Resilience - The difference between it and Business Continuity
This week saw the Commons vote by a large majority for British forces to start bombing Syria. Watching the news we didn’t have to wait very long before we heard that the bombing had started. As the coalition has been bombing ISIS for several months now, I am not sure how our contribution is going to make a huge military difference, other than being symbolic. We do have the Brimstone missile to contribute, which is extremely good at hitting individual moving targets such as pickup trucks, without causing a large amount of collateral damage.
The ability of ISIS so far, not to be terribly affected by the bombing campaign, got me thinking about resilience and whether they may be fairly resilient. The bombings have not prevented them carrying out attacks on the ground in Syria or in Europe, such as the Paris attack. If we think back to the Second World War bombing of Germany by the allies, the Germans were bombed pretty consistently for three years. Although it reduced their supply of weapons, and especially fuel, it was the ground offensive by the allies and Russia, which brought the war to an end.
Resilience is the trendy word of the moment and everybody seems to want a piece of it. The Business Continuity Institute seem to have impressed the term, and many of my rivals on the business continuity consultancy side have put resilience in their business name. Many of the former Scottish Emergency Planning Managers have renamed themselves as Resilience Managers, or have resilience in their department’s name.
My impression is that everyone is jumping on the bandwagon. Nobody would deny that it is not a good thing but I don’t think people really understand what it is and therefore use it in terms of whatever they would like it to mean or what suits their purpose. I think the first thing that needs to be said is that it’s not the same as business continuity and anyone who uses the terms interchangeably is just plain wrong!
My understanding of resilience is that it is all about making your organisation ‘tougher’ so it can withstand changes in the market from natural disasters. There is an element of being able to identify changes early which could affect the business environment, or organisation and then adapting to them. Being well-managed is also important so if something does occur, the management team or organisation is nimble enough to deal with it. These are all good things that we as business continuity managers should be building into our business continuity programme but the scope is much, much larger.
If you take business continuity in its purest form, it looks at people, premises, resources and supplies. In an article from the Economist Intelligence Unit, talking about CEOs and their views on resilience, it was all about the strategic positioning of your organisation and making sure you could deal with whatever the market threw at it and anything affecting operations. This is much larger than what the business continuity manager is typically responsible for and takes in strategic business direction as well as being able to withstand terrorist attacks and natural disasters. Resilience, to them, has the scope of organisation-wide risk management with the extra dimension of mitigating all the risks and operating the organisation so that it thrives.
So where does that leave us business continuity people? I think we need to understand what resilience means and how it can help our organisation. I also think we need to understand how carrying out business continuity contributes to the overall resilience of the organisation. As business continuity managers we have to understand the limitations of our contribution to resilience and it needs to be holistically embraced by the organisation. It cannot be implemented by adding ‘resilience’ to our job titles or putting it in the department name.