Resilience management for an effective response to business interruptions

Updated: Jun 12, 2023

Identification of key threats and implementing a framework for safeguarding the business is a fundamental part of business continuity management (BCM).

For an industrial facility, such as a manufacturing plant, an accidental scenario can cause significant financial damages, but also affect regulatory compliance, personnel safety, protection of the environment, breach of contractual requirements, and the organization’s brand and reputation.

Such scenarios could be cyber-attacks, data fraud or theft, pandemics, financial crises, production stops, utility outages, failure of critical machinery, or natural hazards.

For an asset owner, it is therefore important to implement a framework for identification of the key threats and implement organizational resilience for effective response safeguard in the interest of key stakeholders, reputation, and value-creating activities. This framework can also be described as Business Continuity Management (BCM).

The following steps are important aspects to form the fundaments for a structured BCM approach and can help your organization in managing risk in the daily operation:

Step 1: Management Structure.

Support from top management when working with BCM is crucial when implementing it into your organization. It is important that the management participates in the BCM process and support it by assigning adequate resources, and people, providing relevant technology, and ensuring budgeted funds are provided.

Step 2: Business Continuity Risk Assessment.

The aim of this step is to establish an understanding of your business and organization through risk assessment. Key activities during this step are Risk Assessment and Business Impact Analysis. When assessing the risks, it can identify business processes that are integral to keeping the business unit functioning in a disaster and determine how soon these processes should and can be recovered.

A Business Impact Analysis (BIA) will support the identification of key business assets and dependencies (both internal and external), functions, important applications and utilities, partners, vendors, resources, and the eventual evaluation of potential loss to the organization in the event of a crisis. The results of the BIA will likely drive the levels of actions, coverage, and risk contingency to be assumed by the organization.

It will outline critical operations, critical resources and processes, personnel, and technology and may ultimately drive investment priorities for an effective Business Continuity Plan (BCP).

Step 3: Determine the BCM strategy.

As a result of the previous steps, the BCM team will be able to choose the appropriate continuity strategies to enable it to meet its recovery objectives. Items such as staff, premises (and backup premises), technology, information, suppliers, and stakeholders must be included as part of the strategy by asking: How likely is it that a critical asset or process will fail, and what are the consequences?

Step 4: Implementation of the BCM.

This step is concerned with the development and implementation of appropriate Business Continuity Plans, Technology Recovery Plans and Crisis Management Plans to ensure continuity of critical activities and the management of a threat or incident.

Step 5: BCP maintenance.

It is important to ensure that the BCM arrangements are validated and that the BCP is tested and kept up to date. The documentation should be maintained to match current business requirements in your organization. In addition, relevant BCM policies and standards should be adhered to (for example ISO 22301 and ISO 22317).

When a structured and detailed approach to BCM and a tailored BCP is implemented into your organization, it can help in achieving adequate and safe Business Resilience for your Company by protecting against underlying threats and incidents.

ORS Consulting supports asset owners in various sectors with Risk Management. Business Interruption (BI) and Business Impact Analysis are usually central terminologies from an insurance perspective on various industries. We have experience also from this perspective, providing in-depth studies on these subjects.