Fall World 2014

Conference & Exhibit

Attend The #1 BC/DR Event!

Summer Journal

Volume 27, Issue 3

Full Contents Now Available!

Heads In The Sand

Business Continuity as a Social Responsibility

A disaster at its fundamental core is about people. Even when a core technology component is offline and it affects the ability of an organization to operate, it still impacts people: employees, vendors, suppliers, stakeholders, investors and customers. Each organization is responsible to ensure a business continuity management (BCM) program to minimize the impacts to all of these groups of people.

Responsibility can be defined as “having the capacity to make moral decisions” while social can be defined as “living with, or being exposed to, others in a community.” When brought together, organizational social responsibility can be interpreted as acting in an ethical manner to support the ongoing development of its workforce – including their families – and the local community, which it serves.

In his book Human Universals (1991), Donald Brown describes five universal traits (among many others) that are common to all civilizations, regardless of geographic location, language, religious or spiritual belief; a fear of death, a fear of outsiders, a fear of insignificance, a fear of the future, and a fear of chaos. A sixth can be added with specific regard to the BCM industry: a fear of truth.

It’s ignorance of these fears that corporations are not recognizing when it comes to their BCM programs. For clarification purposes, ignorance is not used in a derogatory sense but rather as a “lack of knowledge or understanding.” The lack of knowledge and the ignorance of these fears may be what will hinder corporations from establishing strong BCM programs and the ability to increase their social responsibility. Those that do have a program may discover why their programs aren’t as effective or as successful as it could be. Understanding these fears will help.

Ignorance of Security

An ignorance of security incorporates the idea that all people have a fear of death. To reduce a person’s fear of death and reduce the ignorance of security, a corporation can increase its attention to physical/facility security and information security.

Facility security refers to the building in which people perform their job functions. If the facility isn’t secure, then it’s open and easily accessible for anyone to enter. If the trespasser is of an unsavoury type, this could mean the destruction and/or theft of corporate property and in extreme cases, the potential for employees to be harmed.

A simple idea is to ensure that every person entering the facility must sign in and/or have a security pass, if not; they’re stopped at the facility’s door. Another strategy is to ensure there are alarms placed on all doors to the facility so that if any unauthorized entry is attempted security personnel are notified and can investigate. Employees want to feel secure within their offices and not work with under a constant state of fear where there is the potential threat of harm in their workplace.

If information security issues occur, there is the chance that components of the BCM program would be activated because the security breach – in many instances – can cause a crisis. With BCM overlapping in some instances with security protocols there are common processes that can be implemented to minimize the potential for security failures and increase employee protection, as well as the protection of client data.

Corporations that understand how to address a fear of death, helps employees feel safe and secure in the workplace, ultimately reducing their concerns, issues, and fears.

Ignorance of Respect

An ignorance of respect builds upon the fear of insignificance, where employees don’t feel appreciated. Though many corporate vision and mission statements say the No. 1 aspect of the corporation is the workforce, employees have difficulty believing in such grand sentiments. This may be a result of not having something such as an employee assistance program (EAP) in place or the lack of basic recognition of the role people play within the company. Sometimes management representatives will use their titles and designations to get things done, rather than showing respect for their employees.

One of the simplest ways – yet an often overlooked method – is to show respect using two phrases: “please” and “thank you.” These are two of the most under-utilized words in today’s corporate world. Each day numerous small crises or operational incidents require a person, or a team, to investigate and resolve any issues that impact clients and customers. That’s one thing, but where is the “thank you” when it’s resolved? This makes people feel undervalued, because they are investigating and resolving issues and preventing them from becoming full scale disasters.

With a BCM program there must be specific roles and responsibilities to ensure that those who are knowledgeable in a role during normal operations are the same people responsible for those operations when disaster strikes. To take away those responsibilities and reassign them – either knowingly or by force – shows a lack of confidence in the people who perform their daily activities. If those with the skills and knowledge aren’t good enough for disaster teams, who is?

This is the same difficulty encountered by BCM. No one person in the corporation can ever know every process or activity. Yet, when a disaster occurs, some corporations turn to one or two people to make it happen. The reigns of responsibility are handed to someone who doesn’t have that level of responsibility on a daily basis. They can’t simply take on all the responsibilities that exist within the corporation. To suddenly overload such a person shows a lack of respect because others – such as senior management – are seen as offloading their responsibilities and accountabilities.

