Business Continuity Strategies Before Plans

Brian Zawada, FBCI Brian Zawada, FBCI | Jun 19, 2019

Instituting and Driving Change Blog Series: Post 1 of 6

 I recently returned from a great conference – unrelated to business continuity by the way – and one of the breakout sessions was focused on driving and sustaining organizational change. I was particularly interested because of our recent roll-out of the Business Continuity Operating SystemTM (BCOS) and how we help professionals successfully navigate through the pain or discomfort associated with change. In this case, taking the time to help them see and experience the power of the BCOS model in driving toward the right level of resiliency.

This session highlighted that effective change management doesn’t focus exclusively on big, sweeping organizational changes; rather, the focus includes the smaller changes too.

Background

With this blog series, I plan to address six industry-wide changes (or issues) that I’ve observed result in significant positive or negative ramifications. I’ll describe these changes using a model by John Kotter on how to help manage change successfully. I’m hoping that the use of Kotter’s model will clarify my perspective and help you, our blog visitor, understand where I’m coming from and how to successfully leverage the concept within your organization.  

Before focusing on the first of the six opportunities I intend to address in this blog series, I’d like to briefly introduce Dr. Kotter’s model by summarizing the 8-Step Process for Leading Change:

  1. Create a Sense of Urgency: Help others see the need for change through a bold, aspirational opportunity statement that communicates the importance of acting immediately.
  2. Build a Guiding Coalition: A volunteer army needs a coalition of effective people – born of its own ranks – to guide it, coordinate it, and communicate its activities.
  3. Form a Strategic Vision and Initiatives: Clarify how the future will be different from the past and how you can make that future a reality through initiatives linked directly to the vision.
  4. Enlist a Volunteer Army: Large-scale change can only occur when massive numbers of people rally around a common opportunity. They must be bought-in and have a sense of urgency to drive change – moving in the same direction.
  5. Enable Action by Removing Barriers: Removing barriers such as inefficient processes and hierarchies provides the freedom necessary to work across silos and generate real impact.
  6. Generate Short-Term Wins: Wins are the molecules of results. They must be recognized, collected and communicated – early and often – to track progress and energize volunteers to persist.
  7. Sustain Acceleration: Press harder after the first successes. Your increasing credibility can improve systems, structures, and policies. Be relentless with initiating change after change until the vision is a reality.
  8. Institute Change: Articulate the connections between the new behaviors and organizational success, making sure they continue until they become strong enough to replace old habits.

My Assertion (Change #1)

In this first entry of the “Instituting and Driving Change” blog, I’d like to start with addressing one of the most important changes I see taking shape, that being the shift from focusing on the plan (document) to identifying actionable strategies that perform in response to a disruption.  

There’s a US military quote out there that’s often cited when it comes to “plans” (with many people receiving credit for it). It goes something like this: “Plans are only useful as evidence that planning took place.”

Another related military quote regarding plans is: “No plan survives contact with the enemy.” -Moltke

The point is that these quotes don’t strongly advocate the need for plans.

However, there’s a military concept out there called “concept of operations” and another related one called “commander’s intent”. These concepts advocate the use of objective setting and then freeing the assigned military unit to creatively consider how to achieve the objective.

Having introduced these two quotes, plus pointing out the concept of “commander’s intent”, I still argue that business continuity plans – as opposed to military plans – are very important IF there’s an underlying strategy the plans are meant to trigger.

Let me explain.

Strategy Before Plans

When done right, a business continuity plan describes how to respond, how to recover, and how to operate differently until returning to normal. If a given part of your organization – let’s say a department at your corporate headquarters – established business continuity requirements during the business impact analysis (essentially, a “commander’s intent” focused on downtime tolerance, minimum capability needed, and resource dependencies), the next step in the planning process is all about selecting recovery strategies and solutions to meet the defined business continuity requirements. The strategy selection process ensures alternate resources are available and identifies (or develops) manual workarounds and alternate procedures. The procedures necessary to source and implement alternate resources, and the procedures describing how to prepare to continue operations – possibly differently – are the core elements of a valuable, actionable business continuity plan.

This documentation is valuable because the people who will actually use the plans don’t think about “recovery mode” every day and value a reminder on how to recover, including how to operate differently until returning to normal.

But achieving this value is contingent on coming up with strategies that address the following five issues:

  1. Where does my team go to work if my primary workplace is unavailable?
  2. What are alternate sources of staff if we experience high absenteeism?
  3. If a key piece of equipment is unavailable, how do I source a replacement or work differently?
  4. If my business applications and data are unavailable, what do I do while IT is recovering them?
  5. If a key supplier is down or unable to provide my team its required products and services, what do we do?

