This paper introduces my concept of the 5 I\'s for embedding a BCM culture in an organisation

1. GROOMING A BUSINESS CONTINUITY MANAGEMENT (BCM) CULTURE
–
5 I’s for your organization
Introduction
The fundamental objective of organizations all over the world is to make money, ensure
sustainability and add value. These noble intentions could easily be jeopardized by a
sudden, unexpected and unplanned for incident. Some of these incidents can be as
simple as a virus attack, as complex as a socio-political unrest and as unpredictable as a
flood or fire incident.
Disasters in recent times have exposed our lack of preparedness for managing
unforeseen eventualities when they occur. The United States of America is yet to fully
recover and restore the damages that resulted from the 9/11 attack and the Louisiana
floods although commendable efforts were made in responding to the disasters and
ensuring that people resumed their daily routines at the shortest possible time.
Companies, in making an attempt to address these concerns have unpretentiously and
mistakenly taken IT recovery for BCM. Whilst IT Recovery is very crucial in the
recovery process, the ability of a business to continue almost unscathed in most cases is
jeopardized. A more critical aspect of continuity as a business, people, is usually
glossed over or completely overlooked.
The guiding best control standard for business continuity management, the BS 25999,
requires that a vicious BCM life cycle is maintained for proper entrenchment of BCM
in any organization. The cycle below shows the processes involved, and depicts how
the organization consciously engrains BCM into the fibre of its existence.
Figure 1 - BCM Life Cycle (BS 25999)
Page 1 of 6
© Eneni Oduwole, Aug. 2008

2. However, the ease with which an organization is able to move from one stage to the
other until it finally completes the cycle that promises the embedding of a healthy BCM
culture remains challenging.
The Board and Senior Management of most organizations simply include BCM in the
‘AOB – Any Other Business’ sections of meeting agenda whilst development and
implementation of BCM strategies are dealt as ad-hoc issues which are passed down to
assistants and deputies to manage. More attention is still placed on making the money
rather than ensuring that the money made is sustainable.
Little attention is given to ensuring continuity and resumption of business in the
shortest possible time with minimal disruption. A healthy BCM culture inculcates this
discipline.
BCM Culture
Culture generally means a way of life that becomes common to a group of people. It
refers to a shared, learned, symbolic system of values, beliefs and attitudes that shapes
and influences perception and behaviour, patterns of human activity and the symbolic
structures that give such activities significance and importance.
BCM can be defined as the management of an end-to-end process from crisis to full
restoration of all services and business processes (Standard Bank definition).
To evolve a BCM culture, the management of this end-to-end process which comprises
response, resumption, recovery and restoration of all services and processes in an
organisation need to be cultivated through sharing of consistent methods and
procedures that are easily adaptable by all ranks and files of staff in the organization.
In my opinion, entrenching a healthy BCM culture in an organization requires the
implementation of what I have coined the 5 I’s of BCM.
The 5 I’s
Implementing the five I’s is a continuous and on-going process since business strategies
change, businesses grow, businesses need to restructure for continued survival during
dire seasons and people within organisations change over time. It is also engrained in
the BCM life cycle as depicted overleaf.
Page 2 of 6
© Eneni Oduwole, Aug. 2008

3. Involve All
Inspect
Facilities
Internalize
Initiate BCM
Consciousness
Scenarios
Imbibe
Response
Processes
Figure 2 - Cycle for the 5 I's
Involve All
Without a good understanding of an organization’s business strategy and objectives, its
people would fail in delivering to it expected value. It is imperative for all members of
an organization to understand what the entity stands for and what its core values are. It
is this understanding that makes its people appreciate the need for continuity and
commit themselves to the process of ensuring continuity.
Just as business strategies involve all and sundry in any business, the same approach
should be adopted for the entrenchment of a Business Continuity Management process.
It should be driven from the top and involve all relevant stakeholders
This is by far the most important step in building the right BCM attitude and culture as
other steps depend heavily on the successful conversion of all relevant stakeholders to
become BCM-centric. The involvement of all relevant stakeholders in a BCM
programme involves assessing BCM Awareness and training gaps, developing the
desired BCM culture and monitoring the cultural change.
To identify BCM awareness and training gaps appropriately, the deployment of an
effective change management process becomes imperative. The following questions
would have to be answered for an appropriate change management process to be
identified and employed.
• Are business owners aware of the need for BCM?
• Are they willing to drive the process and invest in best control practices?
• Is the process driven by a ‘what’s in it for me’ or a ‘this is the way we do it’
mentality?
• Is it being taken as a one-off task or an on-going practice?
• What is the scope of stakeholders to be involved?
• Does the organization have experienced professionals managing the process?
Answers to these few questions would aid proper assessment of the following:
Page 3 of 6
© Eneni Oduwole, Aug. 2008

