Yes, but does it make coffee?

This update outlines some of the key features of our soon to be released “Agile Business Continuity Planning” software. A Platform as a Service (to be offered through AgileBCP Pty Ltd and available at http://www.agilebcp.com)

If you have had a chance to follow our story, you might recall this venture started a few months ago from a shared recognition between four of us (two “risk managers” and two “software engineers”) that helping people come through the current business impacts of the Corona Virus could be a worthy venture.

We recognised we had the experience and capabilities to develop an agile tool to help people to both reimagine their business and make it more resilient against future shocks.

Further, the offering would be easy and straightforward to use – and for small “Mom and Pop” businesses it will be made available at little or no cost.

Focusing on Business Continuity

Business Continuity used to be a dry topic struggling for traction.
The focus was on occasional disruptions to a few businesses for a short period.
Our collective Corona virus experience has changed that … with the very survival of many organizations tested for an extended period of time.
As we come out the other side of any extreme event there are opportunities to reimagine our businesses – from aims and objectives to the products and services we use to achieve those aims and objectives.
At the detailed level of implementation, this means mapping the minimum necessary resources needed to support required activities .
In future, we will think more about the meaning of our exposures.
Where are we – geographically and socially – in relation to risk exposure to various hazards?
How might the hazards impact us – especially in relation to the effect on achieving our objectives?
We now better appreciate these impacts could vary between seconds and months.
The aim – or purpose – of Business Continuity Planning is to build our capabilities to mitigate impact. The aim is to pull the impact curve “back” so that we are affected for less time than otherwise; and to pull the curve up so that we reduce the level of impact.
Time sensitivity of our products and services will vary – context is crucial to considerations around “how soon is your soon?” – “how long is your while?”
Rigid plans categorise – adaptive approaches appreciate context.
Again, a key Corona reminder has been the need to appreciate context and be agile.
This depiction has been the traditional framework we have focused on.
Responses to sudden impact disruption – with priority to “emergency response”.
Contexts such as climate change and pandemics have made us recalibrate our thinking to embrace more intricate considerations. Considerations of greater complexity and uncertainty.
Our approach focuses on before and after “action planning” opportunities.
Opportunities to act identified by asking the right questions, collecting the right information and applying agreed criteria to decisions both before impact to prevent and after impact to mitigate. Before impact, these criteria focus on what is critical, and how susceptible the critical things are in the circumstances and under the conditions we are considering. After impact, these criteria focus on what is critical, and how badly those critical things have been impacted. Two workflows – each with three key steps enhanced by feedback and refinement, and displayed in logical workflows.
We depict these logical workflows using a technique derived from “Business Process Modelling Notation” and seek to communicate these in an accessible way by using “cartoon characters”.
Establishing context before impact relies on mapping the resource profiles for each critical activity. Resources are defined in various standards. To support a comprehensive and balanced approach we use a heuristic device called “The Five Ps”. People … Premises … Processes … Providers … and last, but not least, Profile. Developed initially in England’s local government sector early this century, it has become a tried and trusted approach globally, for both stimulating conversations and for collecting data.
The area within the AgileBCP “Platform as a Software” used to collect information – including resource profiles – is the Mitigation Framework.
Under each of these five Ps (Resource Types) are three key “consideration” prompts. These are depicted on a matrix in the “paper plan” (in the AgileBCP Workbook) located under the “help tab” of the software.
… and they are addressed in “drop downs” within the Mitigation Framework of the software. The text boxes allow for information to advise top management of any aspects requiring consideration.
The information is used to attribute an appropriate “score” according to agreed criteria around (a) criticality and (b) susceptibility. The Before Impact Vulnerability of the entity is a function of these two attributes – Criticality and Susceptibility.
“Traffic lights” are used to draw attention to what the current level of vulnerability might mean.
The level of commitment to address the identified vulnerability should be based on considering, challenging and validating the traffic light scores – and the attributions around Criticality and Susceptibility. Once validated, the higher the percentage (Red … Orange … Yellow …down to Green) the greater the weight that should be afforded considerations around resourcing and committing to contingency and mitigation plans.
What is recorded in Contingency and Resilience Initiatives “boxes” in the Mitigation Framework will come out of further conversations – prompted by scenarios and consideration of the “Tips Tables” in the AgileBCP Workbook.
Reporting covers the four key areas within the two workflows
First – Before Impact Vulnerability Assessment
Second – Contingency and Mitigation Action Plans
Third – After Impact Vulnerability Assessment
Fourth – Response and Recovery Action Plans
All reports have exploratory capabilities such as filtering and ranking columns.
From the Reports, specific lines can be selected to bring up a pdf of all fields for the prioritized activity. This can be moved or manipulated by editing – which takes you to the record in the Mitigation Framework.
It is a great page to drive the conversation.
As you can see here, heads may not roll, but … at minimum there will be issues addressed. Starting with, “Let’s Talk”. The fields in the Framework allow for a comprehensive approach including feedback and refinement.
Developed and adapted from a diagram published on LinkedIn by Dr Carl Gibson (hat tip), this depiction reflects our Mitigation Framework capturing the right questions – including challenging current aims and objectives – through to implementing a range of action plans to address vulnerability.
When an event does impact the organization you have two advantages.
First you are resilient due to your Before impact workflow which addressed contingencies and mitigated vulnerabilities.
Second – your baseline data is – or ought to be – up to date. Therefore all you need to do is assess after impact vulnerability by attributing an impact score to the resources underpinning prioritized activities.
In the example we are following through with from Workflow 1 we see that the vulnerability previously ignored has now spilled over into a significant consequence.
Which is addressed by informing the Crisis Management Team which will review and endorse action plans to be implemented.
The reports should not be passive documents. They are interrogatable documents which groups should use to discuss improvement opportunities.
Top Management and their supporting teams should also spend time exploring the powerful capabilities of the Refinement and Feedback page
The two workflows actually work hand in glove to form a comprehensive and integrated framework. A framework which characterised by informed decisions to prevent, prepare, respond and recover.

