If you have been in the business continuity profession for any length of time, then you are certainly familiar with the laundry list of standards that already exist. This includes BCI’s Good Practice Guidelines, ISO 22301, and NFPA 1600, to name a few. If you have familiarized yourself with the guidance of these standards, you probably also know they are all predicated on the same basic methodology. They all define the same sets of deliverables. Also, they all have the same means of measuring the effectiveness of an organization’s business continuity program: its conformity to these same standards.
There is a new kid on the block that is challenging traditional perceptions of business continuity and shattering assumptions about how best to be effective in this discipline. This method is called adaptive business continuity (or merely “adaptive” from this point forward). Adaptive lays out an entirely new approach to the profession; an approach which is simple, straightforward and delivers significantly better value. Most importantly, one of the key components actually defines a means by which to determine the ability of an entity to recover following a disruption. Using this model, the principles can be applied to discern the specific actions that can improve an organization’s recovery capabilities. Ongoing measurement and improvement provide long-term benefits while delivering value, all for considerably less effort than following traditional methodologies.
The Adaptive Business Continuity Manifesto
The original manifesto, published in September 2015, outlined a set of principles applicable to business continuity practices. While the document is a rather brief 15 pages, including a summary matrix and postscript, it covers a lot of territory. This starts with a new definition of business continuity and justifies the need for radical new approaches to the discipline. It then goes on to firmly establish the scope of the business continuity practice before providing a detailed list of its 10 principles.
At first glance, many of the principles will come across as simple common sense, and readers may question the need to spell them out in the first place. The reason is because our profession’s documented standards fail to do so. These legacy methodologies provide a great level of detail around the execution of specific activities while leaving the common-sense ideas to be inferred. Unfortunately, with little additional direction, new entrants to the field of business continuity come to assume the value of their work is derived from the deliverables themselves and not the underlying work that goes into them. This results in the discipline relying too heavily on the finished materials as evidence of the effectiveness of business continuity programs and not the related outcomes of the effort. Our profession’s inability to define a proper set of measures to determine business continuity effectiveness has resulted in the circular logic we apply today: using adherence to the methodology as the most trusted measure of program success. This is despite the fact that no evidence exists to support the belief that today’s standards actually deliver on the promise of better prepared and more recoverable organizations!
The Principles
So, what are these principles? You will find them in the accompanying table, listed in alphabetical order. This order was intentionally chosen to demonstrate they are not sequential and that no single principle takes precedence over any other. Next to each one is a statement which best explains the objective of the principle itself.
Individual opinions vary wildly, but it is not uncommon for most practitioners to agree with many of these principles while disapproving others. This is expected, and readers who have not previously heard of this method are cautioned to give it time before formulating an opinion. Remember to keep an open mind and try to not to take individual principles out of context.
Adaptive in Execution
Whenever practitioners are exposed to these principles, the inevitable question arises: how is it executed or performed? While this sounds like a query, it has multiple answers, none of which are particularly cut and dry.
The easiest response – and the one which may be the most satisfying – is that execution of this method is simple: measure, improve, and re-measure. In other words, one measures current capabilities which helps identify areas to make improvements. After capabilities are enhanced, one measures again in order to validate the effectiveness of changes made and identify further opportunities to improve. This enables the practitioner to move quickly and adapt as needed. However, the simple answer does not provide the details about how one goes about measuring capabilities and how this enables the identification of improvement opportunities. As mentioned previously, this article is only an introduction, and the additional details around execution will have to wait until the next publication.
Another answer to the question is that adaptive is not meant to be a cookie-cutter approach to business continuity. One of the issues with current practices is they are poorly suited to many organizations, particularly in today’s lean and agile business environment. The length of time needed to perform many tasks advocated by legacy practices – such as the risk assessment and business impact analysis – require significant time to perform. Once done, the results inform subsequent activities which require additional time and effort. By advocating for quicker action, based on clear measures, practitioners can deliver value in shorter sprints and keep pace with the changes in their organizations. By eliminating the laundry list of requirements and deliverables, practitioners can be more flexible, adopting the actions which provide value and modifying their approach as appropriate.
The final answer to the question is that this method is meant to be a rejection of our profession’s insistence that business continuity can be successfully performed by following a series of actions. This incorrectly posits business continuity as an activity which can be easily performed by anyone, provided they follow the correct methodology. However, nothing could be further from the truth. Effective practitioners require a set of skills and capabilities that cannot be acquired by learning a chronological series of steps and their associated deliverables. By taking the focus off of the methods of execution, adaptive seeks to move our profession’s attention to the expertise and competencies needed to be successful.
Adaptive business continuity should not be thought of as a modification of existing standards or even as the proper application of established methods. This is revolutionary because it defines an approach to business continuity which is completely distinct from the practices that have been followed and promoted within our discipline for decades. It is still in its infancy and may undergo further evolution. Hopefully, you will be a contributor to that evolution.
Mark Armour is a business continuity professional with more than 16 years of experience. He is currently the director of global business continuity for Brink’s Inc. the worldwide leader in cash management services and secure logistics. He is a member of the International Benchmarking Advisory Board for BC Management and co-author of the book, “Adaptive Business Continuity: A New Approach.” He can be reached at mnjarmour@gmail.com.
