Which activities and tools create the most value when building resiliency?

Curious to know what brings the most added value when implementing a resilience program?

Find the result of our featured DRJ Spring 2024 workshop, on activities and tools most valuable (or overrated!) when building resiliency.

Subscribe to our newsletter to stay tuned

Activities and tools create the most value when building resiliency!

Find out more about the results of our workshop, on the activities and tools that create the most value (or that are overrated!) when building resiliency. This list can also be seen as a "do's and dont's". Our aim is to provide you with concrete, actionable recommendations for your day-to-day work or annual review meetings.

Leadership

Your challenges:
- Convincing leadership that Business Continuity/Operational Resilience is important and brings value to the organization
- Get Buy-in & Commitment
- Establishing a good working relationship with senior and top management
- Get suitable/appropriate budget & resources
- Obtain decisions on priorities…

Elevator pitch

Presentation: Less is more

What is to come and key accomplishments

Integrated resilience program

Why we are important

Tabletop exercises and buy in

Steering Committee Quarterly Meetings

Know your operations: Critical processes

Reports that are not read

Long policy statement

Excessive reporting or unnecessary meetings

Separate BIA, BCP documents and process

Depend on tools and audience

Resources & Competency

Your challenges:
- Acquiring the knowledge and knowing how to support the program objectives
- Having enough time and tools to accomplish value added activities (less administrative tasks)
- Having adequate staff & budget
- Being able to build relationships and gain allies
- Integrating BC in day-to-day culture so that people embrace business continuity

Tabletop Exercises and Workshops (DR & BC)

Frequent Dry Run Exercises (DR & BC)

BIA, BCP, DRP and Risk Management Plan

System cataloging all resources

Training (new leaders, members, employees, etc.)

Have a plan, train for the plan, exercise the plan

RACI

Job description & performance evaluation

Marketing outreach on BC

Certification & Education

Printed documentation

Misallocation of resources

Awareness Articles

Have an exercise just to do an exercise

Perform BIA’s and do nothing with them

Producing document without an audience or purpose

Presentation

Your challenges:
- Presenting to top management or to large groups
- Regularly providing the organization with meaningful content on BC Running workshops
- Getting my points across
- Influencing key players
- Understanding the strategic impacts
- Understanding the context and culture of the organization
- Knowing how to focus on what matters to the organization’s interested parties
- Building relationships and gaining allies

Know your audience/Know who should be in attendance

Clear and concise presentations with metrics (Having data to inform and influence)

Visually impactful slides Linking content to strategic outlook for the organization / Graphic Tools

Having commitment from the right audience

Build relationships and allies

Reporting and status include any asks or issues

Using case studies of past successes / Using engaging stories to teach the topic / Charismatic and disarming presenter

MS Teams & Communication Tools

Tabletops to engage senior leadership

PowerPoint Excel Word as appropriate to the audience

Longdrawn out wordie presentations

Videoconferencing/ Team / Zoom leading to lack of engagement

Teams– zoom can be a single point of failure

Preparing materials and holding the "meeting before the meeting"

Incident & Crisis Management

Your challenges:
‍- Having the right people and authority
- Warning, alert and activation are not fully operational - Assessing the impact of the interruption and timeframe available to make decisions
- Knowing the actions to take
- Documentation and process are not up-to-date or fit-for-purpose for the organization
- Reviews and learning are limited

Dynamic response plan

Authority protocol in place

Situational awareness

Crisis management plan

Matrix for roles/responsibilities

Crisis management tools

Bridge lines and back up communications

Conference bridges with video and screen

Steering committee

Lack of recovery documentation

Call trees

Annual reviews are not frequent enough

Static plans

No commitment to keep up with cleansed data

Risk Management

Your challenges:
- Process is owned by other department
- Having access to risk register and understanding the threat landscape and of those events that could interrupt prioritised activities
- Risk Assessment is performed before BIA and danger of getting lost in large quantity of assessments
- Identifying and mitigating unacceptable risks and single points of failures
- Being able to highlight inefficiencies and risks, as well as gaps for top management to address or accept

