Business Continuity Management

1-1. The objective of business management

One can trace the beginning of the evolution of BCM during the early days of commercial and professional disaster recovery sites in the context of IT security. It became clear that old infrastructures were immensely vulnerable in the aftermath of the 9/11 terror attacks. There was a need to develop a reliable BCM system. The objective of a present-day BCM process is to ensure that business leaders and business organizations are able to cope and manage a serious disruption so that stakeholders, workers, and leaders are able to continue their work and sustain critical activities.

1-2. Risk management and business continuity management

There are several similarities and differences between a risk management process and a BCM process. When talking about similarities, both conceptual frameworks were developed to identify and mitigate the impact of risks and vulnerabilities within the system. Both conceptual frameworks contribute to the creation of a culture that espouses the value of readiness. However, there are evident differences. Risk management focuses on the information aspect of protecting the business from risks and vulnerabilities, whereas BCM is a more pragmatic approach to ensure the continuity of the business enterprise. In other words, BCM not only informs business leaders about hazards and potential areas of vulnerabilities but also provides a way to test the risk mitigation processes as well as the strategies and processes that are going to be implemented in order to ensure that the business operation does not fail in the event of a serious disruption.

1-3. The objectives of the three internationally recognized standards that promote private-sector preparedness

There are three international standards, namely NFPA 1600; Business Continuity Standard ISO22301; and ASIS American National Standard for Organizational Resilience.

NFPA 1600 aims to develop an approach that addresses issues related to the prevention and mitigation of risks; aims to develop a process related to recovery and continuity of business operations; and aims to create a management tool that identifies weaknesses and risks that can disrupt business operations.

Business Continuity Standard ISO22301 is aimed at developing organizational resilience; is aimed at updating, managing, and utilizing effective plans related to contingencies and critical business processes; and is aimed at helping the organization to handle disruptive events.

ASIS American National Standard for Organizational Resilience is tasked with developing a well-crafted system that ensures business continuity; is tasked with reducing the probability of business disruptions; and is tasked with lowering or eliminating the negative effects of a disruptive event.

2-1. Developing a business continuity plan

A business continuity plan provides valuable and pertinent information in the case of a disruptive event and helps business leaders to issue directives with regard to three critical and related issues, namely emergency response and incident management; business continuity; and recovery and resumption of business operations.

2-2. Role of a business impact analysis in business continuity

A business impact analysis helps leaders determine the recovery time and the recovery point objective or the timeframe that guides them in resuming critical business activities. It also guides them in pinpointing the risks and threats that may have an adverse effect on critical aspects of business operations. Finally, the business impact analysis gives leaders a clear idea regarding the resources that are needed in order to initiate the recovery procedures.

2-3. Describe the following strategies:

• Active back-up model: There is the existence of a backup location that can access files and other resources in order to resume critical aspects of the business operation; accordingly, it may include facilities that allow employees or IT staff members to relocate to the said backup site.
• Split operations model: There are two geographically “split” but active sites that can handle key operations in order to prevent the disruption of work and key business activities; therefore, these two sites can be treated as backup sites or a way to divide the workload or create reciprocal backup facilities.
• Alternative site model: There is a redundant site that acts as a secondary backup site for the primary backup facility.
• Contingency model: This is the development of alternative ways or facilities that can be used as an alternative process of producing goods or providing services when the main production mechanism is not available.

2-4. Roles of senior management

Senior managers play an important role in establishing a corporate culture that values the development and implementation of a business continuity plan. It is the influence of the senior managers and their support that can validate the importance of any BCM-based strategy. They can show their support by communicating the business continuity plan and making sure that every department is aware of its existence. Senior managers must ensure that every employee, department head and business unit manager possesses knowledge of the business continuity plan. In fact, this is made possible by investing in training and exercises that are aimed at developing a mindset that anticipates hazards and vulnerabilities and, in turn, helps develop appropriate measures to ensure minimal or no work disruption.

3-1. 4 stages of a strategic redeployment plan

The four stages are listed as follows: 1) Emergency Stage; 2) Alternative Marketing Stage; 3) Contingency Production Stage; and 4) Communication Stage.

