Business Continuity and Crisis Management - Coursework Example

Business Continuity and Crisis Management Name Course Name and Code Instructor’s Name Date Crisis management Definition A crisis is any event that can cause harm to a firm’s constituent, its finances, its facilities or its reputation within a short span of time (Regester and Larkin, 2008). Crisis management is the art of decision making that helps in heading off or mitigating the effects of a harmful event while the event is unfolding (Borodzicz, 2005). Thus decisions are made about the future of a business while one is under stress and lacks vital information. Prior practical planning before a crisis happens is fundamental for effective institutional response to mitigate such adverse situation. Difference between crisis management and risk management Crisis management refers to a process or a collection of processes which are put in place to deal with unexpected event that threatens to harm a firm, a business, an individual/ group of people or an operation (Hiles, 2010). A crisis usually takes place without any prior warning and thus it is essential that plans are put in place that can be implemented swiftly to either reduce the effect of the crisis in order to restore normality within a short span of time or to remedy the situation (Smith, 2005). On the other hand, risk management is a continuous process where potential threats are identified and solutions are put in place to avoid these risks (Sadgrove, 2005). Risk management is more of proactive whereas crisis management reactive (Smith, 2005). Crisis management is very important in spite of the risk management measures in place since crisis often have no prior warning. Risk management is said to be the basis for a comprehensive business continuity and crisis management program and it determines the decisions that affect all of the other functions contained in the framework (McEntire, 2007). Risk management takes place prior to the happening of a crisis event. Risk management requires dialogue with various stakeholders, monitoring and adjustment in light of environmental, public relations, political, social and economic changes effects on business continuity and crisis management related decisions (Blyth, 2009). Thus risk management strives to prevent the occurrence of certain crisis. However, when such crisis takes place or any other that is unexpected, crisis management helps a firm to act in order to reduce the impact of such a crisis and restore the initial order (Burtles, 2007). An organization crisis is said to be a low probability, high impact event that threatens the well-being of the firm and is often characterized by ambiguity of cause, effects and means of resolution in addition to the belief that swift decisions ought made (Blyth, 2009). This implies that such hazards are unlikely to be managed during risk management and hence the firm ought to be prepared to handle the unexpected through crisis management (Pitt and Goyal, 2004). It has been reported recently that crises are characterized as low probability, high consequence, overlaid with risk and uncertainty, disruptive of normal business, conducted under time pressure and potentially harmful to the reputation of the firm. Theoretical understanding of crisis management Several theories and models have been put forward to try and explain crisis management. They include lifecycle models, chaos theory and disaster management as a model. a. Lifecycle models According to life cycle model when a problem is left unresolved it often increases its seriousness and greater risk. The model also argues that when an issue survives for a prolonged period of time, the available choices reduces and cost of intervention and resolution increases (Burtles, 2007). This implies that there is a progressive sequence through which a crisis results from, that is, from concern to problem to issue to crisis and finally some form of resolution (Boin and McConnell, 2007). This model is however criticized for its linearity which suggests that events occur in a sequential form resulting into some form of resolution (Smith, 2005). The model is also limited by its suggestion that issues are handled one at time whereas it is known that several issues can be handled simultaneously. b. Chaos theory On the other hand, chaos theory posits that systems rely on an underlying order irrespective of its complexity and that within such systems very minimal changes or events can result in very complex outcomes or behaviours. The lack of linearity in this theory prompted some researchers to apply chaos theory crisis management (Burtles, 2007). In spite this application; the theory has received little popularity. It has been recognized that crises are often resolved quickly in order to reduce the damage to the firm rather than waiting for a prolonged time for the issue to resolve itself as required under chaos theory (Castillo, 2005). c. Disaster management as a model Disaster management as a model is a holistic in which different clusters or elements overlap to some extent and can be dealt with simultaneously (Stationery Office (UK), 2010). Disaster management involves government agencies and other authorities and is often related to community or national disasters. The distinguishing factor of disaster management is a cross-functional, whole of government commitment to planning which is usually mandated by regulation or law. Disaster management often focus on natural disasters and is involved in decreasing the impact of the disaster instead of preventing it. It has been suggested that disaster