Each volume of Journal of Business Continuity & Emergency Planning consists of four 100-page issues both in print and online.
The articles and case studies confirmed for Volume 15 are listed below:
Volume 15 Number 4
The process of implementing and maintaining a business continuity management system is associated with various challenges that make it hard for organisations to realise their business continuity objectives. This paper describes how to implement three key drivers to support organisations in their business continuity efforts. First, the organisation must establish a culture conducive to business continuity. This can be reinforced through the distribution of roles and responsibilities for business continuity, in order to spread the operational burden and raise awareness regarding the necessity of business continuity processes. Finally, organisations can benefit from the latest advancements in technology and software to make business continuity efforts easier to implement at all organisational levels. This latter aspect is important not just for business continuity managers, but also their colleagues, who may not be as well versed in the area of business continuity, but whose support is essential to the smooth functioning of the business continuity management system.
Keywords: business continuity, organisational culture, software, management system, staff empowerment, innovation
Business continuity practitioners looking to ensure the resilience of their career must dedicate time to understanding the profession, developing a career strategy, investing in professional development, and finding creative ways to leverage their personal uniqueness. This paper provides tips on how to do just this.
Keywords: career resilience, career strategy, career planning, personal brand, soft skills
Validation activities are essential for organisations to ensure the ongoing efficacy and hence value of their business continuity arrangements. While COVID-19 has impacted the ability to perform normal validation activities in the business continuity life cycle, it has provided the opportunity for a significant live test of recovery strategies, business continuity plans, and response and recovery teams. This paper draws from practical experience with and reviews of approximately 30 Australian companies, and discusses the impacts of COVID-19 on maintenance, exercising and review. It provides suggestions for harnessing and articulating the lessons learned from an unprecedented, global disruptive event, and the adaptation of validation techniques in the new normal to increase both organisational resilience and enhance customer value propositions.
Keywords: resilience, validation, assurance, innovation, recovery
Business continuity is in a comfortable state of established maturity. However, while most risk managers believe their current plan is fit for purpose, future disruptions are likely to take on different forms and have different impacts. At a time when the need for business continuity management is greater than ever, the need to expand its service offering is also great. This paper proposes an operational resiliency programme that would operate as a complement to business continuity management by incorporating key aspects from other fields of expertise. This programme is designed to provide businesses with the tools to identify potential sources of disruption and implement changes before such disruptions occur, thus limiting impacts to the business, its employees and customers and their respective communities.
Keywords: business continuity, operational resilience, project management, risk management, agile
Organisations are regularly exposed to risk factors and issues that may be triggered by disruptive events that can impact on the organisation’s performance and reputation. These disruptions can range from human error through to large-scale natural disasters and long-term global events that can reshape the complex landscape within which these organisations operate. Large-scale business actions, such as decentralisation, mergers and acquisitions, can also introduce major disruption to daily operations. The presence of an embedded, effectively communicated business continuity framework that is rigorously reviewed and tested with appropriate regularity provides an enhanced level of protection and flexibility when faced with such issues. This case study analyses the development of a business continuity framework in a large business unit that operates as part of a UK critical national infrastructure provider with an international influence. The study proposes a business continuity capability framework and examines the approach taken to embed such a framework into the aforementioned business unit.
Keywords: leadership, business continuity, resilience, lessons learned, culture
This paper reviews how the COVID-19 pandemic has impacted established best practices in the field of business continuity management (BCM). It reviews the lessons learned and provides suggestions on how business continuity programmes need to evolve in order to reflect the changed landscape. By walking through the BCM life cycle, the paper considers the various changes required at each phase of the BCM programme.
Keywords: business continuity management, business continuity planning, risk management, crisis management, business resilience, operational resilience
On Christmas Day, 2020, the detonation of an explosive device in Nashville, Tennessee resulted in many thousands of homes and businesses losing access to telecommunications services. While pre-established business continuity and disaster recovery plans helped many businesses and organisations recover from the impact and outages, many still suffered extended downtimes due to the lack of redundancies in place. Indeed, for organisations without a backup telecommunication provider, the effect of the bombing was dramatic, with hospitals, urgent care facilities, restaurants and other businesses all suffering major disruption. This paper examines how the various organisations responded and recovered from the incident, and considers whether legislation is required to ensure that telecommunications providers have sufficient redundancies in place to avoid such extended outages from happening again.
