Understanding Adaptive Business Continuity: Capability

EDITOR’S NOTE: This six-part series explores Adaptive Business Continuity, a framework that deliberately challenges traditional business continuity assumptions and restructures how preparedness and resilience are achieved.

***

There are many examples of unquestionably effective responses to crisis events: NASA’s solutioning following the Apollo 13 mission disaster, Johnson & Johnson’s response to the Tylenol crisis, Cantor Fitzgerald’s recovery after the events of Sept. 11, and Nokia’s response to the Philips semiconductor factory fire just to name a few. If the greatest recoveries in our collective history occurred because of human will and ingenuity, why would we take that away?

Capability is not a plan. It does not mean having a plan. It shouldn’t even include a plan. I would go so far as to say that plans and procedures themselves can negatively impact capability. This is because directing people to follow a plan robs them of agency. Setting the expectation that plans will answer difficult questions limits learning potential. Restricting people to documented strategies and procedures negatively affects creativity. Individual agency, learning and creativity are critical components of response and recovery capability. This means our traditional, plan-focused approach has been systematically robbing the very organizations and communities we support of the qualities they need most to respond and recover effectively.

The Rule of LGOPs

This concept of capability can be illustrated using a story from the World War II battlefield. American paratroopers were dropped behind enemy lines in Europe with plans to disrupt operations in support of the Normandy invasion. Weather, haste and some degree of wartime confusion resulted in allied forces being scattered and in locations they were not familiar with. Rather than abandon the objective because the plan was no longer viable, individuals endeavored to carry out the mission anyway. Well trained, armed to the teeth and lacking serious adult supervision, these men remembered the intent, as communicated by their commanding officers before departure: “March to the sound of the guns and kill anyone who is not dressed like you …”

The results? “They tore down communications lines, demolished enemy infrastructure, set up both random and planned roadblocks, ambushed Axis forces, and killed everything in their path. A group of 16 German pillboxes that controlled key roads was even taken out despite the fact that the attacking force had a fraction of their planned strength.”

This episode became legend and was later referred to as the Rule of Little Groups of Paratroopers, or LGOPs. The rules of LGOPs (or anyone wishing to do the same) are simple:  

• Have a common vision
• The vision should be simple, easy to understand, and unambiguous
• Owners should be trained to improvise and take initiative
• Owners need to know what to do; not how to do it

This is, ultimately, what Adaptive Business Continuity aims to achieve.

Challenges

The issue with this analogy, of course, is that those of us in the resilience profession do not have the luxury of a military boot camp through which we can develop our corporate response teams. We don’t have unlimited resources with which to arm them. We cannot devote countless hours to training and drilling – people have other jobs to do. On top of that, we cannot automatically grant people authority to take initiative.

Capability already exists

There is no evidence the leaders at Johnson & Johnson went through any type of regimented exercise activities to prepare for the crisis they experienced. Nokia was quick and aggressive in their response to the Philips facility fire, not because they had trained that way, but because it was a part of their corporate culture. Countless companies have weathered storms, acts of terror and even world wars and global pandemics without having benefited from planning efforts.

We can deduce that capability exists in every organization, to some degree. Capability will naturally vary from company to company and even from different departments within the same organization. Context will play a role as well. For instance, the way an institution along the Gulf Coast responds to a hurricane does not necessarily correlate to how it might act if it were hit with a ransomware attack.

This means all the resources needed may not be available, but there is a great chance some resources exist. Even if an exercise or tabletop has not been conducted, people across the organization have knowledge about the work they do and how it is performed which can inform response and recovery strategies. This may include the use of alternate equipment, creative manual workarounds or the ability to enlist other team members in execution. Some level of authority and empowerment almost certainly exists across teams, departments and organizations.

This should be the starting point. We should strive to understand what capability looks like, then help people and teams improve. This might mean making them aware of resources they did not know existed. It could mean pointing them to training to build competence or facilitating team building or collaboration exercises. Perhaps people have more authority than they realize and just need to be made aware of what they are trusted to do. Most important is an understanding and embrace of the mission – to enable the business to navigate unforeseeable consequences and deliver profitable operations through any manner of unexpected events.

Paradigm Shift

This is a major paradigm shift when compared to the traditional business continuity methodology. There are no priorities to establish. No objectives to define. No time-bound targets to satisfy. No plans. The work of planning itself looks drastically different in the Adaptive world. Strategies and procedures may enter the picture, but they are not at the root of capability. Instead, we dig deeper into the organization, its teams and employees to determine what is intuitive or instinctual; what is known, what is assumed, and what is believed. Through this approach, improvement opportunities are not updates to a plan but education and learning activities, resource deployment, empowerment, and trust building. This approach may be more challenging but the results – in terms of improved communication, decision-making, and creative problem solving – are significantly greater.

This allows the resilience professional to approach their work more strategically. Understanding where the organization, its departments and services sit, in terms of capability, provides a window into what must be done. This is the secret to maximizing the value we deliver and moves us far beyond the cookie-cutter approach we get from the traditional methodology.

In Summary

Understanding and improving capability should be the heart of all we do as professionals. Doing this properly, however, means we need to abandon old notions and assumptions about the work we do. Capability is not a function of plans and procedures. Capability will always exist, even in places where a moment’s thought has never been devoted to preparedness. The Rule of LGOPs tells us satisfying the mission is less a matter of having a plan and more the result of having adequately resourced teams with clarity, competence and initiative. These are major changes in perspective, so I encourage you to avoid quick judgement. Instead, consider what this might look like within your particular organization. Chances are there a lot of new things you would do but a lot of things you might stop doing as well.

Stay curious, friends!

ABOUT THE AUTHOR

Mark Armour

Mark Armour is a resilience industry leader with more than 20 years of experience in the field. He has been instrumental in the implementation and leadership of several global business continuity and crisis management programs. More importantly, Armour has been directly involved in corporate response and recovery for hundreds of events, from IT outages and natural disasters to pandemics. Armour is the co-author, along with David Lindstedt, Ph.D., of the “Adaptive Business Continuity Manifesto” and the book, “Adaptive Business Continuity: A New Approach.” He is currently the senior director of global resilience at Brink’s Inc., the worldwide leader in secure logistics and cash management solutions.