Description
The term “business continuity” is widely used and it has taken on a variety of meanings. Most frequently, the term is used in conjunction with the need for adequate disaster recovery, data backup, and emergency mode operations. Business continuity can also be interpreted as a broader organizational process.
1
UNLV EXECUTIVE MASTER OF SCIENCE IN CRISIS AND EMERGENCY MANAGEMENT
NOVEMBER 2009 NEWSLETTER
E En ns su ur ri in ng g R Re es si il li ie en nt t H He ea al lt th hc ca ar re e O Or rg ga an ni iz za at ti io on ns s: : C Co om mb bi in ni in ng g E Em me er rg ge en nc cy y
M Ma an na ag ge em me en nt t w wi it th h B Bu us si in ne es ss s C Co on nt ti in nu ui it ty y
B BY Y
J JO OH HN N J J. . C CA AS SE EY Y
E EC CE EM M F FA AC CU UL LT TY Y
Ensuring Resilient Healthcare Organizations: Combining
Emergency Management with Business Continuity
“While no plan can guarantee success, inadequate plans are
proven contributors to failure.”
US Department of Homeland Security Nationwide
Plan Review Phase 2 Report June 16, 2006
Introduction to Business Continuity Planning
The term “business continuity” is widely used and
it has taken on a variety of meanings. Most frequently, the
term is used in conjunction with the need for adequate
disaster recovery, data backup, and emergency mode
operations. Business continuity can also be interpreted as
a broader organizational process. The American Society
for Industrial Security (ASIS) defines business continuity as
“…a series of interrelated processes and activities that will
assist in creating, testing, and maintaining an organization-
wide plan for use in the event of a crisis that threatens the
viability and continuity of the organization.” Business
continuity planning (BCP) is the consideration of the factors
and steps necessary to prepare for a crisis so that the
organization can manage and survive the crisis and ensure
its continued viability. Where disaster preparedness puts
the priority on preparing for what seems unlikely to occur,
business continuity puts the priority on the organization’s
ability to function at a sustainable and viable level in spite
of an emergency or disaster. Business continuity aims to
protect a commercial entity.
Business continuity is a comprehensive managed
effort that allows organizations to consider the factors and
steps necessary to accurately assess risks, prepare for a
crisis (disaster or emergency), manage and survive the
crisis, take all appropriate actions to ensure the
organization’s continued viability, and secure assets.
Business continuity planning (BCP) is not a static process,
but like emergency management it represents a continuum
of activities. Business continuity has five (5) major
elements; readiness, prevention, response, recovery, and
testing/training/ evaluation/maintenance.
Business continuity readiness embodies the
foundational steps necessary for a successful business
continuity plan. These foundational steps include senior
level organizational sponsorship and support, performance
of a risk assessment, performance of a business impact
analysis, development of strategic plans to mitigate risks
and to respond to any crisis, and the development of crisis
management and response teams.
Business continuity prevention focuses on those
areas where planning will allow an organization to avoid or
limit the impact of a crisis. Typical prevention elements
include the development and implementation of mitigation
strategies. Effective mitigation strategies include the
identification of actions that can be taken to prevent or limit
the impact of a crisis, such as a technology disaster
recovery program to mitigate the loss of key documents
and data, but also to identify and provide resources needed
for mitigation. This can include essential personnel,
technology, and facilities, as well as resources such as
external vendors, alternate worksites, and emergency
response equipment.
2
Business continuity response is the timely execution of the
steps required to respond to a crisis. A business continuity
response could be triggered by a catastrophic event, but
unlike a response in emergency management, a business
continuity response could also be triggered by a variety of
other factors, such as legislative changes, changes to the
competitive environment, changes in cash flow, or hostile
labor negotiations. The response triggers can vary
significantly from organization to organization and are
directly related to the risks and priorities identified by the
risk assessment and BIA. Business continuity response
steps are very similar to those in emergency management
and include recognition of a potential crisis, notification of
team, situational assessment, declaration of a crisis,
execution of response plan, effective communication of
information to internal and external audiences, and
resource management.
