Crowdstrike and the UK riots at the beginning of August 24 illustrate how unpredictable events can quickly disrupt business. These unpredictable, disruptive events aren't a recent phenomenon; there are plenty of examples over the last five years, aside from Covid.
With tensions mounting in Asia, the potential for an extended conflict in Eastern Europe, changing weather patterns, and the increasing application of AI, there is plenty of scope for further "unpredictable" /Black Swan disruptive events.
So, how do we protect ourselves from these?
It's true that you can't plan for everything, but can you plan for Anything?
We think you can, or at least you can very close to it, and this defines the difference between Business Continuity and Business Resilience Planning.
DW News image July 2024
Planning for Everything requires an event/threat-based approach. This is Okay for the threats/events we understand, and it is typically addressed with a Risk Assessment at the outset of BC Planning in the Analysis phase.
This has inherent challenges; firstly, it is limited to known threats (what about the "unknown"?), and secondly, the BC Process can easily spin out of control when we start trying to think of everything that could happen - this is a common cause of "dis-engagement" with the process.
What about the "unknown"?
Planning for Anything requires a different approach by looking at operational functionality and being "event agnostic".
So, let's get clear on the basic concepts...
A business delivers its products and/or services by utilising its Assets and Resources.
These may be the obvious physical assets and intangibles such as brand and reputation, external assets/resources such as supply chain, and our product/service distribution/route to market.
...and it delivers these products/services through time.
Time is the real currency of resilience planning.
When Planning for Anything, rather than looking at threats/events, we need to focus on two things;
- Our ongoing ability to deliver products/services through the availability of our Assets/Resources - after all, it is the combination and utilisation of these that allows us to deliver our products/services.
- Our Tolerance for Disruption: if I can't deliver my product for X long, I experience Y damage.
Tolerance for Disruption
In the BC process, we look at the Maximum Tolerable Period of Disruption (MTPD), which is focused on major events that will "kill" the business and is illustrated in the diagram below. However, lower levels of "outages" can cause a different impact, over the longer-term damage and impair the business's future opportunities - and this is because disruption can create a resilience reaction in customers.
If we consider a business that has built a model around a sole supplier solution, this can drive great efficiency and cost control. However, if that business has an outage, maybe only a short outage from which it recovers, the disruption may cause its customers to begin thinking about a dual supplier strategy to build their resilience.
So, in addition to the MTPD, there is an earlier point at which the model experiences some damage, a point at which customers start to react. We describe this as the Initial Point of Customer Reaction (IPOCR).
When we experience disruption
Major Disruption vs Minor Disruption
In the BC Process, the MTPD will be one factor driving our BC Objectives and our Programme Design. But understanding when our Customers are likely to start reacting to disruption and to what degree allows us to consider lower levels of disruption that can cause a different type of damage - that sparks a resilience reaction in its customers. Arguably, lower levels of disruption can be more likely than a major event! Last year, we worked with a business two days away from being unable to supply its product due to a cyber attack at one of its key (and sole) suppliers of a key component of its product.
Shaping our BC and Resilience Objectives
As an example, Company A has three clearly defined product channels with MTPD's as follows
- Product Channel 1 - 8 weeks
- Product Channel 2 - 10 weeks
- Product channel 3 - 12 weeks
But it has IPOCR of:
- Product Channel 1 - 2 weeks - could cause the loss of 30% of sales
- Product Channel 2 - 3 weeks - could cause the loss of 25% of sales
- Product channel 3 - 6 weeks - could cause the loss of 35% of sales
Once we understand our Maximum Tolerable Period of Disruption (MTPD) and the Initial Period of Disruption to Continuity (IPOCR), we can assess the recoverability of our assets and resources. In the above example, if we consider Product Channel 1, having a 2-week tolerance for disruption instead of 8 weeks, this may drive very different requirements for BC and Resilience requirements, Objectives, and the overall Programme Design.
It doesn't matter why the asset/resource is unavailable - if you can recover it within your IPOCR, you will be resilient!
Once we know our MTPD and IPOCR, we can look at the Recoverability/Recovery Time of our Assets/Resources. Rather than assessing the Recoverability against our MTPD, the IPOCR drives different outputs. This opens up the opportunity to consider threats and risk reduction at a more granular level based on the criticality/recoverability of Assets/Resources.
Free Business Continuity and Resilience resources
Look at our free resources here to learn more about Business Continuity and Resilience and how to plan for anything. Or get in touch for a chat about how we may be able to help you move your business continuity planning forwards.
