This week’s bulletin has been provided by James Royds (FBCI) who gives an insight into the effect of COVID-19 on organisations’ business continuity plans and discusses why we should be ready for potential future disruption.
The last three years have, rather surprisingly, passed more quickly than I imagined. I think this is because at a fundamental level, I knew there was a process through which we would all be forced to travel, united as one, in response to the pandemic – a global event well outside our local abilities to control quickly. That process underlines the emergency management and business continuity methodology that we practice today. What was significantly different this time was the scale, complexity and duration of the pandemic itself – an event, I would argue, which was well-beyond the limitations of conventional business continuity planning as we know it.
Pre-pandemic, it was normal for business continuity planners to consider the impact of an event lasting 30 days (this idea has its roots in IT service continuity planning) the characteristics of which lend themselves to the short term. Sometimes we might have planned for impacts lasting 60 days, but rarely more than 90 days or three months. But the pandemic changed all this. Instead of the short-term horizon, we have to start considering planning for events – the impacts of which will last much much longer. Does your business continuity planning consider this? Does your training consider this? How confident are you that you could write a business continuity plan today for an event which might last even longer than 3 years?
What I have learned as a business continuity practitioner during COVID-19 is that many of the old planning certainties have changed. We must start thinking about, and therefore planning for, events which last a great deal longer than we have been used to. The biggest change to consider therefore, is the duration of an event. We need to understand that the duration of an event itself affects all business continuity plans and planning, and the impact timeline we need to think about.
In the wake of COVID-19 we have been forced to innovate, reinvent, and improve the way we think about, and therefore do and deliver, business continuity. The first thing we need to do is invoke our sense of curiosity and unleash the power of imagination. This is to enable us to really think about, and therefore imagine, what the future holds. The future has to be felt or imagined long before it’s experienced. Because the future is unknowable, we can only imagine it by developing a strong sense of curiosity. Future business continuity planners will help their organisations by developing a very clear picture of what the future holds post-disruption.
There will be less reliance on documentation since verbal instructions are generally much more effective during emergency response than reading the written word. It’s one of the reasons why business continuity plans often don’t get read – they either take too long to read, or fail in their duty of imagining what the future will look like. I have seldom met anyone who is truly familiar with the contents of a business continuity plan, except perhaps the plan author. Perhaps this is because the written word is counter-intuitive and what we strive for is clear verbal direction and instruction in times of deep corporate anxiety. It’s why, for example, cabin crew on aircrafts talk through the safety instructions so passengers can hear the proposed emergency procedures, rather than the crew relying on passengers reading them. Most people never bother reading them. In the last 12 years of flying around the world I don’t ever remember seeing anyone read their safety instructions. Next time you board a plane, try and observe how many people actually read their safety instructions. If you insist on your colleagues reading their business continuity plans, what behavioural expectations do you place upon them? In other words, how do you encourage or develop behaviours in people which will ensure they fully understand their plans and follow them.
Think long and hard about the behaviours you need to develop to encourage people to become more familiar with their business continuity plans and the planning process to develop them. Your plans and planning process may well be dependent on huge amounts of written documentation, paper-based systems, and software. How does this really help you in a crisis? Are there other ways of achieving the same ends – hearing a plan, for example, to become familiar with it, rather than relying on reading it? Which method best invokes in you and your colleagues a strong sense of curiosity and power of imagination?
Moments ago I claimed that the future is unknowable. We can of course predict it, but we cannot know it for certain. So we are left with a stark choice. We can either imagine the future, or not imagine the future. If we accept the idea that we can imagine the future, then we can imagine what corporate life might look like when it has been severely disrupted.
In preparation for the future, we have to imagine how we would respond and cope with disruption when it occurs and for much longer periods of time. Thinking, imagining, and forward planning, is undeniably hard work and made doubly so when we have no idea how long an event might last. No one I know or have met since COVID-19 began – not even governments around the world I would suggest – had any idea how long the pandemic would last. Perhaps a few months. But not three or more years. And what about people suffering from “long COVID”? They are trapped in an endless cycle of ‘why me?’ and ‘when will I get better?’ Thinking about ‘when’ is a clue about how we imagine the future.