So many people think plans are THE deliverable from a best-in-class business continuity program. But the problem is that plans are too-often packed with boiler-plate language and typically fail to differentiate among different parts of the business. The reality is that strategy determination, addressing BIA-derived business continuity requirements, is a pre-requisite to creating great plans! Otherwise, the plans are largely useless (or too generic), and therefore you will likely fail to keep people engaged because they will fail to see the value in planning.

Back to Dr. Kotter’s Model

If I’ve sold you on the concept of being deliberate about selecting great risk mitigation, response, and recovery strategies, then how do you use Dr. Kotter’s change model to get other stakeholders on board with your shift in emphasis from plans to strategies?

I’ve provided some ideas below for how to address each step, as it relates to changing the focus from plans to strategies. The following examples can be used to influence the thinking among internal business continuity professionals, as well as part-time program participants (such as those responsible for writing and maintaining plans):

Create a Sense of Urgency

Example: “Today’s plans aren’t actionable; they are bulky, and we don’t really see the need to use them in the response to a disruption. At the same time, few people are confident we know how to recover well, and often make the same mistakes we’ve made in the past during exercises. All in all, we’re unnecessarily at risk for a prolonged outage unless we take action.”

Build a Guiding Coalition

Example: “Next month, we’re going to use one of the monthly Business Continuity Operating SystemTM stakeholder meetings (the audience being the different business unit business continuity coordinators) to sell participants on how Q3’s primary goal is to create actionable plans that describe how to recover and how to operate differently until returning to normal. We’re going to introduce the BCOS Strategy Tool to bring some rigor to the selection process. Perhaps most importantly, I found a volunteer business continuity coordinator who’s offered to lead this process and there are three others that want to serve as members of the core team to get the word out on the importance of this effort. So, they are going to lead the discussion, not me!”

Form a Strategic Vision and Initiatives

Example: “When we’re done with this effort, not only will we be more confident that our different business continuity teams will respond faster and recover in a more timely manner, but we’ll be confident in our current strategies and clear on where we have gaps to close. The goal is simple – shorter, more actionable plans that will add value when responding to a disruption.

Enlist a Volunteer Army

Example: “In Q3, we’re going to look for a group of volunteers to identify ways to make plans more actionable and therefore more valuable during an actual disruption. We’re hoping these volunteers can then sell the outcomes of their work to other business continuity plan owners, so we get proposed changes to take hold.”

Enable Action by Removing Barriers

Example: “There are four barriers we plan to address. First, we’re going to create on-demand training that compares a great plan to one that offers little value. Second, we’re going to make the BCOS Strategy Tool available after introducing it during the training. Third, we’re going to streamline the business continuity plan template and make it available in our software application, with prompts on what’s expected. And, fourth, we’re going to help transition good content from the old plan document to the new template so that the different planning teams can focus on strategies and solutions for the five resource dependencies.”

Generate Short-Term Wins

Example: “Our centralized, core business continuity team will focus on coaching and QA. But rather than making this feel like an audit, we’re looking for award winners… people that created actionable, value-adding plans, as well as planners who did a great job of describing how their team might operate differently in order to minimize stakeholder impact.”

Sustain Acceleration

Example: “We plan to use exercises to demonstrate the need for actionable plans and procedures. We’ll sing the praises of the successful Q3 volunteers, and work to identify specific continual improvement actions to enable others to pick and describe the best, most appropriate strategies. We’ll push hard in Q4 through influence!”

Institute Change

Example: “In the Q4 management review, we plan to issue our awards to the leadership team and highlight areas where we can do better. We’re going to quantify the number of hours used to improve the plans, the number of pages removed due to the transition to our new actionable, streamlined plans, and the outcomes from our new metric coming out of the exercises: the CONFIDENCE score.”

Conclusions

Strategy determination and selection is a core element of a successful business continuity program. Plans are helpful, but only if they include content that helps drive a successful response and recovery effort. Including only boiler-plate content – or content that is not intuitive or useful during a disruptive event – won’t get people to invest the appropriate amount of time to create and maintain these playbooks.

Be deliberate and help people through the change at hand.

If you’d like to learn more about what a great strategy selection process looks like, or Avalution’s Business Continuity Operating SystemTM (BCOS) tools that contribute to achieving success, please contact us.

_____________________

Brian Zawada, Avalution Consulting

Business Continuity Consulting  |  Business Continuity Software