I read an interesting piece of thought leadership today – Luc Klein’s paper that challenges us to think critically about what BCM should be, entitled “Is Business Continuity Management a misnomer?”
If you haven’t heard about this paper you soon will, and you should click through and read it.
The author argues that BCM as a discipline, needs to make a decision about its direction and focus. Does if continue down its current path of being focussed on operational recovery – or take a new road to address all the risks that can lead to an entity going out of business.
I agree it is a misnomer, for two reasons;
- first, and the main thrust of Klein’s argument, it does not really address the full spectrum of risks that can cause a business to stop.
- my other reason would that the “management” part is the misnomer. It is a ‘discipline’ that is not practiced by managers in an organisation.
Klein also observes that recovery and incident management plans normally do not address the areas covered by ‘Strategic Risk’ and ‘Financial Risk’.
Klein sees ERM as the discipline that looks at both cause and consequence, while BCM is only addressing the consequence. BCM is concerned with what happens if the ERM controls fail. In truth it has been like that long before anybody added the ‘E’ to Risk Management. It is interesting that he does not see BCM as part of the risk family. ERM is made up of different type of risk domains;
- Strategic Risk
- Financial Risk
- Operational Risk
- Legal & Compliance Risk
- Environmental, OH&S Risk
There are probably more cases where a business has failed due to strategic or financial risk failure, than has occurred as a result of fire, flood or asteroid strike.
I was disappointed to find no reference to AS/NZS 5050 – the Australian Standard that addresses the management of “Disruption-related risk”, and which positions what Klein is calling BCM clearly within the risk management domain. My series on AS5050 is still one of the most frequent searched on the blog. This standard was also labeled as heresy by the BCI so would qualify as another suggestion for change of focus and direction for the industry.
Klein suggests there are two potential ways forward;
- rename BC to Operational Continuity in order to clarify the discipline based on what it generally does, this would include narrowing the defined range of incidents that the discipline can respond to – or
- broaden the focus of BC (as practised) to include the impacts that flow from Strategic and Financial risks.
- I was disappointed with Klein’s analysis around this point. Essentially he becomes trapped in his own critique, where BCM can only be talked about if it is associated with the activation of a specific type of recovery plan.
- Many financial institutions have response plans to liquidity events – and I know of some clients who will trigger these plans based on a specific % change in the local Share Market index.
- Rarely are these plans included in the domain of BCM, nor developed by the BC folks, for all the reasons Klein outlines.
- They represent sound disruption-risk management (and therefore the new BCM order he is encouraging) – and if BCM is to have a broader meaning then we need to stop defining the concept in terms of response and recovery plans.
I am going to talk a little more about these aspects tomorrow.
Are we actually at a crossroads?
Leave a Reply