People want to feel important and a part of the corporation; they don’t want to be insignificant. Corporation with an ignorance of respect for their workforce undermines the abilities of those who have the ability to manage crises and contribute to ongoing response and mitigation strategies during a crisis.

Ignorance of Community

An ignorance of community is just as it seems; it deals with communities and the universal fear of outsiders. An outsider, for the context here, refers to internal and external communities that may or may not be directly influenced by an organization and its operations. An outsider can also be considered as one who is not part of a recognized group or society and may be viewed as a stranger.

Many in a community won’t be concerned with a corporations BCM program until such time that the corporation experiences a disaster – or the community itself does. Many corporations won’t think about a community until there becomes a need to enter the communities market. Then the outlook changes, and the corporation embraces what makes the community special; it sees how it can benefit from the community and its citizens – and hopefully understand how it will impact the community.

Within each organization are many groups of individuals with common interests brought together to intermingle in a way that has nothing to do with the company itself. People can meet and find they have commonalities in areas such as favorite musical groups, language, favorite sports teams, or a common hobby. These create communities within an organization and can bring people together from all over the organization, not just one specific department. Corporations must be aware that these internal communities and not have an ignorance of these established relationships among employees that can go beyond that of co-workers. When these relationships occur, employees begin to share information. What they know, and what they don’t know, only increases their fears.

An organization may be made up of employees and internal communities, but all employees are part of the surrounding community in which they live. Understanding this will help immensely with dealing with the fear of outsiders. In fact, if all corporations understood how to manage crisis/conflicts internally, they are better prepared to understand the impacts they have externally. To paraphrase an old adage, “You must take care of yourself before you can take care of others.” Therefore, if a corporation takes care of its own interests first it can then reach out and care for those in the external community.

The fear of outsiders and the ignorance of community begin to fade as people are brought together to work and understand each other. If a corporation doesn’t have a BCM program in place that considers the impact it has on its external communities, the community itself can turn against the company, seeing it as a pariah rather than a contributing and helpful corporate citizen.

Ignorance of Authority

An ignorance of authority incorporates the idea that people have a fear of chaos, something that can be attributed to dire BCM programs and corporate responses to disasters. When a disaster occurs people feel threatened, scared, and wonder what’s going to happen to them and their families. There must be people who have specific responsibilities assigned to ensure encountered issues are addressed and coordinated effectively. It comes down to leadership.

Leadership during a crisis is crucial. You can compare it to a ship trying to navigate stormy seas without a compass; you won’t get anywhere. If there’s no noticeable leader, people will make the mistake that no response is being coordinated and will vocalize it. Good leaders help bring direction and stability to what might often seem as insurmountable circumstances. A leader must stand in front of everyone and provide assurances to those affected by the disaster that their well-being is first and foremost, while also providing guidance and direction to those implementing appropriate plans and procedures.

Then there is the opposite – leaders that don’t believe in strong BCM programs but still believe they have the skills necessary to lead a corporation through a disaster.

Mighty Mouse, a cartoon character in the 1960s, illustrates this point. His signature line was a song that began with “Here I come to save the day,” which would mean he was about to vanquish the villain and save those in distress. Leaders whodon’t support or contribute to a BCM program will suddenly run into a boardroom to “save the day” and believe they can manage the chaos, when in fact what they are doing because of their lack of knowledge is causing more issues, confusion, and chaos for employees and the organization. Employees don’t see a leader with a responsibility but someone who is just as confused and lost as they may be. They wonder if they’ll ever get out of the bad situation – or even if they’ll have a job at the end of the day.

Those who take responsibility, ownership, and to some degree, control, for their BCM programs have a better opportunity of gaining support from those affected by the corporation’s situation and ensures that authority reigns over chaos.

Ignorance of Clarity

Ignorance of clarity focuses on ideas that people have a fear of the future. The future is unknown and can’t be predicted, so no corporation has control over its future (at least when it comes to unpredictable events and disasters).

The largest component of clarity is communication, the cornerstone of any well-managed BCM program and corporation for that matter. Having strong communication between employees, managers, and those on disaster teams will help the corporation work its way through a crisis. Communication must occur from the initial stages of a BCM program’s development right through to the end of a crisis and beyond.

When messages are not communicated effectively, it clouds the situation and many will interpret various communiqués and directions in differing manners. Crisis communication representatives must understand that messages aren’t always received the same way by every person; sometimes the understanding is mixed.

