Business Continuity and Critical Business Activities

Hello again, in this session I’m going to talk about business continuity management and in particular how do we actually identify whether something that we do in our organisation is a critical business activity.

Now business continuity management is all about making sure that in a time of disaster or after a time of disaster we are able to continue operation of our most critical business functions or if they have gone down, restore those critical business functions back to a state of working again.

Otherwise, if there is a huge lag time there we may not be able to survive as an organisation, we may lose market share, we may lose our customer loyalty, we may not be able to provide the services that we are legislated to provide, so it’s important that we understand those critical business activities.

Now one way we can do that and it’s been a way that’s been done in the past, we look at all the activities we have done in the past and rank them 1 to 5, where 1 is the least important and 5 is the most important.

There are some drawbacks that way and one of those and the most significant drawbacks , is the fact that, that’s very subjective. And everybody in the organisation believes what they do is important. But there is a difference between what is important and what is critical, so one of the methods you can use is to actually use your consequence matrix to determine the criticality of a particular critical business activity.

What we do is, is we look at the activity and we start to put some time frames around it. It might be 0-24 hours. 24-48 hours, 48-72, greater than 72 hours. And we start to look against all of our critical success factors from our consequence matrix as to what the consequence would be if that particular function was not able to be done for that period of time.

So let’s say we have a function, that within the first 24 hours, if we are not undertaking that function, it is going to have sever consequences, whether they be in safety, reputation, political damage, financial,, those sort of things.

So what we want to try and do is identify those that have the highest level consequences at the earliest point of time after the disaster. So if we’ve identified those particular functions that they would become sever or have severe consequences in a very short time frame, obviously therefore we have identified what is critical to our business.

Now what I’ve done is, I’ve given or put onto the website an example of a critical business function analysis, a spreadsheet. Your more than welcome to use that, and obviously you will be able to change all of the time frames that I have put on there all of the critical success factors that you measure consequence again. And obviously you will need to change the activities, and that is a resource that I hope you would actually use, it is a much better way of just having arbitrary discussion around what’s the most important thing we do in our organisation.

If you link it to our consequence matrix than you almost have some supporting data to justify why you have chosen that as a critical business activity. The first time I used this we turned an organisation that had identified 30 critical business functions into 5, that’s how powerful it can be. So I encourage you to have a look at the website and that tool is yours to use and as you see fit and hopefully it’s useful to you.

That all I’ve got for this session, and as always lets be careful out there.