Being able to imagine the duration of an event therefore, and extend the mental timeline we carry with us in our heads when we think about the future, is vital if we are going to improve our ability to plan for, respond to, cope with, and recover from disruption with impacts which last for a much longer time than we are used to. Three or more years is a long time in any emergency management situation. Normalisation will continue for more years to come. And we haven’t even begun to understand the unintended consequences yet. What we all share in all disruptive circumstances common to everyone, everywhere, regardless of the size of organisation we work for, is managing time and the effects of disruption over short, and now much longer, periods of time.
The idea of time, or event duration, and recovery timescales in business continuity planning – as indeed in business-as-usual planning – are inextricably linked. It is the relationship between these two constructs and their links with two well known risk variables – impact and probability (with which I am sure you are familiar) – that I would like to continue exploring in this bulletin today.
Let’s start by imagining the business of time and how we might improve our understanding and appreciation of its effect on operations and our capabilities as business continuity practitioners to help organisations plan more effectively. To do this I invite you to imagine a timeline against which all your collective corporate endeavour is mapped and measured. Let’s call this the business-as-usual timeline (Figure 1). For the sake of illustration, it is a horizontal line running from left to right, or west to east.
Now imagine another timeline – vertical – running south to north. The intersection point, where the two lines cross each other is the point where disruption occurs. To the left of the vertical line is life BEFORE an event. To the right of the vertical line is life AFTER the event. The vertical line is life DURING an event.
There is an immediate tension which arises and which affects decision-making. The business-as-usual and business continuity timelines are pulling in different directions. Not in opposite directions, but at right angles to each other. For the business continuity planning process to work and for crisis response measures to be invoked, both lines must be heading in the same direction. They must align and both point in the same direction. If they don’t, our ability to respond to, and recover from disruption, may be severely compromised. The link between the different stages BEFORE, DURING and AFTER joins them in a continuous process, thereby making no single discipline, whether it’s risk, crisis, or business continuity, more or less important than the other. They are weighted equally as phases in a simple timeline stretching into the future.
Historically, this timeline for business continuity planning purposes, as I have already suggested, would have been measured out to 30, possibly 60, days. This is important because incidents don’t always follow the regularity of our imagined clockwork, nor do they always follow the same direction of travel. The pandemic proved this beyond reasonable doubt. As the scale of that event became greater, the effort to synchronise in time and space became much more complicated.
Yet what we know with precise certainty is that we cannot make more time. At a granular level in a specific organisation, we can get more resources if we need them. People can be deployed elsewhere, premises can be repurposed, processes can be switched from one network to another. Even suppliers can be changed at short notice, subject to contract. But we cannot alter or change the direction of time. If your timeline points to the future travelling from west to east, then so must all your planning activity. Once the clock is ticking, it cannot be stopped. Or reversed. There is only time in the future against which we measure success or failure. This is why we set Recovery Time Objectives – future points in time – which we aim to achieve in order to avoid breaching a Maximum Tolerable Period of Time (MTPD), or a future point in time we strive to avoid at all costs.
So we only have the time we are given: we cannot make more time. As business continuity planners our job is to set a target which becomes an assumption or aspiration about the future which we set in the present – long before an event kicks off. We therefore have to imagine the future and develop our sense of curiosity. We have no other choice.
I would now like to invite you to imagine an event in the future which causes disruption. It might be a fire in your main buildings, a cyber attack on your network and IT infrastructure, it might even be another pandemic, or an unprovoked act of international aggression which disrupts supply chains and stops your business or organisation in its tracks. The cause in this instance isn’t as important as the consequence, so think of something to which you and your colleagues can easily relate to, or identify with, and is credible given the context of your operating environment.
Risk management will assess the threat and its ability to exploit a vulnerability and may conclude that the worst possible scenario may be one that only happens once in a 100 years. Consider how this calculation makes you feel. If you ‘know’ an event might happen in the next 100 years, how does it make you feel? How do you behave in response to this information? How do you plan for it?
