PP2: Embracing Business Continuity – Building a Culture of Resilience

This article is part of my hands-on BCMS Implementation Series, where we build an end-to-end Business Continuity Management System following the BCI Good Practice Guidelines (GPG Edition 7.0).

• Previous in Series: PP1: Establishing a BCMS
• Next in Series: PP3: Analysis: The Blueprint of Priority
• CBCI Exam Study Reference: If you are preparing for your certification, read my original study notes in the PP2 Embracing Business Continuity Learning Notes.

A common operational flaw in modern governance is treating Business Continuity as a periodic compliance exercise—a binder left on a shelf or a set of slides reviewed once a year to pass an audit.

This passive "box-ticking" approach creates a dangerous illusion of safety. Policies and governance structures mean nothing if, when a real crisis strikes, staff lack the awareness, training, or cultural buy-in required to execute them effectively.

Before we can run technical impact assessments in PP3: Analysis or design recovery solutions in PP4: Solutions Design, we must first bridge the gap between policy and practice.

This brings us to BCI Professional Practice 2 (PP2: Embracing Business Continuity).

As detailed in GPG Edition 7.0, PP2 shifts our focus from passive compliance to active organizational resilience. By addressing human factors, continuous awareness, and real-world training, we ensure Business Continuity moves out of static documentation and into the everyday operational DNA of the business.

Introduction: The Death of the Mandatory Slide Deck

For too long, Business Continuity (BC) has been strangled by bureaucracy—relegated to a "mandatory slide deck" ritual designed to satisfy auditors rather than ensure survival. While standard management systems are theoretically built to navigate disruptions, a compliance-only approach creates a lethal illusion of safety. When a crisis hits, static plans inevitably collapse.

The BCI's updated Good Practice Guidelines (GPG Edition 7.0) expose why quality suffers in these environments: external consultants run BC as a detached project, and key personnel treat workshops as administrative noise. This leads to dangerous "skipped steps" across the BC lifecycle. For instance, many organisations leap straight from establishing policy (PP1) and running a Business Impact Analysis (PP3) into plan-writing, completely ignoring the intermediate Strategies & Solutions (PP4) stage required to make those plans viable.

True resilience requires a fit-for-purpose capability that survives internal change. To get there, we have to evolve from the administrative foundation of "Embedding" to the cultural mandate of "Embracing" continuity.

Head vs. Heart: A Necessary Paradigm Shift

Modern standards mark a clear divide between the "Head"—the systematic integration of BC into business-as-usual—and the "Heart"—the emotional commitment of the workforce.

Embedding is the technical foundation: allocating roles, running training, and scheduling reviews. But embedding alone isn't enough. You can mandate that a manager attend a BIA workshop, but you can't mandate that they care about the accuracy of the data.

Embracing is what changes the culture over time. It requires emotional intelligence from BC professionals because it targets deep-seated beliefs—something a policy document can't touch. This cultural journey moves through four stages:

• Awareness: Marketing the strategic value of BC to raise its profile across the business.
• Stronger Beliefs: Shifting the mindset from "we have to do this for an audit" to "this keeps us alive."
• Constructive Attitudes: Fostering a proactive, inquisitive approach to finding operational flaws.
• Improved Behaviours: Driving natural, instinctive responses during a live disruption.

The BC Professional as a Cultural Anthropologist

Rather than acting as a rigid auditor, the modern BC professional needs to be a "self-aware and pragmatic" explorer of workplace culture. To influence different departments, they must be observant, adaptable, ingenious, and proactive.

This ingenuity is vital during major operational shifts, like an office relocation or infrastructure migration. Here, the practitioner maintains a clear Objective Separation of Duties. Acting as the "Assessor," they spot single points of failure that line managers might miss—such as single-provider telecom dependencies or vendor bottlenecks. They feed unbiased data to Top Management (the "Decision Maker"), protecting leadership from operational noise while keeping accountability where it belongs.

Secret Weapons: BC Champions and Influence Mapping

Cultural transformation is impossible without internal allies. We call these Business Continuity Champions. As defined by GPG 7.0, these are "persons tasked with supporting the BCMS from the perspective of their area of expertise, by inputting and maintaining the system and periodically updating documentation."

The Departmental Representative acts as the connective tissue between leadership’s intent and the workforce’s action. It is critical to distinguish these cultural roles from "Incident Response Personnel." While response teams execute plans during an active crisis, Champions focus on the day-to-day health and viability of the system.

Checklist: The Departmental Representative's Core Responsibilities

• Communicate Changes: Alerting the BC Professional to shifts in departmental operations or technology stacks.
• Data Collection for BIA: Leading the gathering of critical metrics to ensure the Business Impact Analysis reflects operational reality.
• Supply Chain Insight: Identifying and acknowledging single points of failure within their specific vendor dependencies.
• Documentation Maintenance: Keeping local procedures and team contact lists current.
• Exercise Participation: Actively engaging in local scenario tests to validate plan efficacy.

Training vs. Awareness: The Tactical Balance

While Awareness builds the culture, Training builds the muscle. Together, they achieve Competence: the ability to apply knowledge and skills to achieve the intended result.

Consider a critical core service, such as a primary client transaction system or digital operational platform. Broad awareness ensures staff understand its business criticality. However, specific Training is required for the technical response team to execute an Operational Recovery Plan if the system crashes. In a high-stakes scenario, such as peak operational processing, the team must meet tight recovery metrics to prevent severe financial or reputational damage.
To lead effectively, executives must view metrics as human-centric targets:

• MTPD (Maximum Tolerable Period of Disruption): The ultimate "survival limit." The point at which catastrophic impacts occur (e.g., a total service outage exceeding a regulatory deadline).
• RTO (Recovery Time Objective): The target for resuming activities—always shorter than the MTPD to allow a safety margin.
• RPO (Recovery Point Objective): The maximum allowable data loss measured in time. Losing more than a few minutes of real-time transactions could compromise system integrity.
• MBCO (Minimum Business Continuity Objective): The "core-function-only" capacity. Success is ensuring clients can perform essential actions, even if background reporting dashboards remain offline.

Conclusion: The Ultimate Metric of Success

The ultimate metric of a successful BCMS is not a flawless audit report; it is the quality of BC outcomes. Success is realised when an organisation has "Embraced" resilience so deeply that personnel act out of personal conviction.

We see this during an unexpected systems outage or facility closure. An organisation that has embraced BC doesn't stall while waiting for a step-by-step manual. Because the operational team deeply understands the business value of keeping services running, they instinctively switch to pre-established workarounds—utilising contingency systems or manual protocols—to ensure the operational mission continues seamlessly.

Resilience is not a plan sitting static on a shelf; it is the living heartbeat of your workforce. Lead the heart, and the head will follow.

Up Next in the Series...

Now that we have established top-level governance (PP1) and embedded a culture of resilience (PP2), how do we determine what truly matters before a crisis strikes?

In the next article, we cover PP3: Analysis: The Blueprint of Priority, where we tackle the Business Impact Analysis (BIA), define critical metrics (MTPD, RTO, RPO), and introduce consequence-first Risk Assessment to eliminate the "Scream Test."