BCM & Operational resilience: yesterday, today, and tomorrow. Where has it come from and what comes next?

Recently, The BCI, one of the leading institutes working in the field of organizational resilience and business continuity, issued its regular report BCI Operational Resilience Report 2023 in collaboration with Riskonnect, who work with risk management solutions.

One of the questions they asked the respondents was if there was a difference between organizational resilience and operational resilience. As the answers demonstrated, for most respondents (and in most companies) these terms were used as synonyms. Having studied the report, the colleagues brought up another matter – The BCI introduced the new term of «organizational resilience» in addition to «business continuity» and «operational resilience».

If we search Habr for «Business Continuity», «NFR, Business continuity & Resilience. Let’s go.

As I see it, BCM&OpRes has long ago become an umbrella covering lots of functions within the company. This isn’t a piece of news for any of the continuity experts. BCM working as some kind of an umbrella has many times been declared during public speeches and in presentations. BCM&OpRes has become a mediator and a facilitator for all kinds of functions, a united knowledge base of the company – along with the positive change driver.

I have no doubt that many of my readers have encountered some business continuity management (BCM) elements in their companies, no matter if they are employed with the IT department (I believe, the infrastructural unit ran into them earlier and more often whereas product and scrum masters have come to deal with those quite recently, and most likely only during audit inspections), with the risk management department or audit, or even the business units. Really, some of you must have encountered the continuity management procedures or their elements.

Still, I often see people surprised, confused and even censorious of it when I mention the umbrella role of business continuity and operational resilience management within a company. Rather amazing considering the fact that we’ve been watching it all for several years in a row. Now, let me use some facts to show you how the sector is developing and transforming. I’d like to demonstrate how various corporate functions overlap with the business continuity and operational resilience function.

Things are taking their course and developing. Business Continuity (which is currently referred to as Business Resilience or Operational Resilience) isn’t an exception, but where did it start and how has it become an umbrella?

In general, I can see why business owners of different functions fail to understand this issue and why they are censorious about it. Any leader, manager, or specialist believes that his/her function matters, that they are experts in their field, and that they’re working perfectly no matter what for the benefit of the company. This is where the lack of understanding comes from. People grow positive that as nobody beyond their function knows the details of their jobs (and there’s no arguing here, hardly anyone else knows all the details) then an outer independent function (like Business Continuity) can’t umbrella them as long as they have no issues in communicating with related units (btw, practical experience shows that issues are rather common here, although they hardly rush to acknowledge that within any company). Moreover, the political issues, the powers, and the ‘third weird’ should also be considered, even if it is uncommon to announce it in public 😉

Let’s look into the history of the industry and its development milestones, remember how it all started many years ago and hit different business functions in place at today’s major companies.

IT function

If you ask me, the continuity management thing took its start in the IT function. Let me as an IT person take this liberty. There was the IT Disaster Recovery. Do you remember DRP – the disaster recovery plan?

Any earnest network engineer voluntarily worked on some backup means, server reset scripts, means of switch to a reserve node, and so on. Then there were independent DC (data centers), NFR, Business continuity & Resilience.

P.S. I’m considering some other posts – more specific and applicable. Stay tuned.