Survivability or Resilience” (book, page 28)
- Crisis management (and communications)
- “We have delineated BC from other professions such as crisis management, emergency management, and risk management.” (book, page 125)
- Technology protection and recovery
- “While the principles of Adaptive BC may have implications for information technology disaster recovery, emergency management, life safety, and related fields, they [the Adaptive BC principles] are targeted for the discipline of BC.” (book, page 145)
At Avalution, ignoring item number one is a deal-breaker (and we disagree with the other four, too)!
We see business continuity management as a form of risk management focused on disruptive incidents. Nearly all of our clients think about it that way, too. A risk mindset allows for tight coordination with other risk disciplines, including Information Security, Physical Security, and Compliance. In addition, a risk mindset opens the door to managing BOTH the likelihood of a disruption (not to be confused with threat) and impact associated with a disruption. Adaptive BC is only focused on impact.
As a result, we believe any effective business continuity framework should recognize the need for understanding disruption-related risks and a process to reduce both the frequency of disruption AND the impact associated with the disruptive incident. Adaptive BC fails to consider this very important point.
Real Challenges for Business Continuity
While we disagree with Adaptive BC on the fundamental goals of business continuity, the authors raised some valid issues with current business continuity practices, namely:
- It is often difficult to obtain (and maintain) executive buy-in;
- The business impact analysis and risk assessment often take too long and are difficult to get right; and
- Plans are often too long and complicated to be of value during a disruptive incident.
In our opinion, these issues are best solved by improving your process and involving the right people.
The solution suggested by Adaptive BC in all three cases is to skip performing this work (skip the BIA and don’t engage with management). Unfortunately, this recommendation ignores the successful outcomes delivered by many business continuity programs. Organizations that employ high-functioning programs engage executives to set a scope that focuses on what’s most important to a wide range of stakeholders. Top-down scoping is the only way to help executives (and other stakeholders) understand how the details affect the big picture.
We believe that issues involving protracted analysis activities occur because practitioners are getting stuck in the details and struggling to figure out the right tactics to implement the approaches they’ve learned over time – many of which are performed “bottoms-up” rather than initiated with a “top-down” discussion that strives to understand the needs of stakeholders, which includes – but is not limited to – management.
Bottom-line, we don’t think Adaptive BC identified and solved the right problems, as driving business continuity success is NOT just about methodology or a sole focus on recovery.
Our typical approach to writing is not to come across as salesy. However, criticizing Adaptive BC without offering a solution would be unprofessional. So, with that said, we would like to offer our opinion as to the solution that will solve the real problems getting in the way of practitioners achieving the right level of resiliency for their organization.
We’ve contributed to the design and implementation of hundreds of high-performing business continuity programs and, earlier this year, we began sharing how we do it and how you can apply our proven process to succeed.
We call it the Business Continuity Operating SystemTM, or BCOS.
BCOS solves the problems that we know, based on our 200,000+ hours of consulting experience, are the most important, including:
- Effective stakeholder identification and engagement;
- Focus driven by the strategic needs of the organization; and
- Actionable mitigation, response, and recovery capabilities.
With that said, BCOS is not a radical departure from current best practice (it doesn’t advocate throwing out the BIA for example, but consistently doing it in a pragmatic, top-down manner, with the goal of understanding how the organization operates and delivers value to its customers).
BCOS is a collection of tools and trainings that will focus your program and add energy to your efforts.
To learn more about the Business Continuity Operating SystemTM, please read: Introducing the Business Continuity Operating System.
Or, reach out to us directly – we’d love to learn about your program!
You can contact us, here.
Brian Zawada and Robert Giffin, Avalution Consulting