Business Continuity Management

Building an Effective Incident Management Plan

Michael Blyth

• Publisher: Wiley
• Year: 2009
• ISBN:
  9780470478097
• Edition: 1
• Topic: Business
• Subtopic: Decision Making
• Index: Business

PRAISE FOR Business Continuity Management

Few businesses can afford to shut down for an extended period of time, regardless of the cause. If the past few years have taught us anything, it's that disaster can strike in any shape, at any time. Be prepared with the time-tested strategies in Business Continuity Management: Building an Effective Incident Management Plan and protect your employees while ensuring your company survives the unimaginable.

Written by Michael Blyth—one of the world's foremost consultants in the field of business contingency management—this book provides cost-conscious executives with a structured, sustainable, and time-tested blueprint toward developing an individualized strategic business continuity program. This timely book urges security managers, HR directors, program managers, and CEOs to manage nonfinancial crises to protect your company and its employees. Discussions include:

• Incident management versus crisis response
• Crisis management structures
• Crisis flows and organizational responses
• Leveraging internal and external resources
• Effective crisis communications
• Clear decision-making authorities
• Trigger plans and alert states
• Training and resources
• Designing and structuring policies and plans
• Monitoring crisis management programs
• Stages of disasters
• Emergency preparedness
• Emergency situation management
• Crisis Leadership
• Over 40 different crisis scenarios

Developing and utilizing a business continuity plan protects your company, its personnel, facilities, materials, and activities from the broad spectrum of risks that face businesses and government agencies on a daily basis, whether at home or internationally. Business Continuity Management presents concepts that can be applied in part, or full, to your business, regardless of its size or number of employees. The comprehensive spectrum of useful concepts, approaches and systems, as well as specific management guidelines and report templates for over forty risk types, will enable you to develop and sustain a continuity management plan essential to compete, win, and safely operate within the complex and fluid global marketplace.

Chapter 1
Business Continuity Management Plan

The incident management plan (IMP) is a detailed component of a Business Continuity Management (BCM) Plan. Also known as the enterprise resilience, emergency preparedness, or risk management plan, it forms the advance planning aspects that enable the initial crisis response activities to be conducted in a prearranged and organized fashion. The IMP is designed to support business continuity and incident recovery at the early stages, meeting immediate event response needs as resources are mobilized and more mature and comprehensive management measures are brought into play. The IMP can bridge, or be part of, more detailed crisis response plans such as evacuation management, disaster response, and reputational recovery, as well as dealing with kidnap and ransom situations and pandemics. However, these stand-alone plans are often better served as comprehensive components within the overall Business Continuity Management Plan (as they will likely be more oriented to specific divisions, fields, or regions), whereas the IMP addresses more common and generic risk types that the organization might face at the outset of a crisis event. The IMP at the basic level supports immediate tactical considerations and management functions, rather than long-term risk management and business recovery needs. Where feasible, the company should seek to transfer decision making to the lowest levels possible for the initial response requirements, as this will strengthen and empower local managers to contribute effectively to the management and early resolution of a crisis event.

---

Business Continuity Planning Terms

• Contingency planning and crisis management
• Enterprise resilience
• Emergency preparedness
• Enterprise risk management
• Emergency management
• Critical situations management

---

For the purposes of this book, incident management focuses not on the strategic, specialist, or sustained response measures, but on more granular and tactical support mechanisms that are the precursors to more complex and corporate-driven crisis management and business recovery policies and plans: the first 24 to 72 hours of an emergency. This book touches on the broader aspects of risk management in order to support the reader in placing the IMP within an understandable context. However, the book is principally designed to discuss the first stages of crisis response where incident management will play an active part in bringing an emergency situation under control, as well as feeding crucial information to company officers. The IMP is a tool for a wide spectrum of users, not only security professionals or corporate leadership. As such, the IMP supports local management in collating accurate information and following simple response guidelines to reduce the initial impacts of an emergency event, bringing control to a situation and further mitigating the risks that could escalate out of control from a problem, or be created as secondary or peripheral effects as a result of the initial crisis event. The IMP in these terms is also a short-term measure, allowing a degree of organized control to be implemented while the company mobilizes resources and specialists during the early stages of an emergency.

Companies should be aware that the social fabric of a culture or an area can be quickly undermined by a crisis situation, resulting in unique and challenging risks to commercial organizations, their employees (and families), facilities, and business activities. Even within Western countries, the speed at which deteriorations in governance, basic amenities, and societal rules can be surprising. The implications can be widespread and catastrophic, or localized and disruptive. Crisis events may result from a natural disaster: a flood, earthquake, hurricane, or pandemic. They may result from widespread civil disorder: a coup, political instability, insurgency, or war. Or a crisis event may be localized: a riot following a football match, aggressive measures over farming disputes, fuel shortages, a focused labor dispute issue, or directed attacks against individuals, groups, or facilities.