3-2. 3 objectives of the emergency stage of a strategic redeployment plan

There are three objectives under the Emergency Stage, and these are listed as follows: 1) Protect people or workers from hazards, vulnerabilities and risks; 2) Protect the physical assets of the organization in order to keep its value, making it possible for these assets to be used during the resumption of business operations; and 3) Protect the reputation of the organization, especially in regard to its capability to provide quality outputs and its commitment to provide quality work.

3-3. Summarize the alternative marketing stage

The person designated to handle this stage of the redeployment plan is tasked with analyzing or establishing the impact or adverse effect on the reputation or the market share of the firm after an event disrupted or negatively affected the production or work capability of the enterprise.

3-4. The contingency production stage

Business leaders must consider the most critical step in the aftermath of a disruption. They must decide the product or service that has to be produced or provided considering the limitations and challenges that they faced. They have to take into account the type of supply chain management protocol and the logistics that they can utilize in order to prevent work stoppage.

3-5. The sole objective of the communication stage

The sole objective is to communicate to the stakeholders the impact of the disruption and what can be expected from the firm and the leaders in the nearest future.

4-1. Supply chain risk management

Supply chain risk management is a deliberate effort to identify, control, and monitor risk factors that can interrupt the process of creating a product or the provision of a particular service. It involves the identification of supply chain exposures and vulnerabilities and development of contingencies and risk mitigation measures to prevent disruptions and interruptions.

4-2. 6 internal supply chain exposures and vulnerabilities

The six internal exposures and vulnerabilities are listed as follows: 1) production bottlenecks; 2) infrastructure; 3) production location; 4) information technology; 5) breakdown of equipment and machineries; 6) and employment issues.

• Production bottlenecks: In a typical supply chain framework, there is a segment or process with a limited capacity that violates the capability of the system to generate products or provide a particular service. For example, in a manufacturing facility, there is an equipment with a limited capability, and the whole factory has to wait for that equipment to finish its work before the other components can be added to the product.
• Infrastructure: The design and capability of a factory or production site can cause a disruption or interruption. For example, if the building is not well-managed, raw materials and other items can become a fire hazard.
• Production location: Certain risks are associated with the location of the manufacturing facility or the company’s headquarters. For example, if the building is constructed within a fault line, there is a possibility of work disruption in the event of a massive earthquake.
• Information Technology: Vulnerabilities in the context of Information Technology are oftentimes more costly due to the unauthorized use of sensitive information and damage to the reputation of the business organization. For example, a security breach inside a bank’s IT-based infrastructure can lead to the pull-out of investor’s money.
• Breakdown of equipment and machineries: The failure to establish mandatory maintenance checks and repairs can lead to costly breakdowns and stoppage of work operations.
• Employment issues: Workers on strike or a health issue that forced workers to halt their operations in the office can lead to temporary suspension of business operations.

4-3. 8 external supply chain exposures and vulnerabilities

The eight external supply chain exposures and vulnerabilities are listed as follows: 1) Third-party suppliers; 2) Sole-source suppliers; 3) Single-source suppliers; 4) Financial risks;

5) Geopolitical environment; 6) Natural disasters; 7) Man-made disasters; and 8) A key supplier transfers allegiance to a competitor.