management can provide an important framework from which corporate crisis management can be based on by highlighting the elements as linked processes instead of stand alone disciplines (Watters, 2010). This implies that disaster and its management is a continuum of activities which are interrelated instead of a series of activities which begin and stop when another disaster occurs (Hiles, 2010). An integrated and holistic model for risk and crisis management was developed based on the disaster management model which recognizes the need for institutionalization of crisis management and recommends that all major departments of a firm ought to formally address crisis prevention and management formally as part of enterprise planning (Hiles, 2010). This model provides a series of activities that sequentially progresses from risk assessment, crisis preparedness assessment and emergency and crisis response to increased crisis preparedness alongside a concurrent sequential progression from risk assessment to risk reduction. This model is also criticized for its linearity. d. The relational model This model has for main elements: crisis preparedness, crisis prevention, crisis incident management and post-crisis management. a. Crisis preparedness (planning) This entails putting plans in place, allocating responsibilities and roles and establishment of process ownership. The commitment of the management is vital for effective crisis management. Lack of crisis planning results in prolonged period of crisis prior to its resolution. Studies have indicated that lack of planning may result in a firm going out of business once a crisis takes place. Crisis preparedness requires systems and manuals which includes crisis management equipment, infrastructure, documentation, ‘war room’ and resources (Risk Operations, 2003). Systems and manuals form the basis of effective crisis management. However, excellent crisis communication plans without training have little effect on the outcome of crisis management. Thus crisis preparedness requires training simulations (Shaw and Harrald, 2004). This involves familiarization programs, table top exercises, testing and live simulations. Studies have indicated that many firms are not committed to training simulations. b. Crisis prevention This entails processes such as preventive maintenance, audits, issue scanning, environmental scanning, social forecasting, future studies and anticipatory management. This allows a firm to detect early warnings. However, some top management of most firm face the challenge of enormous information provided through computer analyses (Elliot, Swartz and Herbane, 2009). The management has inadequate management of information and lack the commitment to take effective and responsible measures on the information obtained (Hiles, 2010). This is exemplified by the Enron case where a large database system for monitoring and response which could track threats and opportunities, suggest coordinated responses, calculate effect on business operations and plans but the management was not committed to corporate responsibility that resulted one of the greatest financial scandal in the world (Blyth, 2009). Crisis prevention involves both issue and risk management. Issues and risk management entails identifying, prioritizing, developing a strategy and its implementation (Barnes and Oloruntoba, 2005). It involves analysis to get information about a potential crisis. Crisis prevention also requires emergence response that entails documentation, infrastructure and training. It has been recognized that when an emergency is not well handled it may result in a crisis. Thus a prompt and effective emergence response is required in case of emergency in order to prevent it from turning into a crisis. c. Crisis incident management This is where the crisis is recognized. It is a point of transition from emergency, objective assessment to recognition of a crisis. It has been said that it is difficult to identify either when an emergency is transitioning into a crisis or a crisis that emerges without going through a serious emergency (Barnes and Oloruntoba, 2005). The management is thus critical in prevention of a crisis once is predicted through early warnings and scanning. Failure to read signs of a crisis or turning a blind eye to internal warning signs can result in a serious crisis. Some authors have thus argued that when a crisis takes place it is accompanied by many diversionary problems. Thus the management is tasked with identification of the true crisis. Crisis incident management requires activation of systems or response. Once the crisis has been recognized response systems ought to be activated rapidly and effectively (Herbane, Elliott and Swartz, 2004). Lack of prior planning and practice has often been implicated in inadequate response. Management preoccupation with protection of reputation instead of acting has also been accused for resulting in inadequate response. Crisis incident management also requires crisis management. This involves selection of strategy and its implementation, stakeholder management, damage mitigation and media response. Three approaches have been suggested as possible alternatives for crisis response strategies (Hiles, 2010). They include corporate apologia, image restoration theory and situational crisis communicating theory. d. Post-crisis management This is the stage where the business recovers from a crisis and resumes its business operations. It involves recovery of operations, financial costs, business momentum, market retention and share price protection (Sikich, 