Mixed messages occur when a message is stated to one person – or community – and something else is said to another body. The actions that are supposed relate to the message don’t match the commentary being presented. This only brings confusion to employees and aggravates efforts to get the right message to the right people at the right time.

Timing of messages is vital. Timing is everything. Just ask a musician or athlete. If a message is disseminated at the wrong time – or not delivered at all – it can start rumors and conjecture to run rampant. When that occurs, you end up with a second crisis on your hands: managing misinformation, rumors, and reputational damage.

Communications are a fundamental aspect that identifies good corporations from bad ones: how they communicate to employees, vendors, and the surrounding community. When a disaster strikes, a clarity in communications will provide a corporation the means to ensure positive public support, employee faith, and media cooperation. It provides a better understanding of how the future will unfold during trying times.

Ignorance of Truth

This is an additional realm of ignorance, one that affects many corporations. As its name states, corporations can be fearful of the truth when confronted with ideas, perceptions and facts that run contrary to an organization’s belief.

Truth can be found in the initial phases of a BCM program’s development through such things as a risk assessment/analysis or a business impact analysis (BIA). These analysis processes will identify what every department is responsible for, its risks, what’s required to keep the department operational, its required recovery time objective, internal and external dependencies, etc.

Sometimes the findings will contradict what senior management “feel” is important. When this happens, findings won’t be accepted since they are not seen as being the truth. Yet the BIA findings are stating the truth – at least how the business units see the truth. Senior management will deny the truth – the findings – and manipulate the results to meet their personal ideas of what is correct.

The BIA may show that a small application or small department is core to operations, yet because another system or department is larger, by default it must be up and running first. This can be contrary to what management believe, and thus will ignore what the BIA states and continue to support the larger department to come up first. However, if the smaller operation/application isn’t available first, the larger one can’t do anything and is a waste of resources and effort. Still, the BIA will be ignored, and decisions will be made in favor of the more well-known system – not the small, seemingly insignificant one.

A BIA findings report can often highlight discrepancies between the thinking of business unit managers, the boardroom, and those on the front lines.

Finally, many organizations ignore real events. Many believe that a disaster or crisis will only occur to others. Disasters or crises can be learning opportunities for corporations in two ways. A corporation on the outside of a crisis can watch and be mindful of the pros and cons that a competitor goes through when it experiences a situation. A corporation experiencing a disaster may do the right thing, but they may also do some wrong things, all of which can be learning opportunities for other companies observing the situation unfold.

Facing the truth and all it can bring can enhance a BCM program and ensure that it brings facts into its development rather than crossing fingers, guessing, and assumptions, which ultimately could prove fatal when a disaster occurs.

Any disaster in the world will have a strong impact upon people. People are at the core of every disaster, sometimes the cause. People develop the restoration and recovery plans and strategies, and it is people who need to practice and question those same plans to make them robust, scalable, and adaptable to various disaster situations. It’s people who will see friends and families and colleagues lose jobs and possibly more if there are no appropriate strategies or response mechanisms in place to aid them. If corporations state they are socially responsible, then by definition a BCM program must be part of corporate culture.

People have fears, including those in senior positions who were “people” long before they ever become a president or a chief information office.

Addressing and confronting these fears help build comfort levels that support individuals and communities when catastrophic situations occur and people and their surroundings are impacted. Feigning ignorance of these fears is a result of not wanting to face the fact that a disaster will occur. To be socially responsible a corporation must admit to itself that at some point – either tomorrow, next month, next year, or even longer – a disaster will impact its operations.

Depending on how an organization prepares for the eventuality, the situation can escalate out of control – instilling fear and panic in people and the surrounding communities – or it can become something to stand against or something that can show the business world and the general public, how prepared it is.

A BCM program doesn’t just solidify the responsibility a corporation has toward the fears, hopes and dreams of its surrounding and partnered communities. It ensures that the social sphere – the community itself – sees the corporation as addressing its fears and insecurities and is a trustworthy, caring, and significant member of the community. It is people who build corporations; people who maintain corporations, and people who will save corporations when times are tough.

Business continuity is people.

Business continuity is a social responsibility.

A. Alex Fullick, CBCP, MBCI, CBRA, has been working in business continuity/disaster recovery for 16 years and is the founder of StoneRoad, a training and consulting firm. He is also the author of two books.