Operational resilience vs. business continuity: Do you need both?
In a recent blog, we looked at the difference between business resilience and business continuity ' with the conclusion is that organizations need both immediate continuity plans, plus longer-term resilience, to thrive. But what about operational resilience vs. business continuity?
When it comes to corporate resilience, though, there are several similar terms: organizational resilience, operational resilience and business resilience. Do they all mean the same thing? And how do they compare and contrast with business continuity?
Organizational resilience tends to be a broader concept, encompassing leadership, well-being and operational issues. In its Rising Resilient report, consultant Aon posits that 'resilience requires visionary leadership, a continuous dialogue with your workforce and a well-rounded program of well-being.'
Search Disaster Recovery concurs, saying that 'Organizational resilience (OR) generally embodies the entire organization, including technology, people, facilities, processes and everything needed to operate the business.'
Operational resilience, on the other hand, tends to be more akin to business continuity: the UK's Financial Conduct Authority defines it as 'the ability of firms...to prevent, adapt, respond to, recover and learn from operational disruptions.'
Operational Resilience vs. Business Continuity
As operational resilience seems to be used almost interchangeably with business continuity, it's worth exploring the differences ' if any ' between the two.
What's the difference between operational resilience and business continuity? If they are different, how should this influence your approach? Do you need different strategies to ensure you both are operationally resilient and have an effective business continuity plan?
Operational resilience, Search Disaster Recovery claim, 'has been in the shadows of OR [organizational resilience] and is now a term of growing interest.'
In its article, it quotes definitions of operational resilience from Gartner ('a set of techniques that allow people, processes and informational systems to adapt to changing patterns. It is the ability to alter operations in the face of changing business conditions') and the British Standards Institution ('[the] ability of an organization to anticipate, prepare for, and respond and adapt to incremental change and sudden disruptions to survive and prosper.')
Business and organizational resilience tend to refer to an ongoing refinement process and adaption to reflect evolving conditions. Whereas business continuity is all about immediate crisis response and subsequent rebuilding, maybe operational resilience sits somewhere in the middle. Perhaps it should cover both the 'incremental change' and 'sudden disruption' referenced by the British Standards Institution.
How to Ensure Business Continuity
When the worst happens, a well-prepared and tested Business Continuity Plan (BCP) can make the difference between crisis and disaster. By identifying potential risks to your business and setting up teams to manage your response, with clear roles and responsibilities, you are lessening the potential for any business interruption to cause significant disruption. There are enormous advantages for businesses having and maintaining a robust business continuity plan.
An essential foundation of any BCP is the data on which your planning is built. Devising a watertight plan requires, firstly, accurate information on all your subsidiaries and entities. It would be best if you accounted for all your businesses and geographies to ensure nothing is missing from your preparations.
Then, should disaster strike, you need to be able to get your arms around your entire business quickly, confident that no areas are missed. Entity data stored in an ad-hoc way ' on spreadsheets or locally-held systems ' can create holes in your planning that have a significant impact when responding to an incident.
Entity data that is centralized in a single system, on the other hand, gives you 360-degree oversight, with the confidence that your planning is based on accurate and up-to-date information.
How to Achieve Operational Resilience
We looked in our recent blog at some of the things needed for business resilience, among them; corporate behaviors aligned with a shared vision and purpose; the ability to absorb, adapt, and effectively respond to change; good governance and management; and effective risk management.
If we go with the Search Disaster Recovery definition of operational resilience we cited above, then resilience at an operational level sits somewhere between this business resilience and full-on disaster planning. It incorporates both the need to evolve in tandem with the changing business landscape and the necessity of keeping one eye on potential unexpected and catastrophic risks.
Some of your work on operational resilience is therefore covered under your business continuity planning.
Other activity falling under the operational resilience banner might be longer-term; more strategic activity around aligning your business structure and operations to the prevailing environment.
It might include reviewing your operational structure ' should you take your business public; if so, which elements of your operations, and in which jurisdictions? It should cover regulatory compliance and governance; is it up to scratch across all your entities and subsidiaries? Do you keep a close enough eye on competitor activity to recognize threats and opportunities? Is innovation given sufficient attention?
Here again, having reliable data to base your plans on is essential. You need a full and current picture of your entire operation to ensure you understand all the risks you face and their potential implications, as well as the opportunities available in terms of new markets, technologies and customers.
Having an unimpeachable record of all your corporate data smooths your path to operational resilience in a number of ways. This might be via having a single repository for corporate information, like board minutes and corporate documents. It can mean using entity management software to capture a centralized corporate record. That creates a single system that stores data and information for tax, legal, finance and compliance business units across all your legal entities and subsidiaries, ensuring no risks or opportunities are missed.
Operational Resilience vs. Business Continuity ' Do You Need Both?
To answer our original question ' yes, we would argue that you do need both business continuity and operational resilience.
While there are overlaps between the two, each plays a distinct and different role in driving your organization forward. One more immediate and reactive. The other incorporating elements of this disaster recovery work but going beyond that. Doing so builds a robust, resilient foundation for your business's growth and expansion in a compliant, efficient and effective way.
What ties the two together? Data; the indisputable need for accurate information and a clear picture across your entire organization. This need drives more and more businesses to seek a single source of truth for their corporate data. It's something that Diligent's suite of entity management, compliance and board solutions has vast experience of delivering, trusted by more than 65,000 customers in 90 countries. You can find out more by visiting our website and getting in touch for a no-obligation demo.