4. • The level of awareness of the need to change to a more BCM conscious
organization by business owners. The scope of involvement of relevant stakeholders
such as staff, customers, suppliers, contractors and other third party stakeholders
like insurance companies, government agencies, tenants and emergency services
would have to be identified.
• It is important to ascertain the desire of stakeholders to participate and support
the change and identify if resistance to change is as a result of ignorance on the
importance of BCM or dogmatism. This assessment would inform the best modes
of communication required by the organization since the desire to change drives
willingness to imbibe new cultures and standards
• Knowledge of the benefits of BCM must be assessed, how to change all relevant
stakeholders and judgement of the expected results of the change. Effective
methods of bridging knowledge gaps by creating awareness, educating and training
all stakeholders should be identified and implemented
• The organization’s ability to implement the new BCM culture on a day-to-day basis
should be given commensurate attention. BCM champions across business units
within the organization should be appointed and empowered to ensure the day-to-
day BCM consciousness process
• Reinforcement would be required to keep the cultivated BCM consciousness in
place. Over-communicate the importance and benefits of BCM continuously so that
it becomes a lifestyle for all relevant stakeholders of the organization, even in
personal habits. Once this process is mastered by an organization the other I’s
follow naturally.
Internalize BCM processes
All the policies, procedures and service level agreements of the organization should
have business-specific BCM strategies and plans embedded. These plans should
include responsibility for BCM for business units and areas, periodicity for review,
update and testing. All policies and procedures should stipulate required backup and
recovery requirements. A highlight of the business recovery map should also be
included.
Imbibe response processes
In order to make the process of developing and implementing appropriate BCM
responses for the organization, familiar procedures such as fire drills and emergency
evacuation procedures must be properly documented and strategically circulated to all
staff. To a great extent, when people are familiar with these procedures, they are more
likely to imbibe them.
These procedures should be tested periodically, dedicated staff trained as first aid givers
and fire wardens; and all staff trained on fire-fighting techniques.
More sophisticated procedures such as desktop walkthrough of BCM plans and live
simulation processes should also be entrenched as the organization matures in its
Business Continuity Management.
All staff should be aware of Disaster Recovery (DR) sites allotted to their business units
at all times and these sites should in turn be appropriately equipped.
Page 4 of 6
© Eneni Oduwole, Aug. 2008

5. Initiate scenarios
The BCM consciousness of all units in an organization should be tested periodically.
Surprise tests/checks should be carried out on all business units in respect of BCM
consciousness. This aids the process of exercising, maintaining and reviewing the BCM
capability of the organization.
Simulation exercises should be carried out once a year to determine the organization’s
true capacity in responding, resuming, recovering and restoring its business in the event
that a disaster occurs.
Inspect facilities
The noble intentions highlighted above can be sabotaged if an organization does not
place emphasis on appropriately equipping and maintaining its DR sites. DR facilities
and equipment therein must be relevant to the organization and cost-effective. All
critical business units must maintain functional DR sites and provision made for less
critical areas in the course of recovery.
DR facilities must be equipped with battle boxes containing resources required for
business recovery such as:
• Stationery
• Master BCM Plan
• List of all staff of the organization
• Consumables like pens, staplers, tissue paper
DR sites should be functional and ready for use at all times. Periodic inspection and
audit of DR sites becomes a must!
Conclusion
The message of BCM requires reinforced and continuous communication at every level
of development, implementation or review for a BCM-centric culture to abound in any
organization.
Figure 3 overleaf shows how the 5 I’s complements the process of embedding BCM in
an organization’s culture.
Page 5 of 6
© Eneni Oduwole, Aug. 2008

6. Inspect facilities Involve all
Internalize
Initiate
BCM
scenarios
Consciousness
Imbibe
response
processes
Figure 3 - BCM Cycle & the 5 I's
Page 6 of 6
© Eneni Oduwole, Aug. 2008