Keywords: disaster recovery, business continuity, telecommunications, after actions, government regulations, key infrastructure
Volume 15 Number 3
Since the outbreak of COVID-19, the number of employees working from home has increased exponentially. This paper discusses how this shift to remote working has affected enterprise risk management, business continuity management and crisis management over the last couple of years, along with tips, software tools and processes to help manage this impact. The paper also identifies the key functionality required from pertinent software tools, discusses the effects and primary issues associated with such tools, and provides examples of how these tools have been implemented in practice.
Keywords: remote workers, employee location, trend, crisis management, business impact analysis, risk assessment
In today’s rapidly changing threat environment, especially amid the COVID-19 pandemic, the roles of emergency management (EM) and business continuity (BC) professionals are continuously evolving. Today’s EM/BC professional has become more mission-critical than ever, with their position placed under a spotlight as companies of all sizes prepare themselves for the next unknown, but inevitable, crisis. A common problem, however, is that many professionals with the requisite hard skills lack a light touch when it comes to communicating the goals they are striving to achieve. This paper discusses the importance of soft skills for the crisis management guru. The paper lays out which of the multitude of soft skills are the most critical, outlining ways for EM/BC professionals to build, utilise and maintain their soft skills, with case studies that exemplify the use or misuse of such skills.
Keywords: communication, hard skills, relationships, soft skills
Crisis management in large organisations should evolve response structures to prepare better for real-time, enterprise-wide events, and boost overall resilience. This paper proposes that organisations shift from an incident command structure to a more agile approach that reflects changes in business operations. This paper describes the evolution in Liberty Mutual Insurance’s US operations practice from a more traditional emergency response team structure to an agile one that seeks to unify crisis teams globally and cross-functionally. The paper concludes that the adoption of a collaborative methodology across disciplines fundamentally increases organisational resilience.
Keywords: business continuity, business continuity management, crisis management, organisational resilience, operational resilience, resilience, crisis response, crisis team
This paper examines the substantial spike in fatalities that occurred in El Paso, Texas in late 2020 due to an unprecedented surge in COVID-19 infection. It also considers various explanations for the fatality surge, and the fatality management issues observed during the event. The paper suggests what lessons can be learned from this event, in particular those preventable causes that could be avoided in a future outbreak. The paper also examines the gaps in existing mass fatality management processes as they apply to planning for pandemics and mass fatality crisis standards of care.
Keywords: COVID-19, mass fatality, pandemic, El Paso, emergency management, public health response, healthcare planning
This paper reviews some of the common challenges to high-quality decision-making at the leadership level, such as limiting decision shortcuts, analytical blind spots, failure to consider multiple perspectives or options, and reluctance to adjust decisions that are not working well. The paper also reviews some of the pertinent literature and scholarship on decision-making approaches to build a summative decision-making model of anticipatory foresight and adaptation to overcome dysfunctional decision-making mistakes. The paper proposes a new framework that focuses on the internal decision-making processes that leaders should adopt — an approach to decision-making that combines the concepts of anticipatory foresight, predictive vision, creative imagination, adaptive skill sets and adaptive flexibility. It is essential to incorporate these dimensions in how we prepare leaders, equip and train them, create processes and protocols, and ultimately how we evaluate and assess leadership performance.
Keywords: foresight, leadership, decision-making, flexibility
To restore, recover and resume operations in the wake of a major interruption to business requires clearly defined goals and the existence of a roadmap to achieve, if not exceed, established expectations. This paper proposes that the use of a qualitative approach to measuring business continuity maturity provides the ideal lens through which to gauge an organisation’s current state, identify the gaps that need to be closed, and create that roadmap to resilience. Specifically, the paper argues that looking at how well something is completed or understood provides significantly more value than a yes/no quantitative approach that looks only at if something meets expectations. As any successful programme requires ongoing refinement, this paper is intended both to encourage and challenge practitioners to understand better why — and how — to measure their business continuity programme, as well as provide a foundation for development, with a view to unlocking the opportunity for continued resiliency.
