Are you ISO 22301 compliant? 8 Steps to Building a Robust Business Continuity Plan

Vendors, legislators and customers expect your organization to have a business continuity plan. Are you prepared?

Contingency planning is a critical aspect of doing business, particularly in mitigating the effects of disasters and emergencies. In response to the international need to protect businesses from disruption, the International Standards Organization (ISO) developed a management systems standard for business continuity management (BCM). ISO 22301 is a management systems standard that can be used by any organization to mitigate the effects of disasters and emergencies. 

Vendors, legislators, regulators and customers increasingly expect compliance and adherence to a BCM framework. Following these eight steps, as recommended by the Government of Canada can help to assure your organization is prepared for disruption:

  1. Appointing a Disaster Preparedness Team

An emergency and disaster preparedness team should comprise a stand-alone committee. The committee will be responsible for planning and implementation of the business continuity plan (BCP), related policies and procedures, and the communication of the BCP to management and staff. The committee should have sponsorship and support by a senior member of the management team. 

  1. Identification of essential services or functions

In the event of a disaster or emergency, what are the essential services provided by your organization? It may be helpful to think about the essential services as those, when not delivered, could have a negative impact on health and safety of individuals, or on the viability of the business itself. Prioritize and rank these essential services in preparation for the next step in the BCM framework.

  1. Determine required skill sets and staff

Based on the prioritization and ranking exercise done in step 2, consider what skill sets are required to deliver essential services. Can single staff members take on, or be cross-trained to fill more than one role?

  1. Complete a comprehensive risk assessment

As the literature indicates, businesses and organizations were not prepared for a global pandemic. The economic impact will be felt for some time to come, and studies have shown the most resilient organizations have had pre-existing and robust BCP measures. This step includes conducting a risk assessment of identified threats, action plans for each threat and identification of designated individuals for each essential service or function.

  1. Prepare a series of strategies and action plans for each essential service or function

An action plan for each essential service or function (as identified in step 2) should include key contacts, customers, suppliers/subcontractors, business partners and other support providers. 

  1. Review Action Plans 

Once step 5 action plans and strategies have been determined, a checklist should be reviewed to ensure all issues have been addressed, as well as to identify any areas needing additional documentation. Areas to be covered should include impacts on the organization, employees and stakeholders/customers, policies to be implemented, resources to be allocated, communications and coordination with external authorities. 

  1. Senior Management Review

The senior management sponsor should be given an opportunity to respond and comment on the draft BCP before it is adopted by the executive. Ensure the BCP is consistent with organizational objectives and addresses the critical elements identified. 

  1. Revise, test, update, repeat

The BCP is a living document, and may require revision and updating as organizational priorities change. It is critical to ensure the BCP is ‘tested’ on a semi-annual basis to identify areas of improvement. 

As an accredited Business Continuity Professional, I am well-versed in the establishment of comprehensive BCPs for a variety of organizations. To learn more, feel free to reach out to me here.

Room for the River: Applying Dutch Flood Mitigation Strategies in Canada

Image source: High River RCMP (retrieved from http://www.calgaryherald.com/)

During the catastrophic flooding which impacted southern Alberta in June 2013, the Town of High River, located 76 km south of Calgary, was particularly hard hit. The flooding required the evacuation of the town of 13,000, and the displacement of over 100,000 across southern Alberta. 

Following the flooding, as a part of future flood mitigation efforts, Mayor Craig Snodgrass announced that the Wallaceville district of High River, would be “returned to its natural state as a measure aimed at providing increased flood protection to the town.” The Province of Alberta developed a floodway buyout program for affected residents, and removed all structures and infrastructure in subsequent months. 

This highlights an emerging trend in DRR scholarship, regarding ‘building back better’ following a disaster. Paradoxically, in many cases, ‘building back better’ means not building back at all. Additional mitigation efforts, including the Springbank Reservoir west of Calgary, continue to be the source of much debate among area residents.

As the cost of extreme weather events continues to rise, emergency management professionals are working with municipal planners on how to minimize vulnerability via a risk-based approach. Unfortunately, knowing the risks has not prevented municipalities continuing to allow development in high-risk areas such as floodplains, wildland-urban interphase or areas prone to erosion and settling. 

In a 2019 doctoral thesis written by Lynne Njeri Mbajiorgu for the Department of Earth and Atmospheric Sciences at the University of Alberta, she studied how four small to medium sized municipalities implemented resilience programs for flood, wildfire and drought risks. In particular, Mbajiorgu notes inconsistency in the application of risk-based, and risk avoidance measures with respect to flood plain management. Any such efforts should err on the side of reducing future risk exposure and vulnerability.

