BCI blog: How can we improve business continuity awareness?
Among the greatest challenges that characterise business resilience is the need to integrate and improve the level of awareness at every level of the organization in a homogeneous and functional way.
By “awareness” we mean the ability of personnel to understand the main objectives of a business continuity programme and to grasp the advantages that such a programme can bring to them and their daily activities. In fact, an effective business continuity management system should include the direct engagement of employees, with a particular focus on those who are involved in carrying out a process.
This methodology not only increases the general level of awareness but also identifies potential bottlenecks or “red flags”, which are not identifiable by the highest levels of the organization.
In order to improve the level of business continuity awareness in an organization, it is necessary that the high-level functions facilitate a top-down approach by becoming champions as well as promoting and believing in the effectiveness of the business resilience programme.
On the other hand, a bottom-up approach that focuses on individual resources will also yield tangible benefits.
Another essential and often underestimated point is the promotion of a healthy dialogue and debate environment where any critical issues, raised by those who operate daily processes, are taken as points of observation and improvement rather than mere problems requiring no follow-up action.
Too often personnel are not given the right space to express concerns since there is anxiety that such actions may have negative repercussions and because they fear that their concern may remain unheard and not receive any concrete actions (for this, a top-down approach is essential).
A great tool that organizations can adopt is to create walkthrough tests in which, following a preset input (a disastrous scenario like a fire, an earthquake, a ransomware attack, etc), personnel have to think about potential solutions and strategies to implement and restore the processes involved in the shortest possible time, possibly in line with the recovery time objective identified during the business impact analysis. This can involve any number of personnel and help make them active parts of a business continuity programme.
Quoting the essay “The Black Swan” by Nassim Nicholas Taleb, it is important to remember that predicting every single scenario that could potentially damage an organization and calculating its actual economic impact with precision is almost impossible. For this reason, having personnel that are trained to think proactively, and as part of a team, can prove to be a winning hand in resolving an emergency and/or crisis.
An additional tool that organizations could use to collect the issues encountered by personnel in their daily management and execution of activities, is to issue regular questionnaires where there is the possibility to anonymously express these concerns or issues which have not emerged during the business impact analysis.
This evidence will then have to be correctly evaluated to establish whether to classify them as red flags and/or potential bottlenecks, which will be followed by subsequent monitoring and prevention actions, or whether they can remain in the background.
Consider, for example, a manufacturing company where energy drops are detected by the operators on a production line from time to time. It is not high enough to cause costly damage but, at the same time, creates discomfort to those who interact daily with such machinery. This type of energy drop could lead to more extensive damage in the long term with possible knock-on effects on the entire supply chain as well as the inability of personnel to work at their best.
The use of a questionnaire will provide the workforce with a greater say and make them more involved during the entire business continuity process, thus increasing the likelihood of anticipating potential emergencies and/or crises as well as increasing the level of knowledge and understanding of the subject.
More on
About the author
Chiara Cavicchioli
Business Continuity Analyst
I'm a business continuity analyst at Bper Bank. I deal with the
execution of BIAs (business impact analysis) on critical processes, in
compliance with the main Italian regulations that characterize this
field (285, Dora, Resolution, etc ...) in order to develop Business
Continuity and Disaster Recovery plans (including the crisis
communication plan and the emergency plan) and related tests.
I
manage and coordinate the emergencies of small and large entities (eg:
earthquakes and floods), especially for processes considered critical
and with stringent RTOs.
I also deal with the execution of
business impact analysis (BIA), development of plans (BCP & DRP)
and tests for the other banks part of "Bper Banca Gruppo"
(Banco Di Sardegna, Bper Lux, Optima etc.) and for those in the
acquisition phase (eg: Carige and Banca Cesare Ponti);
I attended
a Master in Risk Management (RiskMaster) at the University of
Verona.
In April 2022 I got a CBCI certification (Business
Continuity Management certification), in November 2021 I got a FERMA
RIMAP certification (European Professional Risk Management
Certification) and ISO 19011 certification.