Keywords: maturity, measurement, qualitative, model, goal, effectiveness, assessment
Together, the Finnish National Emergency Supply Agency and Digipool are developing exercises to improve the nation’s cyber security. This paper provides examples of these exercises and explains how they contribute to companies’ emergency response and business continuity plans. The paper also describes how the model is being developed to further improve continuity and emergency planning in the area of cyber resilience.
Keywords: exercise, resilience, preparedness, continuity, cyber, partnership
When it comes to crisis management, every second counts — whether it is a fire onsite or a reputational crisis, decisions must be made rapidly to protect the company’s people, operations and reputation. This paper gives real-world examples of standing up and running a crisis management process inside the Special Operations Command during the Afghanistan conflict. It highlights the need for fast, flat and accurate communication in order to enable rapid response and recovery. The paper describes the challenges of building an organisational approach to crisis management and establishing the buy-in, process steps and systems solutions for such an endeavour. The paper will review, step by step, how this process was built in Afghanistan and how to bring it to the civilian sector to create a level of intelligence and response that most civilian companies are yet to realise.
Keywords: Special Operations Command, incident management, crisis management, security, leadership
Volume 15 Number 2
To extort a ransom payment, ransomware actors must make the threat sufficiently compelling that payment seems like the only option. This is achieved by encrypting or disabling a company’s data replicas and backups as well as its production data — data that are essential to the organisation’s success. To prevent this happening, it is essential to extend one’s thinking beyond the organisation’s cyber security incident response plan and disaster recovery programme and give active consideration to a cyber incident recovery risk management (CIR-RM) programme. This paper explores what this requires, including the right thinking, the right approach, the right team and the right plan.
Keywords: cyber crime, cyber attack, ransomware, malware, data recovery, disaster recovery, immutable backups, cyber incident recovery, cyber incident response
Natural disasters have been occurring more frequently and with greater potency, creating a real and heightened financial and operational risk to businesses around the globe. This paper aims to enhance traditional business continuity techniques and strategies by discussing how risk management, insurance and claims knowledge can form a robust platform from which to minimise the impacts of natural disasters on business. To this end, the paper combines professional knowledge from the fields of risk management, disaster response and insurance claims recovery to offer best practices in the key phases of planning and response.
Keywords: risk management, disaster management, insurance claim preparation, insurance dispute, insurance coverage, policyholders
The mantra from Emergency Management professionals is that lessons learned when enacted are beneficial; when they are not, it is a lesson observed. The COVID-19 pandemic has required healthcare organisations to be agile and responsive. This paper describes how Alberta Health Services leveraged the lessons learned from previous incidents in order to provide a flexible response to a rapidly evolving situation.
Keywords: healthcare resiliency, lessons learned, pandemic response
This case study looks at a denial-of-access event, where airborne asbestos material was found in a government-owned building leased by the New Zealand Parliamentary Counsel Office (PCO). The paper describes how despite the lack of advance notice, the PCO demonstrated its resilience to business disruption through its leadership and culture; its networks and relationships; and being change-ready. The paper also discusses how the incident provided an unexpected opportunity to build further resilience on return to the workplace.
Keywords: resilience, asbestos, critical functions, resources, communication
In 2019, Hurricane Dorian wreaked widespread havoc across the Province of Nova Scotia, with significant, adverse impacts affecting citizens and government services for a protracted period. This paper describes the challenges faced by the provincial emergency management and business continuity response teams. It argues that storm response requires a flexible top-down approach, with senior leadership delegating responsibility and encouraging locally-driven decision-making. Using examples from Hurricane Dorian, the paper shows that as emergency response and business continuity overlap, response teams must find a balance between the protection of life and property and safeguarding the continuity of business. This can be accomplished through strategic support from senior leadership, the adoption of evolving best practices and competency development through training and realistic exercise scenarios.
