Business Continuity and Resilience Blog

Article originally published by the BCI's Continuity Magazine, issue Q2 2017.

The long-awaited ISO 22316:2017[E] International Standard Security and resilience – Organizational resilience – Principles and attributes has arrived.  I paid my £80 and downloaded it.  At first read it doesn’t seem to offer much – a long title but just 10 pages of dry and heavily-engineered clauses.  Surely there must be value in there if only I can unlock it.  I decided to apply my own test, perhaps a little off-piste as far as conventional review goes, but relevant for many.  I chose Brexit.

Almost every prudent business, large or small sees wisdom in buying some level of business insurance. We feel comfortable paying a small amount (premium) that will deliver a larger amount (claim) if we suffer a sizeable loss.  

However, insurance won't keep your customers happy whilst they wait for you to rebuild.  It won't organise your people, ensure you can find capacity elsewhere or help you decide how to respond to the challenging conditions you now face.

Business continuity does these things.  It works hand-in-glove with risk management and insurance.  It's not difficult and the guide below explains how to do it.

The following is taken from a whitepaper we recently published. You can download the full article here. It includes 5 additional resilience building methods not included in this article.

"I was recently tasked with writing a business continuity plan for a manufacturing organisation with critical production facilities close to a conflict zone.  This prompted me to write a paper about geopolitical resilience.  The organisation’s executive was positioning it for investment and wanted to be seen to be managing that aspect of risk.  They recognised the situation, the way investors might regard it and the potential need to resume in a planned, acceptable way if disruption occurred.  The focus was strongly on geopolitical risks whilst still planning for conventional natural perils. "

Over the last few years, many organisations have ‘upgraded’ their Business Continuity Manager roles to Resilience Manager positions. However, it’s not clear whether the function or the expertise required to support it have actually changed. Has one term simply been used to replace the other, and if it has, is vital nuance being lost?