Partnerships and tabletops

Monthly/Quarterly Risk meetings with appropriate stakeholders

Risk Matrix

Centralized Risk Register

Gap/Risk Attestation Tooling

Available reports (BCI Horizon Scan / Global Risk Report from World Economic Forum)

Identify teams/departments that have a budget

Coming Leadership waiving off risk due to not clearly understanding impact to business soon

Including too much or too few or not the right stakeholders

Risk Assessments for non prioritised activities

Communications & Notifications

Your challenges:
-Having the right tools available and using the right channels for different audiences
-Procedures and approval process are not defined
- Confusing/overlapping roles and ownership
- Knowing the interested parties, their concerns and key messages to communicate
- Not being comfortable enough to use tools
- Overall lack of communication

Emergency NotificationSystem

Teams / Zoom

Communication Exercises

Email template

Tabletop Exercises /Rehearsals

Mobile App with access to plans

SOP (Standard Operating Procedures) Documents

Workforce resilience services such as International SOS

AAR (After Action Reviews) /Post-Event Assessment

Shared mailbox (for receiving questions, requests)

Email originated at time of incident

Too many details on text

Laminated cards

Call trees

Reputation, Legal & Conformity

Your challenges:
- Demonstrate that we are a “safe” actor on the market
- Damage to reputation due to interruption
- Viral negative story on social media
- Collaboration between Crisis Communication & Crisis Management Structure
- Obtain legal support and involvement
- Program is implemented for regulatory requirements only
- Select appropriate standard/certification to adopt
- Conformity requirements take too much time and resources for team capability

Documentation / GeneralAuthority Policy (Do not speak to Media, etc.)

Using Industry standard technology

Clear concise and timely internal communication

Meeting Joint Commission requirements

Professional communication to the media

Paying attention to what is going on with other organizations

Social media

Certification

Stay ahead, in healthcare

Internet monitoring Communications Plan

Lawyers cost and approach

Legal Software

Applications Chat Bots

Following of flows and questions

Industry certification of program

Working in silos

Documentation & Data

You challenges:
- Having too many documents to update
- Not having access to the most recent information
- Not having access to all required information
- Benefiting from available information (imports, source of truth)
- Knowing where to begin and when to stop/right level of documentation
- Having document distribution roles/time consuming - Ensuring security of documentation

Standard templates

BC software solution that perform : dependency Mapping

Data privacy standards -naming convention

BC software solution that incorporates the organization’s retention policies

BC software solution that enhances plan sharing while ensuring security of sensitive information

Clarity of the ask

BC software that performs data imports from Corporate Systems

BC software that helps the maintenance process

Data retention periods too long

Viability of documents, given the rate of change

Approvals - the number of required approvals and the accountability associated with approving isn't clear

Must stop segmenting storage of documents across multiple platforms. Instead centralize and consolidate documentation.

Industry certification of program

USB keys and binders

Prioritized Services

Your challenges:
- Knowing the impact of interruptions
- Having accurate/realistic MTPDs and RTOs
- Process owners not understanding the true benefits of BC
- BIAs are not relevant or up-to-date
- Mapping activities and processes to Product and Services
- Cutting corners
- Responding efficiently during disruptions
- Identifying outsourced processes that present an increased risk

Depending on size of company you should be using tooling to manage your program

Identifying your critical assets and prioritizing them

Central Knowledge Management System Plan Reviews Asset Tiering

Plan Reviews Asset Tiering

Develop ranking of most critical systems first

Lexicon - common terms and graphics

Develop technical impact analysis and business unit impact analysis and compare the two

Useless meetings

Taking weeks to complete simple tasks

Doing things the same way you’ve always done them

Stop doing the preparation for the business unit owners. They have the experience