Does it (a) make you think it won’t happen any time soon and therefore you can relax and not consider it for many years? Or does it (b) make you think that because it’s a 1/100 year event that it might happen today, tomorrow, or early next week?
Here’s the point: you can choose how you react to the risk planning assumption. You can either choose not to do anything to prepare, or you can choose to make plans and be prepared for an event tomorrow or next week – even though you still have no idea how severe it will be or how long the disruption will last.
The risk management variables of impact and probability don’t, as a matter of routine process, encourage us to imagine the duration of an event. It helps us to consider severity or impact but it doesn’t measure the duration of impact and I suggest that this prevents us, from a behavioural point of view, from not doing enough to prepare and demonstrate being event-ready. That’s why as business continuity planners we try to imagine the MTPD. A future point in time which we try to avoid because if we go beyond that imagined point in the future, the adverse impacts over time are in danger of causing catastrophic failure from which there is no way back, or that there is no point in continuing.
I want you now to imagine that the disruption of an event with a 1/100 probability comes as a complete surprise next week and which gives you and your colleagues a paralysing corporate shock. Despite this, the point which unifies all planning assumptions, is that there is corporate life before an event. And there is a very high probability of corporate life after an event – if people do the right things and make the right decisions in the right order at the right time regardless of how unprepared they are for disruption. The period of time of disruption – the high intensity phase – together with priorities decision-making, is what we call life during an event.
Life during an event is all about managing the duration of the event while minimising the severity of the consequences. In other words, how long will disruption interrupt business-as-usual. This is something we need to understand and appreciate in order to appreciate how long disruption will last and our tolerance to absorb it. This is about understanding what is urgent, rather than what is important.
These three phases of time – before, during and after an event (or the past, present and future) are the three contextual phases of any incident for any disruption in any organisation anywhere in the world, and they provide us with a framework to understand the nature of time and the duration of disruption. It doesn’t matter in time if an event is classified as having a probability of 1/100 years. It if happens next week regardless of its probability, we must be event-ready and demonstrate capabilities to match.
Being event-ready therefore is a capability which an organisation must take seriously if it wishes to be taken seriously. Readiness or being ready for disruption is the attribute or quality we most need to nurture, as this will help us overcome the anxiety about future uncertainties.
You can start developing this attribute as soon as today. Why wait until tomorrow? It might already be too late by then. So next time there is a major event anywhere in the world, convene your management team and ask yourselves if the event you follow happens to your organisation tomorrow or next week, consider how ready you are to cope with the consequences. Are you prepared? Are you event-ready? These two questions will help you to develop a sense of curiosity about the future and turn your imagined future into a tangible reality.
In conclusion, time matters because it’s all we have to measure our relative progress and success. The faster an incident is resolved, the lower the cost of disruption, and the quicker you return to normal (Option A) or decide to reinvent a new normal (Option B). Time matters because without it we have nothing to determine, nor synchronise, the priorities and order in which we address our priorities.
Time matters because it provides us with the means to segment the future and therefore create phases of activity. For example, in Phase 1 (before an event), we use risk management techniques to make predictions about the future. In Phase 2, we use emergency response and crisis management to manage the situation during an event. In Phase 3, we use business continuity plans to focus on maintaining the business priorities which keep the organisation going. In other words, continuing the urgent priorities while discontinuing those activities which we consider as not being urgent.
Curiosity is important because without it we cannot think of, and ask the right questions, about the future such as ‘what if’ and ‘if that happens to us what would we do’.
The power of imagination and sense of curiosity helps us to cope with the fear of uncertainty and anxieties about the future. It provides us with a creative road map, a route card, or a measurable process for facing down uncertainty, while enabling us to consider much longer planning timelines to manage disruption.
BCI Europe Awards 2023
We are delighted to announce that BC Training have won ‘Continuity and Resilience Provider for a Service or Product 2023’ and our Director, Charlie Maclean-Bristol (FBCI), has also gone on to win Continuity & Resilience Volunteer 2023 at the BCI Europe Awards 2023! We are extremely proud of our achievements and we would like to thank our customers and readers of the bulletin for all of their support over the years. Congratulations to all of the nominees and winners!
