Making the Journey from Business Continuity to Business Resiliency

It all happened so fast. One day, we started hearing about a new virus on the news and within a few short weeks, much of the world was in complete lockdown. That meant employees couldn’t return to the office, as something as simple as having a two-minute watercooler conversation could result in dire health consequences. It was a panic-filled time full of remote work transitions, branch closures and concern for staff and member safety…plus a whole lot of cleaning wipes and buckets of hand sanitizer.

In the midst of the chaos, how many of us found that our business continuity plans were not effective or lacked preparations for a disaster of this magnitude? Were we able to handle the many, many hurdles we faced in such a short time? Suffice it to say that the pandemic taught us many lessons over the past year. And one such lesson is that focusing on straight up business continuity isn’t enough. Simply being prepared is not the end all, be all. In fact, business continuity is just a step in the process on the journey to reaching business resiliency.

What is business resiliency, first of all?

There are a variety of definitions for the term business (or organizational) resiliency. Two such definitions are provided by computer software giant, IBM, and the International Organization for Standardization (ISO), so let’s compare:

“The ability of an organization’s business operations to rapidly adapt and respond to internal or external dynamic changes – opportunities, demands, disruptions or threats – and continue operations with limited impact to the business.” -IBM

“The ability of an organization to absorb and adapt in a changing environment to enable it to deliver its objectives and to survive and prosper.” -ISO 22316:2017

Both acknowledge the need to continue with business as usual, regardless of an emergency or disruption. Sounds kind of similar to business continuity, right? But here’s the difference. Business resiliency comes down to one thing: adaptability. It’s about having the critical areas of disaster recovery/business continuity – technology, employees, processes, security, etc. – already in place so you can actively change course in your plans as the situation ebbs and flows. And it’s that simple variation of adaptability that makes it vastly different from the typical notion of business continuity.

Think about it – business continuity is all about playing defense. The ultimate goal is to have plans in place to continue your operations as close to normal as possible. It’s being reactive to the emergency that’s already happening. Business resiliency, on the other hand, is about the offense and being proactive – taking actions to ensure your credit union has the proper resources in place to handle a disruption to business even before it arises.

How to Start Your Journey

It’s likely that your credit union already has business continuity top of mind after the many challenges the pandemic has brought to light. But how do you get from continuity to resiliency? The journey begins with some questions your institution needs to mull over. Consider these and how your responses will help to shape your voyage to business resiliency:

• What is the mission and vision of your organization?
• Who are your members and what do they need from you? How have their consumer habits changed and what does that mean for your credit union?
• How much you can bend before you break – have you performed a business impact analysis (BIA)?
• What have you prepared for from an internal perspective (data breaches, pandemics, natural disasters, etc.)? Are your vendors and partners also prepared and, if not, what is the impact to your institution?
• Have you trained and tested your preparations? Do you have cross-training efforts and succession planning in place?
• What do future operations look like? Have you compared remote vs. facility-based work? Is it feasible to have multiple operation sites for disaster recovery purposes?

With those questions answered, you can determine what you need to make the transition in terms of staff time and expertise, technology and other physical materials, software and databases, analytics, procedure updates and so on.

The 4 Steps to Make the Transition

Just like Rome, business resiliency cannot be built in a day. It takes time and effort to create an infrastructure that will enable your institution to be not just prepared, but flexible in ever-evolving emergency conditions. These are the four steps you need to engage to make the transition, and although they seem simple, they will help you truly see the difference between business continuity and resiliency:

Focus on your people. People are your foundation for business resilience. Trust and empower employees to do their jobs; communicate clearly and give them the tools they need to carry out business functions. In turn, they’ll find solutions that will help you thrive today and tomorrow.

Support your partners. Your credit union might be equipped for change, but are your partners? Monitor vendor and critical partners’ access to data, cybersecurity and financial health to minimize risks to your institution/members and increase effectiveness of resilience.

Safeguard your technology. Technology is a double-edged sword – it can protect your organization or expose you to risk. Err on the side of caution by finding and implementing solutions that can safeguard your credit union through turbulent times. An example might be implementing a monitoring and alert system to let you know of real-time supply chain issues.

Plan for sustainability. Sustainability is key in resilience, and organizations need to make ongoing and perhaps even significant investments to ensure that sustainability. A flexible workforce, succession planning and disaster recovery efforts can all help to reinforce business resiliency.

Make the Journey and See the Difference!

There’s a reason we call it a “journey” to business resiliency – there’s no single path or right way to get there. Every credit union’s will be different. Stick to the considerations and steps shown above on your journey, there’s no doubt you’ll see the difference between the defense tactics of continuity and the quick, hands-on and adaptable nature of resilience. Good luck and bon voyage!

Mark Clarke works as the business continuity administrator for Vizo Financial Corporate Credit Union. In this role, Mr. Clarke supports the performance of business continuity planning, business impact analysis and business continuity training for the Corporate and the credit union industry. Mr. Clarke also delivers tailored consulting services for credit unions, assisting them with their specific business continuity needs.