Keywords: delegation, hurricane, business continuity, emergency management, telecommunications failure, incident command system, mental health
The decision to automate any part of a resilience programme may be straightforward, but translating that decision into a successful software selection and implementation demands complete, detailed scoping and a commitment to a culture of ongoing change and improvement. This paper provides an approach to the design of supporting reporting and data frameworks and models, up to the point of requests for information or proposal. It also provides suggestions on embedding an ongoing change process, and guidance and watch-points at each stage. This should in turn ensure that software selection is informed and successful, and that subsequent change is managed successfully.
Keywords: automation, tooling, change, design, data
This study investigates the mitigating influence of business continuity management (BCM) with respect to supply chain disruptions. Using a dataset from the 2017 BCI Supply Chain Resilience Report, the authors conduct partial least square-based structural equation modelling with reflective constructs for both exogenous and endogenous variables. The results demonstrate that BCM reduces vulnerability and mitigates the impact of supply chain disruptions on operational performance. The study highlights BCM’s contribution to such important components of supply chain resilience as visibility, collaboration and agility. In addition to demonstrating the impact of BCM on supply chain resilience, the paper explains the role of top management in the BCM process, and provides a list of measures that organisations can take to protect themselves from external threats. This is the first study to use statistical analysis to provide empirical validation in this field, while employing a clear definition of BCM in line with international best practices.
Keywords: supply chain disruption, supply chain resilience, business continuity management, SEM
It is wrong to describe the COVID-19 pandemic as a ‘black swan’ (ie a catastrophic event that no one saw coming). Far more apt would be to call it a ‘grey rhino’ — something that has long been predicted but overlooked by leadership the world over. This paper argues that it is time to stop relying on outdated risk formulas and adjust risk assessment methodologies to account for these grey rhinos. Simply put, it is time to accept that the potential impact of an event is more important than its likelihood.
Keywords: gray rhino, grey rhino, risk assessment methodology, crisis leadership, executing crisis, crisis management
Volume 15 Number 1
Across the world, there is an increasing tendency for businesses to rely on best practices, based on the assumption that they provide proven, credible and efficient solutions. In-depth scrutiny of ‘best practicism’, however, paints a different picture of its effectiveness; indeed, the adoption of best practices is commonly ineffective due to their misapplication or the use of unsupported assumptions. This article explores the use of best practices in the business resilience profession and describes reasons why assumptions about them are often incorrect. Cautions about best practices focus on the importance of change processes, underestimating problem complexity, and the influence of confirmation bias. These factors, and ways to address them, are described in the context of business resilience.
Keywords: best practices, business continuity, business resilience, cognitive biases, complexity, confirmation bias
Exercise GTA Unified was a functional, multiagency, cross-jurisdictional, health-sector focused mass casualty preparedness exercise conducted in the Greater Toronto Area (GTA) on 28th November, 2019. With over 1,000 unique paper-based and electronic injects and 34 participating agencies, including 22 separate hospital sites, Exercise GTA Unified is likely the largest health-sector focused mass casualty preparedness exercise ever conducted in Canada. The exercise design approach supported a successful, objective-based functional exercise, with elements of marked realism for participants. The exercise offered a unique opportunity to collect data for future analysis and the insights gained will have a transformative impact on interagency engagement and cooperation for emergency response planning. Furthermore, the approach adopted for the exercise is affordable, reproducible, scalable and transferrable to sectors beyond the health system. This paper provides a detailed review of the key planning and design components adopted in the development and implementation of the exercise, as well as practical insights for the design and conduct of multi-agency, cross-jurisdictional functional exercises.
