BCM is an acronym that many people are still unfamiliar with. This article provides an overview of what BCM is. It also highlights the importance that BCM holds for individuals and companies given today’s complexities. And finally, it proposes the adoption of BCM to promote resilience through the growing and increasingly devastating impact of threats to people and organizations.
What is BCM. It is an acronym that stands for Business Continuity Management. Business Continuity Institute (BCI) defines BCM as a ‘holistic management process that identifies potential threats to an organization and the impacts to business operations those threats, if realized, might cause, and which provides a framework for building organizational resilience with the capability of an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities’ (2013). Crisis management essentially becomes a part of BCM. The cycle of Preparation, Response, Recovery, Resumption, Restoration, and Return to Normalcy details BCM’s framework.
The Preparation Phase involves testing the organization’s Business Continuity Plans, reviewing and updating it, the conduct of training and communication to all potential participants, employee readiness, emergency preparedness, workplace safety practices, and vendor and external agency readiness. The Response Phase includes emergency recognition, notification and escalation, emergency response, security evacuation, medical attention, facility lockdown procedure, and salvage/assessment. The Recovery Phase comprises resource management, security/facility protection, logistics, transportation, communications/media, computers/systems, and supplies/services/utilities.
Meanwhile, the Resumption Phase is about minimum business continuity requirements, key functions/equipment, alternate business location, supplies/distribution, key dependencies, and external agencies. The Restoration Phase rebuilds facilities, equipment/systems, logistics /supplies, manpower, and transportation/distribution. Finally, the Return to Normalcy Phase focuses on bringing everything back to its pre-crisis state, the conduct of financial reviews and insurance, and branding/communications. (BCI, 2013)
It was not until 1994 that BCM as a field of focus was formally established. In hindsight, I would say it is a blessing that BCM today is a doctrine with its own growing body of knowledge. There are two general types of BCM. One is your day-to-day trouble-shooting procedures to quickly resolve any operational issues to minimize disruption and restore normal business operations without further delay. Every value-creating business pretty much has this type of operation whether it is engaged in manufacturing or distribution of finished goods or services. However, there is also a second type of BCM whose usefulness and frequency in the world are growing. This is the BCM that is designed to address occasional but uncontrollable, unpredictable, and very disruptive threats to business continuity. Classic examples are natural or man-made disasters that disrupt businesses not only for minutes or hours at a time but entire days, weeks, and months!
Wars, epidemics, terrorism, economic depressions, and natural disasters like typhoons, strong earthquakes, floods, fires, tsunamis, etc. are all major threats that disrupt any organization whether that organization is prepared or not. Today’s world certainly does not lack its share of disruptive challenges. Following the major world and regional wars was 9/11 which suddenly redefined the way business operates as a critical vulnerability with wide-ranging impact. Almost not a day passes that a certain area in the world does not experience the effects of global warming that Al Gore so warned us about only a decade ago. It is therefore the intent of BCM to at least minimize the adverse impact of any disruption to businesses that have it. There is a saying in the military that goes: ‘It is better to sweat in training than bleed in battle.’ A similar principle operates in BCM although this best practice standard adopts a lot more holistic approach.
It is probably a no-brainer to sell the benefits of a BCM program to any entity that wants it in order to mitigate the adverse impact of an impending threat. Citing a real world scenario is probably the best way to illustrate this. In California, people are bracing up for the day the San Andreas Fault finally gives. On their own, residents are ready with their survival kits readily tucked in their cars, homes, and places of work. Here in the Philippines, the current talk of the town besides the upcoming elections is the reportedly overdue cataclysmic movement of the West Valley Seismic Fault System that runs from San Jose Del Monte, Bulacan to Cabuyao, Laguna.
In preparation, what have the government and private companies been doing? Well, many companies now have documented Business Continuity Plans. Prior to coming up with one, a risk assessment had to be done as it is after all the basis of the BCP. The site BCP is the mother plan. Its off-springs are the Incident Response Plans (IRPs) that contain the more detailed information about who will do what when where and how. Employees have been encouraged to build up their survival kits for themselves and their families. Earthquake drills and table-top exercises have been conducted based on the organization’s BCP. Regular communications cascading what people should do and creating awareness of the BCP are ongoing. Continuing education and training led by invited experts from PHIVOLCS, OCD-NDRRMC, and the medical fields are likewise in many company agenda.
On the other hand, the government has been preparing its own plans and executing drills and exercises to simulate an effective response to an earthquake threat of destructive intensity (7.2+). Last July 23, 2015, a nationwide earthquake drill was implemented by the government to test and assess general preparedness and response to the threat posed by a theoretical 7.2 intensity earth shake from the West Valley Fault. Key stakeholders like the variously-affected local government units, fire and medical emergency services, the Armed Forces of the Philippines, Philippine National Police, etc. showed up showcasing their various capabilities. On July 30, 2015, a Metro Manila Earthquake Drill shall have been conducted simulating a scenario that involves ground-shaking for 45 seconds beginning at 10:30AM. The simultaneous drills encourage all to do the standard ‘Drop, Cover, and Hold’ drill followed by general evacuation to open ground. In the real scenario, the plan of the Metro Manila Development Authority is for all stakeholders to evacuate to the designated evacuation area for each quadrant. These areas are: Veterans Golf Course, QC – North Quadrant, Intramuros Golf Course – West Quadrant, Santolan Station – MRT Depot, Pasig City – East Quadrant, and Villamor Golf Course – South Quadrant.
An organization’s BCP is supposed to contain all the necessary details that will allow that organization to adequately prepare for an impending threat like the West Valley Fault and to mitigate the adverse impact of that threat to the organization’s business operations as well as the well-being of its people and their families. Other BCPs addressing other threats should likewise be in an organization’s emergency preparedness library. The BCPs and IRPs are live documents and should be constantly updated and validated through drills and exercises. The same should be true for the Business Impact Analysis (BIA) which is the risk assessment that gives rise to the BCP as its basis.
Concluding, there is no doubt that BCM is intended to be helpful to an organization toward preparing for a threat, and having the ability to adequately respond, recover, resume, restore, and return through this threat. But, BCM has to be done in the proper manner avoiding short-cuts through its processes. It is hard work and entails investment of resources. However, its benefits surely outweigh its costs.
