This week I have been at a company in the Netherlands teaching the two day BCI Introduction to Business Continuity course.
The company, based in The Hague, is a subsidiary of a large Middle Eastern company. During the discussions and exercises I became very aware of how the culture of the company affects its business continuity management system.
The starkest example came when we were talking about the organisations’ potential incident management structure. Each group of students had to design a structure that they thought would best suit the company. Within a largish company I would expect there to be a number of operations teams, a tactical team and then a strategic team. Both teams drew their structures, which contained two teams, and they were almost merged together.
When we discussed the roles and responsibilities of the teams, it became very clear that their tactical team are not empowered to coordinate the recovery and would need to wait for instructions, or at least permission from the President (CEO) of the company, before they could act. They explained that although the company is based in the Netherlands, its management structure is very hierarchical and is very much influenced by that of their parent who is based in the Middle East. Therefore the tactical team had to take instructions from the strategic team in order to invoke the plan and put into action the agreed recovery strategies.
We were not going to change the culture of the company and so we brainstormed ways to make the business continuity response work within the existing culture.
A couple of good ideas were put forward:
- Firstly, that all response plans and strategies should be signed off by the President prior to any incident so that he is comfortable with their content, the level of recovery and their RTOs. They would also look for authorisation in advance to be able to implement plans without his express permission, pointing out the importance of a speedy response to an incident.
- The second idea was to ensure that there is a robust methodology within all plans for contacting the President. This included knowing his whereabouts at all times and ensuring that there are a number of different ways of contacting him.
As business continuity people we have to be aware of our organisations’ culture and work within it, sometimes by having to put into place innovative solutions to achieve our requirements. To try and go against the organisations’ culture or put in place a ‘standard’ recovery will not work and may result in the response being unsuccessful!
