BCM Basics: Business Continuity vs. Business Resilience
This post is part of BCM Basics, a series of occasional, entry-level blogs on some of the key concepts in business continuity management.
The terms business continuity and business resilience are superficially similar and a world apart. A comparison between them provides a window into fifty years of change in business, globalization, technology, the threat landscape, and customer expectations.
Related on MHA Consulting: Navigating Resilience: How to Create a BCM Roadmap
A Distinction With a Difference
Most people are familiar with the phrase, “That’s a distinction without a difference,” used to assert that a supposed difference between two things is so trivial as not to be worth mentioning.
The terms business continuity and business resilience are a distinction with a difference. They seem similar but in fact stand for radically different concepts (at least, they’re radically different in scope).
The story behind the emergence of the terms business continuity and business resilience is the story of the history of our field over the past 50 years.
It’s also a common source of confusion for both new and experienced business continuity (BC) practitioners.
The best way to get at what they mean is by telling the story of where they came from.
The Emergence of Business Continuity
The concept of business continuity emerged in the 1970s and 1980s as organizations began to recognize the need to prepare for and recover from disruptions. It focused on identifying the most critical business processes and developing plans to keep those processes going or quickly restore them in the event of an outage.
The end of the 20th century saw the increasing importance of IT, the rise of globalization, and preparations for the potential disruptions of the Y2K bug.
Then came the game-changer that was the September 11, 2001, terrorist attacks. Those attacks, coupled with the 2008 financial meltdown, exposed the limits of an approach that was limited to protecting a handful of essential business processes.
The Arrival of Business Resilience
In recent years, the rise of extreme weather, global instability, the pandemic, social media, cloud computing, cybercrime, and customer expectations about always-on services have all contributed to the sense that a more strategic, holistic approach was called for.
This was the context in which the concept of business resilience was born.
Business resilience is an overarching concept with many components, one of which is traditional business continuity (with its BIAs and recovery plans). Other components include risk management, crisis management, operational resilience, supply chain resilience, and financial resilience, among others.
Business Continuity vs. Business Resilience
To sum up, business continuity as a concept is about 50 years old and its focus is on identifying critical business processes and devising plans to quickly restore them in the event of a disruption.
Business resilience is a more recent and much broader concept intended to address companies’ needs in the environment of today, an environment characterized by greater organizational complexity, pervasive technology, global supply chains, extreme weather, global turmoil, relentless cyberthreats, heightened reputational risk due to social media, and customer expectations for always-on services, among other challenges.
Business Resilience and You
Now that we’ve had a look at the meaning and history of our two terms, let’s consider how the emergence of business resilience, in particular, is likely to affect the average organization and the typical BC professional.
The likely answer is not that much.
A lot of people are talking about business resilience and operational resilience, to the point they are becoming the shiny new BC trend of the moment.
But let me share two facts, based on my experience as someone who has been doing this for 25 years and whose clients include organizations of all sizes across a wide variety of industries, situated all over the country (and beyond).
- A sound business continuity program is a required building block for achieving business resilience. Since relatively few companies have a sound BC program, most are far away from being in a position where it makes sense for them to think about business resilience. You must walk before you can run.
- For many organizations, achieving business resilience would not be worth the time, money, and resources. Pursuing resilience makes sense for a small percentage of organizations: companies providing critical infrastructure, such as utilities and companies involved in finance, consumables, logistics, transport, and healthcare for example.
So, while business resilience (like operational resilience) is here and real and worth knowing about. It’s also the case that, for most BC professionals and the vast majority of organizations, it’s not going to be part of your life.
Most BC pros and the companies they work for should be focused on getting better at good old-fashioned business continuity: identifying their critical business processes, identifying their main threats and risks, mitigating critical gaps, developing plans to allow them to recover quickly in the event of outages, training their employees in how to execute those plans, and regularly validating and updating them. It’s not glamorous or new, but it works, even in today’s challenging environment.
Solid, Cost-Effective Benefits
Business continuity and business resilience are similar terms with strikingly different meanings, mainly reflecting their scope. The emergence of business continuity in the 1970s focused on safeguarding critical processes and recovering from disruptions. In the 21st century, events such as 9/11 and the 2008 financial crisis drove the development of business resilience, a more strategic and holistic concept of which traditional business continuity is one small component.
Despite the buzz around resilience, and its undeniable importance for a handful of critical industries, most organizations and BC professionals should focus on achieving the solid, cost-effective benefits of a traditional BC program. This is a realistic goal that can deliver meaningful protection, even in tumultuous times.
Further Reading
- The Times They Are a-Changin’: Adapting to Change as a BCM Professional
- Navigating Resilience: How to Create a BCM Roadmap
- BCM Basics: Introduction to Business Continuity as a Service (BCaaS)
- Single Points of Failure: Protecting Yourself from Hanging by a Thread
- All About BIAs: A Guide to MHA Consulting’s Best BIA Resources
Michael Herrera
Michael Herrera is the Chief Executive Officer (CEO) of MHA. In his role, Michael provides global leadership to the entire set of industry practices and horizontal capabilities within MHA. Under his leadership, MHA has become a leading provider of Business Continuity and Disaster Recovery services to organizations on a global level. He is also the founder of BCMMETRICS, a leading cloud based tool designed to assess business continuity compliance and residual risk. Michael is a well-known and sought after speaker on Business Continuity issues at local and national contingency planner chapter meetings and conferences. Prior to founding MHA, he was a Regional VP for Bank of America, where he was responsible for Business Continuity across the southwest region.