Business continuity recovery is similar to the recovery
phase of emergency preparedness; it is the assessment of
damage or impact of the crisis on the organization, the
resumption of critical and remaining processes, and the
eventual return to normal operations. In the event of a
natural or man-made disaster, a business continuity
damage assessment would be identical to that seen in
emergency management, but not all crises involve physical
damage. Crises, such as technology or societal issues,
can impact business operations without resulting in
physical damage. Effectively assessing and documenting
the damage resulting from a crisis is critical to mobilize the
resources necessary to effect recovery. Once damage is
assessed, business continuity prioritizes the restoration of
critical business processes. The end result of the recovery
phase is to bring the organization “back to normal”. The
American Society for Industrial Security (ASIS) points out
that a “new normal” may exist following the crisis that is
different from the pre-crisis “normal”, but the establishment
of the “new normal” state is important in that it helps the
organization phase back into productive work.
Business continuity testing/ training/ evaluation/
maintenance consists of the training and education of team
members and organization employees in the execution of
business continuity operations, the testing of established
business continuity plans and the evaluation of their
effectiveness on an on-going basis. This consists of the
use of drills and exercises to test management and
response teams and the evaluation and modification of
plans where improvements can be made. Consistent re-
evaluation of an organization’s business continuity plan is
an important element of this phase since the plan can be
impacted by a number of different variables, including
industry trends, regulatory requirements, newly emerging
risks, and event or crisis experience.
Integration of business continuity and emergency
preparedness principles in healthcare
The basic elements of emergency management
are referred to as the “disciplines of emergency
management.” Conceptually these emergency
management “disciplines” are very similar to the basic
elements of business continuity.
The implementation of a business continuity process bears
many similarities to established emergency management
processes. Both have been motivated, at least in part, by
the events of September 11, 2001 and of Hurricane Katrina
in 2005. Both are intended to help an organization prepare
for, respond to, and recover from a crisis or disastrous
event. Both utilize an on-going process of risk analysis,
preparation, response, recovery, and risk mitigation. The
major difference between emergency management and
business continuity is their focus. While the focus of
emergency management is specifically on natural and
man-made disasters, business continuity takes a broader
view of what might constitute a “disaster”, and takes into
account events that could negatively impact an
organization’s ability to remain financially viable and their
fundamental credibility in the marketplace.
Because the current political climate results in a lack of
attention being paid to mitigation and long-term recovery,
and that they only become priorities as a result of some
major catastrophic event, it is time to “take a fresh look” at
emergency management. What is needed in emergency
management is an overhaul of the current federal
management system, where the emergency management
disciplines of mitigation and long-term recovery are
separated from those of preparedness and response. The
entire culture of emergency management needs to adopt a
more holistic focus that balances the long-term benefits of
mitigation with the short term necessities of preparedness
and response.
An objective review of the performance of emergency
management mechanisms in the wake of major events
supports this position. Federal-level programs are in need
of creative changes that permit both a more effective
response, but also prioritize long-term mitigation and are
better able to support long-term recovery. However, the
challenge is greater than simply overhauling the federal
administration of emergency management. These new
approaches must be utilized by all organizations involved in
emergency management, including state and local
governments, as well as private sector and non-
governmental agencies such as hospitals.
3
Facts that continue to emerge from post-Katrina New
Orleans demonstrate the need for different and more holistic
approaches to emergency management. There seems to be a
common myth that emergency management is used only to prepare
for events that seem unlikely to occur. One constructive approach is
to combine the individual efforts by both the public and the private
sector to create a longer continuum of emergency management
planning. The integration of business continuity concepts with those
of emergency management offers an iterative step in this direction.