The following list illustrates some macro-level considerations companies should incorporate into their strategic planning for crisis management:

• Governance. The loss of governmental control and policing authority can be swift and widespread. Government offices may be directly affected or overwhelmed by a crisis event, and officials may not have the knowledge, capacity, or resources to quickly support the affected populace. Government offices dedicated to dealing with a crisis situation may also be undermined as personnel respond to personal emergencies or to care for families, diminishing a government's expected capacity to respond to a crisis effectively.
• Social Fabrics. The social norms that regulate our societies can be quickly lost or undermined as the effectiveness of governance is diminished. Rioting, thefts, looting, and other social crimes can quickly spread to otherwise law-abiding sections of the community. This is a cyclic effect and can create a further loss of governance which might exacerbate a crisis and add additional elements of risk to the original crisis event.
• Utilities. Common utilities and services can be disrupted, such as power, water, sewage, and communications, during a crisis. Basic amenities like food availability, financial services, and fuel provisions can also be affected. Modern cultures are not best engineered to weather a loss of power or disruptions to food, fuel supplies, or utilities, and often struggle to manage if common services are disrupted, and such losses can also result in secondary crisis events.
• Movement. Movement can be affected by crisis situations, whether due to man-made risks presented by hostile or disruptive groups, or due to damaged infrastructures or the unavailability of fuel or power supplies. This can affect every aspect of emergency management, from those dealing with emergencies at the point of crisis to those attempting to respond in support of the emergency or evacuate from an affected area.
• Critical Services. Critical services, such as fire response, medical provisions, and health care, or critical infrastructure power and utilities can be seriously undermined with the loss of basic utilities, undermining the ability for such groups to respond to or support an affected population. Infrastructure damage and affected supply chains of critical materials or resources can quickly devalue otherwise effective critical service providers.
• Communications. Communication mediums may be affected by a crisis event disrupting or preventing the effective passage of information and instructions which might support an understanding of the crisis event, as well as the effective response to an emergency. Communication systems may be damaged, or overwhelmed by a surge of use. Often voice mediums are lost before text and this can affect both government entities' ability to mobilize and respond to a crisis, as well as a commercial organization's respond measures.

---

Crisis Definitions

A crisis is (1) an unstable condition, as in political, social, or economic affairs, involving an impending abrupt or decisive change, or (2) an abnormal or unique event that threatens groups or individuals, as well as their goals and enterprises, through disruptive or harmful effects.

---

A crisis event can also be considered in terms of the micro- and macro-level crisis. The micro crisis is the point of the event: a collapsed building, fuel leak, or roadside fatality. The macro crisis consists of all of the risks that originate and ripple outward from that event: threats posed to surrounding buildings, recovering trapped persons, bringing control to the oil leak, dealing with the media, and reducing reputational and liability risks. In these terms, the IMP typically focuses on the micro-level crisis: the event itself. The IMP does, however, play a fundamental role in supporting the company in dealing with macro-level considerations and threats. Therefore, the IMP may be considered the first of many steps within a broader crisis response plan, acting as a precursor to the fuller crisis response measures being implemented by the company, as well as the transition point at which a company goes from managing the incident to controlling the effects of the wider crisis. This is a subjective delineation and will of course be influenced by the nature of the event, the composition of different management teams involved within the emergency, and the operating environment in which a company is performing work. An effectively designed and implemented IMP reflects the level of effort a company invests into ensuring the safety and welfare of its employees, protecting its business interests and brand value, and maximizing operational productivity through pragmatic contingency planning measures that enable effective, immediate, interim, and long-term crisis response mechanisms and methodologies to be implemented.

Given the ease at which organizational control and governmental support can be lost during a crisis, companies should seek to design and resource a degree of self-reliance within their crisis planning that takes into consideration these factors, while still leveraging and exploiting external governmental and other resources to support their response measures and capabilities.

Crisis Management

For the management of risk within a nonspecialized industry or more tangible fields such as construction, development, power and water, fuels, maritime and air, consulting, and training, the company's or its security vendor's crisis response team typically comes from a military or law enforcement background where the concept of incident management and crisis response has been an integrated aspect of their careers. In addition, subject matter experts within areas such as health and safety, engineering, administration, and legal considerations will also support critical crisis response decision making. Where risk elements are more market sector focused, such as business, financial investments, and mergers and acquisitions...

Table of contents

• Cover
• Contents
• More Praise for Business Continuity Management
• Title page
• Copyright
• Dedication
• Preface
• About the Web Site
• Chapter 1: Business Continuity Management Plan
• Chapter 2: Incident Management Plan
• Chapter 3: Crisis Management Structures
• Chapter 4: Scope of Risk
• Chapter 5: Incident Response Guidelines
• Chapter 6: Crisis Information Capture Reports
• Acknowledgments
• Index
• End User License Agreement