2003). It has been argued that the potential for legal costs is one of key determinant of how organizations respond to crisis even though it cost is minor as compared to costs such as market costs which impact on market share, margins and ability to grow in addition the market value of a company suffering (Barnes and Oloruntoba, 2005). During post crisis management impacts of crisis emerge such as coronial inquests, prosecution, judicial inquiries, reputational damage, litigation and media scrutiny. It has been argued that post crisis issues may persist for more than five years. Decisions made during crisis may impact on the firm for prolonged period of time. Post crisis management also entails evaluation and modification of business processes and operations. This entails root cause analysis, process review, management assessment and implementation of change (Hiles, 2010). Thus this stage allows the firm to learn and modify its systems. This stage requires that a firm begins to prepare for another crisis in order to be well prepared for future challenges. At this stage crisis team is debriefed and the crisis plan is evaluated immediately in order to allow the firm to formulate an effective crisis management plan for future crisis. This phase presents a firm with an opportunity to change aspects which facilitated the occurrence of the crisis. Disaster Response Disaster response has traditionally been dominated by the top down model that was characterized by command and control paradigm of a highly centralized response with a few select experts issuing orders down the line to employees, responders or the public (Hiles, 2010). The initial step in disaster response plan is setting up a tight system that focuses control in a central node and limiting communication originating from outside of the node. This model is based on the assumption that response ought to be put in the hands of trained experts who will be responsible for directing and caring for the untrained masses to keep them out of harm. The public interference ought to be limited as much as possible. Another new model of disaster response has emerged called structured networks model. This model harnesses the collective intelligence of all members through predefined methods via which people will communicate (Hiles, 2010). This model allows ideas to come from anywhere within the network and are then debated upon and the best opinions or ideas emerge. Social media have enhanced this model. Emergency Management Emergency management refers to measures undertaken to reduce the adverse effects of any type of disaster. Disaster management is never ending preparedness cycle of prevention, response, recovery and mitigation. Local authorities are encouraged by federal law to develop comprehensive disaster preparedness and assistance plan, community brisk assessment, threat analysis and hazard mitigation measures to decrease losses from disasters. Local authorities are also required to develop emergency plans which cover comprehensive prevention and mitigation measures in addition to initial post disaster first response and subsequent recovery activities. These activities effectively and efficiently manage disasters to minimize loss of life and property. Emergency management requires preparedness. Preparedness is attained and maintained via a continuous cycle of planning, organization, training, equipping, exercise, evaluation and taking corrective measures (Hiles, 2010). Continuous preparedness efforts among people involved in incident response and emergency management activities ensure coordination during crisis times. It also provides an efficient and effective emergency management and incident response activities. Emergency management also requires appropriate training to improve all hazards capabilities. In most cases these training focuses on discipline specific and structure and operational coordination processes and systems. Training and exercise ensures that emergency management/response personnel are able to function together effectively during a crisis. Training and exercises need to be tailored to the specific roles played by an individual. Mentoring and shadowing are often employed during training and exercise to allow less experienced people to observe and learn from those who are well experienced. The exercises should also be designed in a way to simulate multiple command, leadership and supervisory roles. In most cases emergency management takes place at government level. However, firms can borrow from these management principles to prepare for and handle a crisis (Hiles, 2010). By using principles from emergency management firms can be able to manage crisis in a better way. Business Continuity Management A business continuity management is a holistic management activity whose goal is to enable firms protect their assets, customer trust, earning capacity and the reputation of the firm in case of the event outages, disruptions or other negative events (Paton, 1999). Business continuity management is seen as an all inclusive management practice that allows a firm to identify vulnerabilities that threatens the firm and provides a framework for building resilience and response (Hiles, 2010). A business continuity management (BCM) is an interdisciplinary practice and it includes disaster recovery, facilities managements, security enforcement, risk management, quality management, supply chain management, health and safety management, emergency management and crisis communication and public relations. Importance of effective business continuity BCM enables a firm to improve its