A Culture of [Business] Continuity | Part I
This two-part series from Avalution Consulting focuses on defining and embedding a “culture of continuity” within organizations.
PART I: DEFINING A CULTURE OF CONTINUITY
“Culture of continuity”…it sounds beautiful, doesn’t it? It flows off the tongue so naturally as we describe the quintessential business continuity program – a program embedded into an organization so well that personnel fully commit to business continuity and consider it in every decision they make. An environment where executive management considers the organization’s ability to recover from disruption during strategic planning discussions, and thinks about minimizing downtime and maximizing recovery during project development (as opposed to after-the-fact implementations). But, what does that phrase really mean? In part one of this series, we’ll define “culture of continuity” and dive into its importance and fit into every organization.
The term “culture of continuity” is widely used by business continuity practitioners, but, unfortunately, there really isn’t an agreed upon definition. Sure, articles and blogs have been written on the topic and business continuity standards allude to it, but it seems as though a specific definition or roadmap toward implementation simply doesn’t exist. So, in collaboration with industry leaders and business continuity professionals, we developed the following definition:
Culture of continuity, noun
An organizational state of being in which all personnel inherently work to minimize the likelihood of downtime and improve responsiveness and recoverability as they perform day-to-day activities.
Assuming you agree with this definition, does your organization have a culture of continuity? Do you agree with the term as defined? Based on what we’ve seen in working with dozens of organizations over the past several years (including some with robust business continuity programs), we would say that the answer is probably “no”. To be honest, this definition represents an extraordinarily mature business continuity program. In reality, even mature programs with well-executed business continuity lifecycle activities oftentimes fail to transition from a push-pull environment to one in which everything and everyone thinks about the business continuity implications of decisions.
Who Needs a Culture of Continuity?
This takes us to an important point: establishing a culture of continuity isn’t needed for EVERY organization. If a culture of continuity is the highest form of maturity for a business continuity program, then there are lots of organizations out there that may not be willing to invest the resources needed to achieve such a high level. However, for some organizations, continuity really is that important. These might include:
- Health Care Providers
- Financial Services Organizations
- Outsource providers
In these organizations, reliability of the services they provide is a defining characteristic of their value. As a result, a culture of continuity is a reasonable expectation. If your organization’s need for a culture of continuity is unclear, then a discussion with senior management about their goals for business continuity may help determine how mature of a program is needed.
Building a Culture of Continuity
Many of today’s leading standards, including the draft business continuity standard ISO 22313, make reference to a culture of continuity:
“The organization should build, promote and embed a Business Continuity Management culture within the organization that becomes part of the organization’s core values and management and makes interested parties aware of the business continuity policy and their role in associated procedures.”
If you’ve already taken a decentralized approach to business continuity planning, especially if it’s anchored by strong governance, you’re on the right path. Assigning business units and departments ownership for business continuity planning holds them accountable for planning, maintenance and execution. However, a culture of continuity isn’t just about getting other personnel in the organization to update BIAs and plans (although sometimes this is a feat in and of itself). It’s about developing an environment in which people inherently promote continuity every day and don’t blame their inability to support business continuity on one or more of the following reasons:
- “Sorry, but this just isn’t a priority right now. Perhaps we can touch base in a couple months”;
- “I could care less about my supplier’s business continuity arrangements – all that matters is that we have a plan internally”;
- “I’m really busy this quarter – I’ll get around to updating my plan next quarter when things slow down”;
- “I’m sorry, but I just can’t pull my team away from billable work this month to participate in an exercise. We did one last year – we’re good to go”; and
- “Everything I need is backed up in the ‘cloud’ – I don’t need a business continuity plan”.
Through general change leadership techniques and principals, business continuity practitioners can work to achieve a culture of continuity and make activities as routine as grabbing a morning cup of coffee, going to lunch or evacuating the building during a fire alarm.
In part two of this series we will share an implementation framework and provide recommendations for how you can begin to embed a culture of continuity within your organization.
The Avalution Team
Avalution Consulting: Business Continuity Consulting