Business Continuity Management (or BCM as it is called in short) as a specialised arena of overall risk management umbrella often gets relegated to the background when the focus remains on the major aspects of risk management like managing credit risk, market risk or even operation risk. Probably this is more so in risk management, as practiced in the financial institutions. However, needless to say, in the overall scheme of managing risk (Enterprise-wide Risk Management as it is called in risk management lingo), continuity of business by way of prior planning of strategies, policies, putting in place appropriate frameworks, SOPs, doing testing to assess the resilience of the continuity plan remains at the very core of overall management of risk. And this goes for all organisations, be it a bank, financial institution or an entity in any line of business. Before getting in to the tricky waters of future of Business Continuity Management, let’s begin with a simple definition of BCM.
The UK based Business Continuity Institute (BCI) puts forth the definition of BCM in these lines.
“Business Continuity Management (BCM) is a holistic management process that identifies potential impacts that threaten an organisation, and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities.”
This guideline defines stakeholders as employees, customers, suppliers, investors, and the community or communities in which an organisation operates.
According to ISO 22301, Business Continuity Plan is defined as “documented procedures that guide organisations to respond, recover, resume, and restore to a pre-defined level of operation following disruption.” (Clause 3.5).
The future of any framework, risk management intervention is necessarily to be based on its perceived usage in stress situations and there were perhaps no better stress situations than the Covid pandemic to demonstrate the value that a proper, well planned & embedded BCM can have on the continuity of business operations, continuity of the relevance, or even survival of an entity itself.
How did BCM fare during the pandemic? Here it’s important to begin with few pointers.
Firstly, a pandemic of this magnitude, virulence was not conceived to be the part of any BCP or BCM.
As Forbes makes out in an incisive article ‘operations managers charged with business continuity predominantly focused on natural disasters, human error, cyberattacks and insider threats. In 2017, for instance, the top reasons cited for a business continuity plan were: minimising downtime, protecting what’s important, communicating with confidence, resuming operations and ensuring full recovery — all of which superseded the imperative to ensure employees’ physical and mental well-being over an unprecedented period of time.’
However, despite this, the key point here is whether the organisations which had a well-planned BCM in place, a structured and organisation wide plan with the buy in of key stake holders, fared any better, compared to those entities who had no worthwhile BCM or BCP in place before the onset of pandemic.
While no specific study seems to have been done to assess on these comparison matrices, it is part of anecdotal knowledge that even brick mortal organisations had a requirement to switch to an online model or at least a hybrid model to cope with the challenges of lock down. And all those entities which had a BCP in place or were at least were flexible enough to foresee the requirement to change and adopted to change their work processes are able to operate in an online mode, managed to do their ordained business, either to the fullest extent or at least partially.
Trends & predictions for 2023 and beyond:
- BCM as a specialised risk domain has received due focus, may be inadvertently on account of the onset of a once in a lifetime pandemic.
- The budget allocation for BCM has increased in the last 2-3 years & also FTEs.
- The concept of enterprise-wide risk management has also received
increased focus and attention, leading to better appreciation of nuances of risk management. - There is a possibility of enhanced pace of innovations in the arena of Business Continuity Management as it has been seen as life saver or rather entity saver!
- And then BCM may also become one of the mainstream domains of risk management in the line of credit risk, market risk, operational risk in the light of the focus & prominence has garnered in recent times in the not-too-distant future!
Final Word: Continuity of operations is vital for maintaining organisational confidence, reputation and, in some cases, survival. Security and risk management leaders responsible for business continuity need to understand the full scope of their BCM efforts, which should comprise an enterprise-wide program.
Views expressed by Ashutosh Mishra, Chief Risk Manager, National Bank for Agriculture & Rural Development (NABARD).
