Learn on this real life example how business continuity implementation based on ISO 22301 not only protect s the organization, but also their customers.
All of a sudden hundreds or thousands of people might be in need…
Business continuity protects an organization from the impacts of business disruptions. The goal is to provide a certain level of products and services to customers during disruptions. But what industries need to take care of their customers themselves?
As usual, a normal project start…
As a case study, let’s have a look at an actual implementation of a business continuity approach in a large international travel group. At the beginning, the project looked like any of BCM implementation I did with a number of organizations. You identify key project team members, obtain management commitment and initialize the project. Just as ISO 22301 proposes it to do, we started with creating a business continuity policy.
These plans had nothing to do with disruption to an organization’s business…
Existing documentation in different international locations revealed that some of these local organizations had business continuity plans, preparing them for business disruptions. Scenarios included loss of IT resources, fire or flood on the premises and similar “classic” causes.
Some of the units within the group had plans which had nothing to do with disruption to an organization’s business, but focused on what the organization is supposed to do if travelers (customers of this international travel group) were affected in their travel plans while being on vacation: the traveler flies from his/her place of living to a destination and is supposed to return after the holidays. If travels to/from the holiday destination is affected by whatever reasons (airline problems, air traffic control problems, labor actions, bad weather, political unrest…) both the travel agency and the holidaymaker have a problem.
Suddenly, problems thousands of kilometers away
These problems may materialize before/during heading for the holiday destination or in the way back. Likewise, a lot of problems may arise during the stay at the holiday destination (bad weather, labor actions, terrorism, outbreak of diseases, natural disasters…).
Typical questions in this situation: what to do with travelers booked for a certain destination next week and there is an airline strike? How to handle a natural disaster at a holiday resort? Due to political unrest at a holiday destination all flights to and from this country are canceled, what now?
Problems may materialize before/during heading for the holiday destination or in the way back…
Considering that all of a sudden hundreds or thousands of people might be in need, the challenges to the organization might be daunting if not prepared…
Running two intertwined projects
This fact necessitated to restructure the project in a certain way in order to provide a coherent, group-wide approach to emergencies happening to the customers of this international travel group.
Likewise, a lot of problems may arise during the stay at the holiday destination…
A key tool in this process consisted of the development of a classification scheme for incidents: smaller incidents to be handled locally, multi-country emergencies would involve the invocation of a corporate crisis management team. This is still an aspect of business continuity, as the organization will certainly be impacted if many of their customers are in trouble. There are contractual, moral and financial implications. Think of the negative headlines if this travel group would not be prepared for this type of emergencies. As per the letters and spirit of ISO 22301, customers are very important external parties.
While the project followed the well-established business continuity lifecycle (business impact analysis, business continuity strategy, business continuity plans) as suggested in ISO 22301, it was split into sub-projects dealing with internal and external emergencies, respectively.
Dual incident response structures
The project team effectively structured most of the supporting documents in the project in a way that those two overriding scenarios were addressed throughout the documentation. For example, the business continuity response structures (e.g. team members and response documents) were split into different entities: the teams handling internal scenarios consisted of business unit managers, IT specialists, logistics specialists, and others. The teams handling external scenarios involved transportation and accommodation specialists, but also special groups dealing with psychological aspects such as caring for next of kin and dealing with trauma.
The external scenario called for enhanced support in the field of human factors…
Especially the external scenario called for enhanced support in the field of human factors, as this scenario predominantly deals with effects on people: insecurity, uneasiness, lack of information, food, shelter, diseases, uncertainty about the fate of next of kin, injuries, loss of life. In the end, the organization had structures in place not only to deal with internal business disruptions, but also to properly and efficiently handle personal matters of their travelling customers.
Customer care as an opportunity
In each and every of your projects ask yourself: do we need these people aspects be treated in our continuity project. Can we afford to leave out these aspects? Are we hurting anyone if we ignore them? Aren’t there any business opportunities in caring for these people?
Omitting these aspects might be missing an important mandatory requirement or just be missing an opportunity to set you apart from the competition.