• Third-party suppliers: There is little control with regard to third-party suppliers because they are accountable only to an external business partner or supplier that directly interfaces with the firm. For example, the third-party supplier has no contractual obligations within the firm.
• Sole-source supplier: It is an example of a vulnerability if a firm is under an agreement to get only raw materials or components from one supplier. Thus, it is much better if the firm works with at least two suppliers providing the same component or product.
• Single-source supplier: It is another example of vulnerability when the firm does not take extra effort to find another legitimate supplier that can provide the same raw material or component. In this case, the firm is not obligated to work with only one supplier, but due to negligence, incompetence or a constraint, there is only one supplier for a critical requirement.
• Financial risks: There are different forms of financial risks that can affect the company. For example, a financial crisis within the banking industry makes it harder to get a line of credit; therefore, the source of financing exhausts, and the firm can no longer pay its bills or expand its business operations.
• Geopolitical environment: This type of vulnerability is highlighted in countries wherein there is a problem with law and order. However, the geographical location of the company’s headquarters or the manufacturing facility can also become a source of vulnerability, for example when it is located near an active volcano or is easily harassed by local insurgents.
• Natural disasters: It is difficult to predict the impact of a natural disaster. However, firms can use historical data and the topography of the location of the company’s headquarters and facilities to have a better grasp of the potential risks in a given area.
• Man-made disasters: One can argue that it is not an easy task to anticipate man-made disasters. One can study terrorist activities in the past or seek expert help to predict human behavior. The prevention of man-made disasters includes a thorough assessment of the weaknesses or hazards within a system that terrorists can use to cause extensive damage to the facility or the employees.
• A key supplier transfers allegiance to a competitor: It is like having a single supplier, and the said supplier decides not to provide the needed components or raw materials. However, in this case, the problem can become much worse if the firm had created a competitive advantage using the supplier’s products. Thus, the competitive advantage is lost and transferred to another competitor.

4-4. Supply chain best practices

The process for establishing supply chain best practices includes: 1) initiation of a business influence analysis and risk estimation; 2) creation and application of a business continuity plan; 3) establishment of a BCM or BCP culture; and 4) maintenance and update to the plan.

• performance of a business influence analysis and risk estimation: It is imperative to extensively study the different aspects of the business model and the supply chain process. It is also critical to understand the vulnerabilities and risks relating to a particular supply chain process.
• development and implementation of a business continuity plan: It is not enough to simply create a document that describes the firm’s business continuity plan, while it is also prudent to develop the mechanisms that would allow business leaders to implement the said plan.
• establishment of a BCM or BCP culture: There is only one way to ensure the implementation of a business continuity plan that is to establish the necessary corporate culture beforehand.
• maintenance and update to the plan: Changes occur in regard to technology, regulations, and personnel. Thus, it is also reasonable to make changes to the plan on the basis of current needs and resources.

5-1. Attributes of a good stakeholder crisis communication plan

A good stakeholder crisis communication plan considers the business relationships that will be affected by a critical event or any form of disruption. The end result should be to minimize employee turnover, lower the risk of litigation, and ensure that the firm’s reputation remains intact.

5-2. Communication that should be directed specifically to internal stakeholders

An example of communication that should be direct to internal stakeholders would be the transmission of a message regarding backup sites and relocation procedures.

5-3. Communication that should be directed specifically to external stakeholders

An example of communication that should be directed to external stakeholders would be the transmission of a message regarding the impact of a disruption and the steps that will be taken to ensure the continuity of the business operation.

6-1a. Identify at least four exposures for Southern Bend Ranch.

• natural disasters
• financial risks
• production location
• production bottlenecks

6-1b. 4 exposures for Whole Organic Meat Market

• sole-source supplier
• financial risks
• infrastructure
• breakdown of equipment

6-1c. Southern Bend Ranch: recommend at least one potential option

• natural disasters – Obtain insurance with “acts of God” coverage.
• financial risks – Change the contract to reduce or eliminate penalties when it involves man-made or natural disasters that are beyond the control of the firm.
• production location – It is best to transfer to a more suitable location.
• production bottlenecks – Increase the area that can grow chemical-free grass.

6-1d. Whole Organic Meat Market: recommend at least one potential option

• sole-source supplier – It is prudent to establish a secondary business relationship with another organic meat supplier.
• financial risks: The firm must search for a special type of insurance policy that would cover financial loses in the event of non-delivery of products.
• infrastructure – The firm must improve its storage capability to increase the amount of organic meats that can be stored during lean seasons.
• breakdown of equipment – The firm must have backup generators or a backup storage facility so that expensive meat products will not spoil in the event of a breakdown.

Share on Facebook Share on Twitter Share on Pinterest

Related Free Management Essays