It all happened so fast. One day, we started hearing about a new virus on the news and, within a few short weeks, much of the world was in complete lockdown. That meant employees couldn’t return to the office because something as simple as a two-minute watercooler conversation could result in dire health consequences. It was a panic-filled time full of remote work transitions, branch closures and concern for staff and member safety – plus a whole lot of cleaning wipes and buckets of hand sanitizer.
In the midst of the chaos, how many of us found our business continuity plans were not effective or lacked preparations for a disaster of this magnitude? Were we able to handle the many, many hurdles we faced in such a short time? Suffice it to say that the pandemic taught us countless lessons over the past year. And one such lesson is that focusing on straight-up business continuity isn’t enough. Simply being prepared is not the be-all, end-all. In fact, business continuity is just a step in the process on the journey to reaching business resiliency.
What is business resiliency?
There are a variety of definitions for the term business (or organizational) resiliency. Two such definitions are provided by computer software giant, IBM, and the International Organization for Standardization (ISO), so let’s compare:
“The ability of an organization’s business operations to rapidly adapt and respond to internal or external dynamic changes – opportunities, demands, disruptions or threats – and continue operations with limited impact to the business.” -IBM
“The ability of an organization to absorb and adapt in a changing environment to enable it to deliver its objectives and to survive and prosper.” -ISO 22316:2017
Both acknowledge the need to continue with business as usual, regardless of an emergency or disruption. Sounds kind of similar to business continuity, right? But the difference is that business resiliency comes down to one thing: adaptability. It’s about having the critical areas of disaster recovery/business continuity – technology, employees, processes, security, etc. – already in place so you can actively change course in your plans as the situation ebbs and flows. And it’s that simple variation of adaptability that makes it vastly different from the typical notion of business continuity.
Think about it, business continuity is all about playing defense. The goal is to have plans in place to continue your operations as close to normal as possible. It’s being reactive to the emergency that’s already happening. Business resiliency, on the other hand, is about the offense and being proactive – taking actions to ensure your credit union has the proper resources in place to handle a disruption to business even before it arises.
How to Start the Journey?
After the many challenges the pandemic has brought to light, most credit unions already have business continuity top of mind. But how do you get from continuity to resiliency? The journey begins with some questions your institution needs to consider:
- What is the mission and vision of your organization?
- Who are your members and what do they need from you? How have their consumer habits changed and what does that mean for your credit union?
- How much can you bend before you break – have you performed a business impact analysis (BIA)?
- What have you prepared for from an internal perspective (data breaches, pandemics, natural disasters, etc.)? Are your vendors and partners also prepared and, if not, what is the impact to your institution?
- Have you trained staff and tested your preparations? Do you have cross-training efforts and succession planning in place?
- What do future operations look like? Have you compared remote vs. facility-based work? Is it feasible to have multiple operation sites for disaster recovery purposes?
With those questions answered, you can determine what is needed to make the transition in terms of staff time and expertise, technology and other physical materials, software and databases, analytics, procedure updates and so on.
What are the next steps?
Just like Rome, business resiliency cannot be built in a day. It takes time and effort to create an infrastructure that will enable your institution to be not just prepared, but flexible in ever-evolving emergency conditions. These are the four steps needed to make the transition, and although they seem simple, they will help you truly see the difference between business continuity and resiliency:
Focus on your people. People are your foundation for business resilience. Trust and empower employees to do their jobs. Communicate clearly and give them the tools they need to carry out business functions. In turn, they’ll find solutions that will help you thrive today and tomorrow.
Support your partners. Your credit union might be equipped for change, but are your partners? Monitor vendor and critical partners’ financial health, cybersecurity, and access to data to minimize risks to your institution/members and increase resiliency.
Safeguard your technology. Technology is a double-edged sword. It can protect your organization or expose you to risk. Err on the side of caution by finding and implementing solutions that can safeguard your credit union through turbulent times. An example might be implementing a monitoring and alert system to let you know of real-time supply chain issues.
Plan for sustainability. Sustainability is key to resilience, and organizations need to make ongoing and perhaps even significant investments to ensure that sustainability. A flexible workforce, succession planning and disaster recovery efforts can all help to reinforce business resiliency.
There’s a reason we call it a journey to business resiliency; there’s no single route or right way to get there. Every credit union’s path will be different. Stick to the considerations and steps shown above and you’ll see the difference between the defense tactics of continuity and the quick, hands-on and adaptable nature of resilience. Good luck and bon voyage!
About Mark Clarke
Mark Clarke works as the business continuity administrator for Vizo Financial Corporate Credit Union. In this role, Mr. Clarke supports the performance of business continuity planning, business impact analysis and business continuity training for the Corporate and the credit union industry. Mr. Clarke also delivers tailored consulting services for credit unions, assisting them with their specific business continuity needs.