Keywords: mass casualty incident, health system, exercise design, surge capacity, regional emergency planning, operations-based exercise, functional exercise
Federal medical stations (FMS) and alternative care sites are used to provide surge capability and capacity for short-term inpatients with healthcare needs that cannot be accommodated or provided for in a general shelter or general acute care facilities. In March and April 2020, an FMS was deployed to support the management of the COVID-19 pandemic in the ‘hotspot’ of Santa Clara County, CA. This paper describes how the flexibility of the incident command system allowed for the positions of situation unit leader and liaison officer to be combined at the FMS, supporting the effectiveness and efficiency of the FMS through comprehensive situational awareness, information-sharing and collaboration. This method of combining closely related roles is not suitable for all healthcare emergencies, but as this paper demonstrates, it is well worth considering in circumstances where competences and capacity align.
Keywords: emergency preparedness, healthcare, hospital, alternative care site, incident command system
With the world becoming increasingly complex and uncertain, the disruptions that businesses face are becoming increasingly unpredictable. Traditional approaches to business continuity planning must therefore evolve to enhance organisational resilience. As this paper will discuss, it is vital to ensure a balance between detailed planning and flexibility and adaptability. This can be achieved through: 1) creating closer links between business continuity and strategic management; 2) embedding a culture of resilience throughout the organisation; 3) decentralising business continuity planning and enabling teams and departments to design and own their own plans; 4) making planning principles-based; and 5) exercising more frequently. This paper argues that planning must be based on principles and outcomes rather than processes, and how it must, to be integrated within broader risk management and strategy functions to be inclusive of everyone, from the staff all the way up to the board. In short, preparedness and resilience must become part of their DNA.
Keywords: business continuity, organisational resilience, adaptive planning, business disruption
A pandemic is a unique natural disaster that will pose challenges for any organisation. During the COVID-19 pandemic, for example, organisations of all types have struggled to maintain operations while assuring the health and well-being of the various persons who work on their behalf. Certainly, many organisations have found that their risk management and business continuity plans fail to consider adequately the disruption associated with a pandemic caused by a novel pathogen. As this paper discusses, this suggests a need to revisit risk assessments and business impact analyses; the assumptions and timeframes on which they are based; and the plans that they have generated. The paper argues that static plans are ill-suited to address the evolving threat of pandemic, and that effective planning and management of pandemic response must be dynamic in nature.
Keywords: risk management, continuity management, pandemic planning, dynamic planning, COVID-19
This paper explores the significance of supply chains to modern economies and the brittle nature of those supply chains. It considers how this brittleness is increasingly exposed by an array of threats, both natural and manmade, as well as the pressures placed on supply chains from rapid changes in society’s expectations and priorities, including with respect to globalisation and ethical considerations. The paper establishes why resilience matters, setting out the degree to which known risks are mitigated and assessing the current status of supply chain resilience. Finally, practical techniques are suggested by which organisations may better understand the risks to their supply chains and enhance the resilience of those chains.
Keywords: supply chain, value networks, resilience, crisis management, business continuity
Globally, disasters appear to be growing in frequency, intensity and cost. While national governments provide varying levels of assistance to affected populations and regions, are local agencies doing what they can to prepare for the next disaster? This article discusses what can be done, sometimes at minimal cost, to be better prepared to recover economically from the next disaster.
Keywords: FEMA, Public Assistance, disaster, cost recovery, recovery plan
Small-to-medium enterprises (SME) are vulnerable to disasters because of their limited ability to duplicate, separate and diversify their risk. SMEs must therefore rely on local personnel and resources to plan for, respond to, and recover from disasters. Unfortunately, community-level planning does not readily incorporate SMEs effectively. SMEs are thus forced to plan in isolation as current hazard risk analysis (HRA) models do not adequately account for the capacity of local personnel to respond to emergent hazards. Accordingly, this study posits an easy-to-use SME disaster impact model for HRA that combines probability theory and statistical analysis to integrate local personnel capacity. The model is designed specifically for SME usage; although, it can be applied to any organisation regardless of size. This study proposes a standardised HRA probability and consequence sequence based on the analysis of over 400 locations and risks that determined the model’s reliability in practice. The posited SME disaster impact model for HRA effectively integrates vulnerability and local personnel capacity with services, personnel and equipment to optimise SME disaster response and recovery capacity.
Keywords: impact analysis, continuity management, resilience, risk modelling, small-to-medium enterprises, hazard risk analysis
