Despite my young age, I had the opportunity to carry out many auditing activities. In the audits I conducted in areas such as Information Security, Business Continuity, and IT service management, I witnessed that very few businesses operate these systems seriously. Seriously, I mean: Since most businesses need the certificate of the relevant management system in some way, they start the work and lay the post after the certification audit, so to speak.
Are there any good examples? Of course there is. In sectors that are aware of the seriousness of sensitive issues such as information security and business continuity (Defence, Communication, Banking, etc.), we can say that these systems are properly managed and provide high added value to businesses. However, it would not be wrong to say that systems other than this usually proceed as “Copy + Paste” or “Find & Replace”.
This is why we are faced with irrelevant risk analyses and irrelevant business continuity plans in the businesses we go to audit. For example, in service businesses, you may see irrelevant risks that concern manufacturing businesses. When we said that it should be developed and enriched by examining risks and business continuity plans, we often encountered “what is the need”. Business continuity plans, Business Impact Analysis are undoubtedly among the most unfortunate in this context. Because these are the processes that are mostly operated with “Copy & Paste”.
“One misfortune is better than a thousand advices”
When examining business continuity plans and business impact analyses for years, we have seen that superficial and usual disaster situations such as “internet outage”, “server failure”, “hardware failure” are handled. Whenever I gave examples of “epidemic”, “quarantine” and similar disaster situations and asked why you didn’t deal with them, “Sir, what is the need!” I got your answers. I wish we had not experienced it by living, but when we look back today, all businesses, large and small, started to decide to work remotely due to the Corona epidemic. Apart from that, many industries are looking at ways to sustain their business.
The simplest part of this job is that employees continue from home. Consider also the manufacturing companies. Almost all of the enterprises that buy raw materials and semi-finished products from countries where the Corona epidemic is widespread stopped or had to reduce their production. Unless we stop seeing business continuity as only an “Information processing” issue, our business continuity plans and business impact analyses will continue to be ineffective elements.
The phenomenon we call business continuity needs to be addressed in all areas of businesses, from the business plan to production planning, cost accounting, human resources management, sales and marketing, and shipment. Considering that the processes are carried out interdependently, if you cannot ensure continuity in the supply of raw materials, perfect execution of sales and marketing activities will not work either.
In fact, international standards such as ISO 22301 Business Continuity Management System have been documented to address exactly these issues. However, while we are applying these standards, we may interpret some issues incompletely or incorrectly, and in some cases, we may misinterpret them because “it does not work for us”. While applying the risk analyses and business impact analyses requested by the standards, instead of acting superficially, it is necessary to benefit from the resources that will enrich the work. For example, when you ask about the threats that will affect business continuity, perhaps you will not think of much at first. However, when you examine national or international research, statistics, and case studies in the past, you will see that many things that you say “cannot” are actually “possible” in your current situation.
Imagine that you did a risk assessment at the Ministry of National Education a year ago. If you had evaluated the risk of epidemics and pandemics and said that the Distance Education infrastructure should be kept ready as an action, you probably would not have received a budget for this work.
“Lesson Learning”
I wish the pandemic situation had not happened. These and similar situations that develop beyond our control are important for us to learn from. There is definitely a lesson that everyone can learn from this epidemic. In the simplest of terms, we can say that it caused people to question the understanding of cleanliness and changed their cleaning habits. But I think there are lessons to be learned for people who manage systems in terms of business continuity plans and business impact analysis.
To sum up, we see once again that business continuity plans and business impact analyses need to be handled much more sensitively. More importantly, we have seen by experience that Business Continuity Management is not only about “Information processing”, but that business continuity is necessary for everyone. I hope we don’t live by taking precautions instead of learning by experiencing worse scenarios.
I wish you healthy and business continuity days.
Be First to Comment