Breaking with tradition

Breaking with tradition

And so the debate rages on! My own conclusion on this thread are as follows:

-         It’s always healthy to challenge (and potentially disrupt) the status quo. Failure to do so allows dogma and vested interests to grow unchecked. This is what has happened with the “traditional” Business Continuity Lifecycle – compliance dominates at the expense of effectiveness. There are now many vested interests in sustaining the traditional approach that any fresh ideas are met with angry resistance, particularly where the alternative offers a lighter touch or makes the subject matter more accessible to non-specialists

-         The traditional BC lifecycle – now supported by a “standard” tends to become overly focussed on process compliance and the production of documentation to prove that the process has been complied with. This has very tenuous relationship with an organisations intrinsic capability to defend and recover from business interruptions.

-         There was one response in this thread by a respected practitioner that pulled me up: “techniques that many of us have used for 20 years” – which could imply that those with real experience have been adapting “the traditional business continuity lifecycle” for practical purposes for some time. I’m not sure if that actually counters the argument or makes it!

 

The bottom line here is: what works the most effectively. Do we get the same or a better outcome from one technique or another? Do we need less process, less “certification”? By way of justification I’m seeing some similarities to a book I wrote several years on the optimal way to use IT for competitive advantage. The backdrop to this (it was in the late ‘90’s) was some influential studies from Harvard and other prominent business schools on early corporate pioneers who exploited IT to gain strategic market advantage. This fuelled the rush to use IT for strategic business advantage. This turned into a fad and just about every major consultancy was touting their methodology for success in this area. I could not help but notice that not one of the major consultancies could show that THEIR method produced superior results (in fact, none of the organisations cited in the business schools studies engaged ANY consulting firm to assist with developing their strategy!). My own empirical research which became ”Infopreneurs” found no similarity in process from which significantly successful strategic systems were created, but highlighted a common culture that was prepared to consider different approaches, encouraged free thought (regardless of where it came from) and facilitated innovation and focused all of this on optimising and improving customer service. The problems and disappointment start when someone tries to retrofit a structured process on this without the underpinning culture.

 

Bringing this back to the subject BCM approaches: my opinion is that a high-level framework that signposts the direction of travel is helpful – but the underlying and genuine commitment to achieving the desired goal must always be present. As specialists in this area we can development improvements by sharing ways in which we optimise specific activities (and maybe even bypass some) but we cannot expect that following one process over another to will lead us a particular destination. Over dependence on process becomes dogma.


“It is impossible to lay down binding rules, because two cases will never be exactly the same.”
Helmuth von Moltke

To view or add a comment, sign in

More articles by Steve Dance, MBCS

  • The Overlooked CISO

    This post by Michael Reichstein stirred up some powerful responses on the challenges and frustrations of people in…

  • Nudge, Nudge, Wink, Wink -Business Continuity Awareness

    Nudge theory focusses on creating subtle influences on people's behaviour without authoritarian mandates or…

    1 Comment
  • Business Continuity Awareness

    What is business continuity awareness? Business continuity awareness is about creating familiarity and understanding of…

    1 Comment
  • Operational risk appetite - a source of indigestion?

    The concept of risk appetite originally came from the investment industry as a measure of capital risk an investor was…

  • Information security basics - what "good" looks like

    A few days ago Matthew Trump published a post that highlighted the fact that the root cause of the vast majority of…

    2 Comments
  • Business Continuity Exercising: Out of Ammunition?

    There's been some "buzz" around two government led exercises related to pandemic response plans: Exercise Cygnus (and…

    5 Comments
  • Navigating in a whiteout

    Thre's real concern that information security specialists are under considerable stress and experiencing "burnout"…

  • Incident Preparedness: what colour are you?

    I recently stumbled across something a concept called the Cooper Colour Code. The Cooper Colour Code was developed by…

    2 Comments
  • When threat awareness = business as usual

    Another "thought-piece" stimulated from Chris Ryan's book "Safe". The content of this article was prompted from a…

  • Protests & Demonstrations: staying safe

    Protests and demonstrations always have a possibility of turning ugly and while the majority of business continuity/…

    3 Comments

Explore content categories