Crisis Management supports leadership decisions, coordination, and communication.

Business Mecovery focuses on restoring critical business functions and processes.

IT Disaster Recovery focuses on restoring the technology, applications, data, and infrastructure those operations depend on.

Strong BCM programs connect all three.

One of the more confusing aspects of business continuity is the terminology. A number of terms are similar to those used in BCM, but with slightly different meanings. Examples include:

• Business Continuity (BC) is the strategic and tactical capability of the organization to plan for and respond to incidents and business disruptions in order to continue business operations at an acceptable predefined level.
  
  

• Business Continuity Plan (BCP) refers to the documented collection of procedures and information that is developed, compiled, and maintained in readiness for use in an incident to enable an organization to continue to deliver its critical products and services at an acceptable predefined level.
  
  

• Disaster Recovery (DR) is a term reserved for the recovery and resumption of critical technology assets in case of a disaster. Disaster recovery can include tasks such as resuming individual systems (e.g., Wide Area Network or an ERP application), or recovering all critical aspects of the IT environment.
  
  

• Resumption Planning is reserved for the recovery of critical business functions that are separate from IT. Examples of resumption planning include resuming call center functions, manufacturing processes or payroll.
  
  

• Crisis Management refers to the process designed to enable an effective response to an event. Crisis management processes focus on stabilizing the situation and preparing the business for recovery operations.
  
  

• Crisis Management Team refers to a group of individuals responsible for developing and implementing a comprehensive plan for responding to a disruptive incident. The team consists of a core group of decision makers trained in incident management and prepared to respond to any situation.
  
  

• Contingency Planning refers to tactical solutions addressing a core resource or process. As opposed to BCM, contingency planning is typically an isolated action and does not resemble a program or a series of related actions. An example of contingency planning is determining how to handle the loss of a specific vendor, or creating processes to work around the loss of a key piece of equipment on an assembly line.
  
  

• Emergency Planning refers to the development and maintenance of agreed procedures to prevent, reduce, control, mitigate and take other actions in the event of a civil emergency.
  
  

• Emergency Response includes the immediate actions taken to preserve lives and safeguard property and assets. Emergency response is often a subset of a broader crisis management program. An example of an emergency response action is an evacuation plan.
  
  

• Recovery Strategies refers to the approach used by an organization that will ensure its recovery and continuity in the face of a disaster or other major outage. Plans and methodologies are determined by the organization’s strategy. There may be more than one methodology or solution for an organizational strategy.
  
  

• Exercise refers to the process of rehearsing the roles of team members and staff, and testing the recovery or continuity of an organization’s systems (e.g., technology, telephony, administration) to demonstrate business continuity competence and capability.
  
  

• Test is the activity that is performed to evaluate the effectiveness or capabilities of a plan relative to specified objectives or measurement criteria. Types of tests include: structured walkthrough, standalone test, integrated test, and operational test.
  
  

• Supply Chain Management refers to management of the linked processes that begin with the acquisition of raw material and extend through the delivery of products or services to the end user across the modes of transport. The supply chain may include suppliers, vendors, manufacturing facilities, logistics providers, internal distribution centers, distributors, wholesalers, and other entities that lead to the end user.

A company’s business continuity approach and project scope may vary widely, and are driven exclusively by business requirements (and constraints). However, a number of common project characteristics remain (although the process to meet these project objectives vary):

• Business Continuity Governance – including definition of policies, standards and tools to support business continuity efforts. In addition, an effective BCM program should include assigning accountability and responsibility for each key area (e.g., crisis management, business resumption and IT disaster recovery).
  
  
  
• BIA – establishing recovery objectives (business and technology), as well as the associated justification for each.
  
  
• Risk Assessment – identifying and prioritizing threats and failure scenarios to which the organization may be vulnerable.
  
  
• Strategy – identifying and implementing continuity strategies that best meet the organization’s needs, based on a cost-benefit analysis.
  
  
• Plan Development – documenting response, recovery and restoration procedures to enable effective business continuity operations.
  
  
• Exercises/Testing – validating and continuously improving business continuity strategies and plans.
  
  
• Training and Awareness – increasing knowledge regarding business continuity operations, both in terms of response/recovery team members, as well as employees in general.
  
  
• Audit/Assurance – establishing compliance with internal and third-party business continuity standards.

A well-run BCM program helps an organization understand disruption risk, set recovery priorities, prepare teams, protect critical products and services, support regulatory or customer requirements where applicable, and improve confidence in its ability to continue and recover operations.

The FFIEC Business Continuity Management booklet, issued in 2019, emphasizes an enterprise-wide approach covering technology, business operations, testing, communication, maintenance, and resilience.

It is especially relevant to regulated financial institutions and can also provide useful reference points for other organizations.

BCM ownership depends on the organization, but effective programs usually have an executive sponsor, a clearly accountable program owner, and defined responsibilities across business, technology, crisis management, risk, and other relevant functions.

The best home for the program is the one with enough authority, visibility, and resources to coordinate work across the enterprise.

Business continuity is one way an organization manages disruption-related operational risk.

ERM provides the broader enterprise view of risks and objectives, while BCM focuses on preparing for, continuing through, and recovering from disruptive events that could affect critical products, services, and operations.

Use risk, BIA findings, recovery gaps, customer or regulatory obligations where applicable, operational dependencies, and the cost or impact of disruption to show leadership what the organization is exposed to and what improvement would accomplish.