To remedy these inconsistencies, Mbajiorgu recommends a proactive prioritization of land-use planning as a mitigation measure. She argues that land-use planners have a particular responsibility to work closely with municipal officials “to influence, guide and advice decision-makers about risk mitigation measures throughout the land-use development process, starting from bare undeveloped land to the issuance of development permits.” (Mbajiorgu, 2019). 

In a bid to reduce risk and mitigate the impact of severe flood damage, in 2007 the Netherlands embarked on the ‘Room for the River Programme’ (RFRP) to manage and restore the rivers’ natural flood plain. The 30 projects completed to date have resulted in measures to give the river the space to flood safely, while improving the quality of the immediate surroundings. 

In a study done by Eva A. Bogdan at the University of Alberta, she compared and contrasted flood mitigation approaches adopted by the Netherlands and the Alberta government. Similar to the conclusions reached by Mbajiorgu, the report concluded that while many Albertans support the RFRP approach, there is a misalignment in governance frameworks that would enable greater collaboration. As Bogdan states: “Extensive technical advances have been made in flood management, but to effectively address this wicked problem, better understanding and innovations are also needed in the social dimensions, including coordination of policies and practices as well as collaboration between stakeholders.” Bogdan identifies an existing knowledge gap in the current literature, requiring further and systematic comparative analysis. 

What are your thoughts? How have your governments addressed the need for greater flood mitigation to protect homes and properties? I look forward to hearing your thoughts about how the Dutch approach can be applied to other jurisdictions.

Understanding and Applying the Sendai Framework to DRR

Our current understanding of disaster and emergency management requires a paradigm shift. For too long, the cycle of disaster -> response -> recovery -> repeat has been the norm. This paradigm shift involves reducing risks themselves, not simply preventing disasters.

In 2000, in recognition of the growing number of people impacted by natural disasters across the globe, the United Nations International Strategy for Disaster Risk Reduction (UNDRR) was formed to support and coordinate organizations in their work building resilient communities. The Sendai Framework for DRR 2015-2030 was endorsed by the UN General Assembly in 2015 and recognizes the central role that the State has in reducing disaster risk, in consultation with local governments, stakeholders and the private sector. 

Image source: http://www.undrr.org

In response to the unprecedented 2017 flood and fire season in British Columbia, an independent review was commissioned on how emergency management agencies may begin to address the “new normal” of increased natural disasters, both in number and severity. A wide cross-section of perspectives were sought, from Indigenous and non-Indigenous communities, organizations and other stakeholders. 

The recommendations contained in the report fall under four broad themes, consistent with the Sendai Framework on DRR:

Partnerships and participation

The response framework in place during the 2017 disaster season resulted in resources, particularly the B.C. Wildfire Service being stretched beyond its limits. In the midst of an emergent situation, citizens (with an intimate knowledge of their lands) will often take it upon themselves to mitigate the spread of wildfires and damage. Enhanced partnerships with these ‘spontaneous volunteers’ is the subject of much discussion in current emergency management literature, and will be covered further in a future post.

Knowledge and tools

Indigenous and local knowledge is not effectively incorporated in current ICS and incident management planning. Further, the frequent reassigning of personnel during the 2017 wildfire resulted in valuable time being wasted as teams were frequently relocated to other provincial regions. Enhanced technology tools, including LiDAR would assist B.C. in developing more comprehensive preparedness and prevention strategies. A keen and comprehensive understanding of DRR would assist in maximizing Indigenous and local knowledge, incident action planning and the incorporation of enhanced technology. 

Communication and awareness

One of the 14 core features of the ICS system is the need for integrated and interoperable communications, processes and structures. Yet, as anyone involved in an EOC will tell you, communications often fail. In the 2017 B.C. wildfires, those people (rightly) seeking information about the condition of their homes and properties faced innumerable challenges and misinformation spread on social media. In my experience (anecdotally), similar challenges were faced by individuals in the 2013 Southern Alberta floods and the 2016 Fort McMurray (RMWB) Wildfire events. Significant investment in information-sharing between response authorities and the public is required in order to bridge the gap and prevent further trauma to impacted individuals. 

Investment

Interestingly, respondents of the report emphasized the disproportionate lack of resources devoted to the first two pillars of emergency management (prepare, mitigate) as opposed to resources allocated to response. Increased investment in preparedness and mitigation, done effectively, would inevitably decrease the significant draw on resources required by government to respond and recover from disaster events. 

To conclude, increased investment by governments in preparedness and mitigation should be made in partnership with communities and utilizing the knowledge of Indigenous and local stakeholders, consistent with the Sendai Framework. 

Our ‘new normal’ requires us as emergency management professionals to think and act differently about risk. How is your organization or government embedding an understanding of risk into new investments or developments?

I look forward to hearing your thoughts.