Strategies & Solutions

Your challenges:
- Defining the right balance between costs, resources and benefits
- Understanding the impacts of workarounds and adapting solutions accordingly
- Involving the right people taking ownership
- Designing the solutions and managing the projects
- Low attention to details
- Getting approval

Centralized office to provide governance and direction

Getting buy-in from stakeholders at all levels with clear roles and responsibilities

Centralized tool to complete the work / Single solution housing all strategies

Leveraging lessons learned from actual events

Executive advocate & Leadership buy in /Support from the top

Justification and clear communication

Strategy addressing a wide range of events with predefined responsive actions

Having cross functional teams that are accountable for response

Understanding ROI

Modularity in strategies and solutions

Over engineering and getting analysis paralysis

Controls can overstate or understate the level of preparedness

Localized impacts may be overstated

Aiming for perfection

Multiple levels of approvals required to take action

Excessively detailed plans for extremely specific events

IT Connection

Your challenges:
- Increased dependency on IT Systems
- Gap analysis between required RTOs and capability
- Connecting BIA’s results and crown jewels
- Mapping system dependencies
- Lack of plans and documentation
- Building a good working relationship between IT & BC
- Being informed of new projects and changes
- Designing solutions and plans to respond and recover from cybersecurity incidents
- Having an integrated exercise program

Dedicated specialists

Shared leadership

Centralized business continuity management platform tool

Centralized leadership that knows what IT is doing and how that impacts the business Strong comms with business regarding system impacting events

Aligning RTO and MTD, address gaps Exercise with IT and business stakeholders Dedicated DR sites that are tested routinely

Business impact analysis

Involving business and ITduring an exercise

CMDB (like ServiceNow)

Automate system dependency tracking

Developing recovery plans just to check the box

Silos

Maintaining documents without current state accommodations

Updating in a vacuum

Cloud

Biometrics for security

Supply chain & Outsourcing

Your challenges:
- Being accountable for the Product & Service delivery even if the service is outsourced
- Identifying dependency to outsourced services
- Identifying outsourced processes that present an increased risk
- Losing a link of the chain (one supplier)
- Just-in-time strategy with low inventory levels
- Mapping suppliers
- Establishing contractual agreement with SLA and BC requirements
- Overall resilience of supply chain

Multiple suppliers on in multiple locations /Multiple Vendor Supply Chain

Have an automation tool and have suppliers meet SLAs and supply chain policies

Contract Evaluation

Relationships management

Geoengineering Tools

Applications in use for mapping: Excel, BC Software

SLA management Contract Management

Suppliers mapping

Focus on all vendors

Lack of understanding of the outsourced processes

Ones that are not used

Building surveys no one will answer

Operational Resilience

Your challenges:
- Integrating operational resilience
- Distinguishing with BC Navigate legal and regulatory requirements (especially for financial sector)
-Collaborating with other disciplines in the organization and building relationships
- Identifying Important Business Services
- Expanding the scope of your team without being overwhelmed by new responsibilities
- Performing Stress tests scenarios

Steering committee that covers all Operational Resilience disciplines

Due diligence of vendors, have them to plan if a critical function goes down, how does it affect the business unit and the business itself

BIA

People/assets

Process

DR/BCP exercises with business units

DR tests with critical vendors

Software /Hardware

Annual meeting with Plan Owners to review their plan

Office Space & Desktop space

Identifying a large number of IBS

Steering Meeting with just BC or IT (should be across function)

More about the workshop

Whether you could not attend the workshop or would like to revisit some of the concepts discussed, please find below the recording of the workshop (the on-demand version) and the presentation used.

Watch the recording Download the presentation

Useful links

Discover useful and relevant resources to help you develop your resilience program.

BCI Continuity and Resilience Report 2023

This report explores the status of business continuity and resilience within organizations.

Learn more

BCI Horizon Scan Report 2023

The report uses survey responses and structured interviews with senior resilience professionals to provide an in-depth analysis of this critical area.

Learn more