resilience through advance identification of potential sources of business disruption and possible effects that could deter the firm from fully attaining its objectives. BCM is interested in the development of organization wide resilience which allows it to withstand the loss of part or all of its operational capability (Kaye and Graham, 2006). This resilience need to be developed throughout the firm from junior employees to the top level management (Khosrowpour, 2003). Thus BCM is a holistic process of management that helps in the identification of threats to the firm, the effects of such threats to the business operations and it provides a framework upon which organizational resilience is built to enable it effectively respond in a way that best safeguards the major interests of its key stakeholders, brand, reputation and value creating activities (Burtles, 2007). It does this through the following. First, it proactively improves the resilience of a firm against the disruption of its ability to attain its key objectives (Snedaker, 2007). Second, it provides a rehearsed method that enables the firm to restore its ability to supply main products and services to an agreed level within an agreed time after a disruption. Finally, it delivers a proven capability to manage a business disruption and protect the reputation and the brand of the firm. The maintenance of organizational continuity is the responsibility of managers and owners of the firm. A BCM provides a business with the capability of reacting to disruptions in operations and at the same time protects the welfare and safety of employees (Hiles, 2010). In cases where firms provide emergence response, voluntary or a public service such organizations have a moral and social responsibilities. In some instances firms have statutory responsibility of undertaking BCM. Business continuity planning Business continuity plan identifies the potential impact of a crisis, develops feasible continuity strategies and formulates the process to implement in order to mitigate the crisis. It allows a firm to manage a crisis effectively (Paton, 1999). A business continuity plan should be able to make out the objectives of the firm, the schedule for attaining the objectives, the individual and group contributors and their roles, contributors who can provide both internal and external support, deliverables and how the deliverables are measured and delivered. The concepts of recovery time objectives (RTO) and recovery point objectives (RPO) are used in formulating a business continuity plan. RTO is the duration between failure and functional recovery while RPO is the amount of data loss that can be tolerated by an enterprise. Business continuity planning should establish a focal point with clear responsibilities for business planning. It also ought to identify and prioritize essential processes of a business for which measures for business continuity are formulated for (Paton, 1999). Business continuity plan should also document the disaster recovery policies, measures, processes and responsibilities of the centre. The assessment criteria for the damage caused by the crisis should also be included the business continuity planning. The authority levels and circumstances for implementation/activation of the plan should be clearly documented in the plan. The plan should be tested, reviewed and updated periodically. Costing of the plan should be done as a basis for acquiring resources needed to implement the plan. The automation of the preparation and maintenance of the plan need to be considered. Relationship between business continuity and crisis management Crisis management is often seen as a continuum of activities such as planning, incident response and crisis management (Sapriel, 2003). Thus, even though crisis management and business continuity are different terminologies their supporting functions ought to be integrated thoroughly in order to support the general business management (Paton, 1999). It has been cited in some text that crisis management and business continuity management (BCM) are not seen as mutually exclusive given that they cannot stand alone based on the type of event. The two terms have been fully recognized to be two elements which are found in an overall business continuity process and in most cases one is not found without the other. The interrelatedness of the two terms has resulted in the two terms being integrated together as business crisis and continuity management (Wieczorek, Naujoks, Bartlett, 2002). As such business crisis and continuity management is defined as practices of business management that provide guidance and focus for the actions and decisions necessary for a firm to prevent, prepare for, respond to, resume, recover, restores and transition from a disruptive (crisis) event in a way that is consistent with its strategic objectives. Conclusion A crisis is any event that can cause harm to a firm’s constituent, its finances, its facilities or its reputation within a short span of time. Crisis management is the art of decision making that helps in heading off or mitigating the effects of a harmful event while the event is unfolding. Several theories and models have been put forward to try and explain crisis management. They include lifecycle models, chaos theory, disaster management as a model and the relational model. According to life cycle model when a problem is left unresolved it often increases its seriousness and greater risk. The model also argues that when an issue survives for a prolonged period of time, the available choices reduces and cost of