At the risk of over-simplifying a wide-ranging subject, I believe Business Continuity Planning (BCP) only really needs two things to be successful. The first and most obvious is the availability of (or the financial resources to acquire) viable technical solutions to the problems unearthed in the planning process. The second, and I believe even more vital, is the management will to initiate, encourage and drive the process forward.

It is very clear than in the past decade, technical options for disaster prevention, recovery and restoration have expanded enormously. The traditional fixed IT Recovery Centre has moved on to provide a wide range of services. Recovery capability is now widely available for Dealing Rooms, General Office Workspace (PC/LAN), Telecommunications infrastructures and Desktop services. Web hosting, disk shadowing, complete system mirroring, remote data vaulting and self-healing networks are now all well established products and services.

Not only in the IT recovery arena have we seen changes. The need for professional asset recovery has moved on considerably. What was once a low-tech salvage operation is now a very sophisticated business to recover lost data, paperwork, artefacts, specialised office equipment and manufacturing components such as machine tools. These services, together with much more advanced ways of measuring, monitoring and controlling security, seem to point to a major improvement in organisation's ability to cope.

Unfortunately I do not believe the change in management commitment and understanding has grown at the same rate as the technical solutions available to it. To some extent it is the classic case of the solution still looking for a question. Ultimately Business Continuity is a business issue, and until you fully understand your business risk there is little point in looking for a technical solution. If you do not fully understand your vulnerability how can you formulate strategies to counter it in a cost-effective way? This is not to suggest that nothing can be done without extensive and expensive risk analysis, many risks are intuitive and the impact on the business of major interruptions clearly catastrophic. However, even in these cases, how can recovery strategies be implemented so as to ensure they will really work in anger? Certainly a wide involvement of management and staff at all levels is needed, plus interfaces with suppliers, customers, emergency services and a myriad of other 3rd party stakeholders. Once you are happy with your plans, how do you constantly keep them up to date and accurate?

The key to achieving a successful programme is to embed BC into the culture of an organisation. Purchasing expensive solutions will only work if that is combined with generation of understanding and interest throughout the business. There has undoubtedly been a shift towards treating BCP and more recently full Business Continuity Management (BCM) as a serious mainstream business discipline, particularly in large companies. This trend has been most obvious in the global regulated industries like banking, insurance and financial services. In smaller companies often the key driver is coming from their customers. The need for BCM across an entire supply chain is emerging as a major criterion for purchasing decisions by the multi-nationals. We are seeing this in both traditional retail and manufacturing supply chains and it is forcing SME businesses to re-think their attitude to BCM. However, in many areas that cultural shift is in an embryonic state. As our politicians like to tell us - much has been achieved but there is still a long way to go. In the case of BCM (at least) they are exactly right. Return to Menu...