Time is our currency

“If I Had More Time, I Would Have Written a Shorter Letter” is oft cited – and the range of citations is interesting in itself. Today, I share a somewhat rambling reflection of being one week out from Beta testing a “Minimum Viable Product” I believe to be already good, and which will become, a terrific tool to support businesses rebooting out of the current crisis.

The “Weekend Fin” this morning showed that mainstream considerations are now clearly focused on how and when to “get back”.

A dilemma faced by all of us is that this is not a “standard” business disruption. It is a “crisis” – and as noted in the International Crisis Management Standard, “crises through a combination of their novelty, inherent uncertainty and potential scale and duration of impact, are rarely resolvable through the application of predefined procedures and plans. They demand a flexible, creative, strategic and sustained response…..”

Risk-based approaches which emphasise the importance of “establishing context” are useful. Unfortunately, “context” has become a buzzword – and buzzwords become irksome and lose traction. This is unfortunate because “meaning making” or “sense-making” – again, use whichever jargon or buzzword you like – is fundamental. Indeed, critical. It is critical to both “get right” and keep refining.
Revisiting and reviewing your corporate “purpose” – and redefining or validating the objectives you need to pursue should help to set you back “on course”. It may not be your old course but it will be a course away from both unseen rocks and ominous icebergs.

Once your objectives are clarified, it then becomes a question of “how best” to achieve them. Will you continue to rely as much as you used to on off-shore providers? What is your preferred “resource configuration”? How can you manage the capabilities of your business in ways that are agile?

These are among the questions and the opportunities we seek to support with the upcoming realease of our “Agile Business Continuity Planning” Software as a Service (SaaS).

The adapted (Plan-Do-Check-Act) diagram above reflects the iterative and cyclic relationships between dynamic decision making and the execution of action plans – key processes and outcomes supported by the tool.

1. Before Impact steps focus on reducing the susceptibility of resources.
2. After impact steps focus on addressing consequenes of impact.
Screenshot of part of AgileBCP (Demo) Reports Page

Whether our approach adds sufficient value whereby reports support good decision making – (because we do think informed decisions are generally better decisions) – will be explored next week by some terrific Beta Testers. Testers committed to giving us “negative feedback where and as required”.
I look forward to it! Stay tuned.

Beta Testing next week!

I love how people start their posts with “I’m excited to …”

People who know me know that I am fairly “unexcitable” – but trust me, I am excited.

Let me share where we are up to. This week, our Partnership Board meeting approved moving our upcoming Software as a Service (SaaS) to Beta testing next week.

We have targetted trusted colleagues to support us in this. There are three key differentiators in our approach – some are around simplicity and others are around improved practice.

The first “hook” (don’t you just love marketing jargon) is a respectful understanding that most people in a crisis bring together a team of bright and enthusiastic individuals who too often “flap about”. We will be empowering them with “structure” – a great process and straightforward tool.

Move from uncertainty to informed decisions

Stay tuned.

#crisis

#management

#informed

#decisions

Move over “resilience”

Move over “resilience” – make room in the disaster management lexicon for “uninsurable enclaves”.

It has been recognised for nearly five decades that disaster risk is a function of hazard and vulnerability

Our efforts have focused on supporting those at risk to be more resilient – more prepared.

This focus – I suggest – has failed to adequately map the broader, more holistic nature of risk and in so doing, we have missed opportunities to change the very interaction of hazards and communities at risk. (Here I use the term “community” to be any group with a shared association – for most people this may generally be perceived as being spatial, geographic; but it equally might be economic, social or cultural associations.)

Even if we only explore the spatial aspects  of the “hazard community interface” – which are usefully readily mapped and visualised (and hence communicated) – we can see a history of neglect, if not negligence. In the “real world” of wealth and power, a “short termism” – either seeking or supporting economic returns on investment – has given us a legacy of narrow policy approaches and compromising land use decisions across a range of scales (from single sites to extensive settlements).

Ready illustrations where visualisation enhances understanding can be found with ‘fire’ and ‘water’.

Flooding (somewhat bemusedly viewed as ‘water out of place’) is set to be out of place in increasingly more places. From coastal settings subject to sea rise and more intense, if not also more frequent extreme weather events – to urban subdivisions poorly sited and under ‘runoff pressure’ from increasingly sealed catchments.

Bushfires continue to expose development which has not been strategically informed – and is too often compounded by inadequate design.

Current reactive approaches rely on governments constitutionally responsible for life and property focusing on promulgating preparedness – ‘watch and go’ – life before property.

A logical last resort. However last resorts ought not necessarily be best practices.

Let us start by drawing breath and making sure we are asking the right questions.

I suggest in our changing world we should ask – do we have the will, commitment and tools to overhaul the approaches which imposed the vulnerabilities in the first place?

Can you manage uncertainty in three straightforward steps?

Management processes should always be as simple as possible – yet as complex as is necessary.

First, clear, understandable, straightforward risk statements come out of mindful conversations about context.

Second, we assess risks – not as an academic exercise – but in order to determine whether we need to do anything about those risks. So it’s important to do that both rigorously and consistently – with strong criteria based decision making processes.

Third, effective risk treatments are also best determined by applying rigorous, consistent criteria.

To support the quality of your risk management process our Macro-enabled Excel Workbook – is available as an immediate download – at http://bit.ly/IdentifyAssessTreat