intervention and resolution increases. On the other hand, chaos theory posits that systems rely on an underlying order irrespective of its complexity and that within such systems very minimal changes or events can result in very complex outcomes or behaviours. Disaster management as a model is a holistic in which different clusters or elements overlap to some extent and can be dealt with simultaneously. The relational model has for main elements: crisis preparedness, crisis prevention, crisis incident management and post-crisis management. Crisis management is a continuum of activities and is closely related to terms such as emergency response, emergency management and business continuity. Even though emergency management is mainly used in natural disasters and are handled by government departments, it is related to crisis management in that both of them requires prior planning and execution of the plan in case of a crisis for crisis management and a disaster for disaster management. Emergency response is more of like incident response in crisis management. The interrelationship between crisis management is so great that the two terms have been integrated and defined together. Crisis management and business continuity have been integrated to form business continuity and crisis management. The integrated term is defined as practices of business management that provide guidance and focus for the actions and decisions necessary for a firm to prevent, prepare for, respond to, resume, recover, restores and transition from a disruptive (crisis) event in a way that is consistent with its strategic objectives. Reference Barnes, P., and Oloruntoba, R. 2005. Assurance of security in maritime supply chains: Conceptual issues of vulnerability and crisis management. Journal of International Management, vol. 11, no. 4, pp. 519-540 Blyth, M. 2009. Business Continuity Management: Building an Effective Incident Management Plan. London: John Wiley & Sons. Boin, A., and McConnell, A. 2007. Preparing for Critical Infrastructure Breakdowns: The Limits of Crisis Management and the Need for Resilience. Journal of Contingencies and Crisis Management, vol. 15, no. 1, pp. 50-59 Borodzicz, E. 2005. Risk, crisis and security management. London: John Wiley and Sons. Burtles, J. 2007. Principles and Practice of Business Continuity: Tools and Techniques. London: Rothstein Associates Inc. Castillo, C. 2005. Disaster preparedness and Business Continuity Planning at Boeing: An integrated model. Journal of Facilities Management, vol. 3, no. 1, pp. 8 – 26 Elliot, D., Swartz, E., and Herbane, B. 2009. Business Continuity Management: A Crisis Management Approach, 2nd Ed. London: Taylor & Francis. Herbane, B., Elliott, D., and Swartz, E. 2004. Business Continuity Management: time for a strategic role? Long Range Planning, vol. 37, no. 5, pp. 435-457 Hiles, A. 2010. The Definitive Handbook of Business Continuity Management, 3rd Ed. London: John Wiley and Sons. Hiles, A. 2010. The Definitive Handbook of Business Continuity Management, 3rd Ed. London: John Wiley and Sons Kaye, D., and Graham, J. 2006. A Risk Management Approach to Business Continuity: Aligning Business Continuity with Corporate Governance. New York: Rothstein Associates Inc. Khosrowpour, M. 2003. Information technology and organizations: trends, issues, challenges and solutions, Volume 1. London: Idea Group Inc (IGI). McEntire, D. 2007. Disciplines, disasters, and emergency management: the convergence and divergence of concepts, issues and trends from the research literature. London: Charles C Thomas Publisher Paton, D. 1999. Disaster business continuity: promoting staff capability. Disaster Prevention and Management, vol. 8, no. 2, pp. 127 – 133 Pitt, M., and Goyal, S. 2004. Business continuity planning as a facilities management tool. Facilities, vol. 22, no. 3/4, pp. 87 – 99 Regester, M., and Larkin, J. 2008. Risk Issues and Crisis Management in Public Relations: A Casebook of Best Practice, 4th Ed. London: Kogan Page Publishers. Reuvid, J. 2010. Managing Business Risk: A Practical Guide to Protecting Your Business, 7th Ed. London: Kogan Page Publishers. Risk Operations. 2003. Business continuity and crisis management. Management Quarterly, Faculty of Finance and Management. Available at: http://www.opscentre.com.au/resources/pdfs/Research/Business%20Continuity%20and%20Crisis%20Management.pdf Sadgrove, K. 2005. The complete guide to business risk management, 2nd Ed. London: Gower Publishing, Ltd. Sapriel, C. 2003. Effective crisis management: Tools and best practice for the new millennium. Journal of Communication Management, vol. 7, no. 4, pp. 348 – 355 Shaw, G., and Harrald, J. 2004. Identification of the Core Competencies Required of Executive Level Business Crisis and Continuity Managers. Journal of Homeland Security and Emergency Management, vol. 1, no 1, Sikich, G. 2003. Integrated business continuity: maintaining resilience in uncertain times. London: PennWell Books Smith, D. 2005. Business (not) as usual: crisis management, service recovery and the vulnerability of organizations. Journal of Services Marketing, vol. 19, no. 5, pp.309 – 320 Snedaker, S. 2007. Business continuity and disaster recovery planning for it professionals. London: Syngress. Stationery Office (UK). 2010. Management of risk: guidance for practitioners, 3rd Ed. London: The Stationery Office. Watters, J. 2010. The Business Continuity Management Desk Reference. Manchester: Jamie Watters Wieczorek, M., Naujoks, U., Bartlett, R. 2002. Business continuity: IT risk management for international corporations. New York: Springer. Read More