Private and non-governmental agencies face the same
shifting priorities and funding difficulties experienced by
governmental agencies. Hospitals and other healthcare providers are
no exception. As long as emergency management is viewed as not
contributing to the financial viability of the organization, it will remain
at best a secondary function, and at worst, it will be viewed as an
unfunded government mandate. By integrating the concepts of
business continuity with emergency management, the focus of the
effort is broadened. Rather than focusing effort on preparing for what
seem like unlikely events, efforts are broadened to encompass
everyday business drivers. Business continuity planning
encompasses a broader definition of crisis, including events that
occur with greater frequency and with some degree of predictability.
Major storms and earthquakes are relatively rare and are completely
unpredictable, which makes the effort of preparation for, and
recovery from them harder to justify, let alone sustain. Broaden the
focus to include labor negotiations, legislative or regulatory changes,
civil instability, and competitive or supply environment changes and
suddenly the value of the having mechanisms in place capable of
dealing with these issues represents good business.
The broader focus of business continuity makes it practical to
integrate emergency management concepts into everyday business
operations. The more broadly they are integrated, the more
frequently they are used. With greater use, comes greater
acceptance and understanding of their application by a greater
proportion of the organization’s employees. Greater use also brings
more feedback that helps improve the process, making it more
relevant and increasing its usefulness to the organization. Effective
integration of business continuity and emergency management
concepts breeds a culture of preparedness and organizational
learning, communication and memory.
In the healthcare industry, this represents a change from
established practices. Hospital preparedness is mandated to
conform to specific standards. Changing this approach requires the
education of hospital leadership to both the value of business
continuity planning and in creatively applying business continuity and
emergency management processes in ways that demonstrate value
to the organization.
CONCLUSION
Emergency management, even when mandated by
regulatory agencies, does not by itself provide a compelling
motivation for its broad and general application. In order for this to
happen, emergency management must be able to show real world
value for the organization. The integration of business continuity
concepts helps broaden the applicability and increases both the real
and potential value of such programs. While it is certainly not a
perfect solution, it is an iterative step in the development and
implementation of improved “disaster resiliency”.
More information on the ECEM
program can be found online athttp://urbanaffairs.unlv.edu/pubadmin
APPLICATIONS FOR ECEM FALL,
2010 ACCEPTED NOW – DUE DATE:
MAY 7, 2010 * START DATE: JULY 5,
2010 *
doc_148082064.pdf
The term “business continuity” is widely used and it has taken on a variety of meanings. Most frequently, the term is used in conjunction with the need for adequate disaster recovery, data backup, and emergency mode operations. Business continuity can also be interpreted as a broader organizational process.
1
UNLV EXECUTIVE MASTER OF SCIENCE IN CRISIS AND EMERGENCY MANAGEMENT
NOVEMBER 2009 NEWSLETTER
E En ns su ur ri in ng g R Re es si il li ie en nt t H He ea al lt th hc ca ar re e O Or rg ga an ni iz za at ti io on ns s: : C Co om mb bi in ni in ng g E Em me er rg ge en nc cy y
M Ma an na ag ge em me en nt t w wi it th h B Bu us si in ne es ss s C Co on nt ti in nu ui it ty y
B BY Y
J JO OH HN N J J. . C CA AS SE EY Y
E EC CE EM M F FA AC CU UL LT TY Y
Ensuring Resilient Healthcare Organizations: Combining
Emergency Management with Business Continuity
“While no plan can guarantee success, inadequate plans are
proven contributors to failure.”
US Department of Homeland Security Nationwide
Plan Review Phase 2 Report June 16, 2006
Introduction to Business Continuity Planning
The term “business continuity” is widely used and
it has taken on a variety of meanings. Most frequently, the
term is used in conjunction with the need for adequate
disaster recovery, data backup, and emergency mode
operations. Business continuity can also be interpreted as
a broader organizational process. The American Society
for Industrial Security (ASIS) defines business continuity as
“…a series of interrelated processes and activities that will
assist in creating, testing, and maintaining an organization-
wide plan for use in the event of a crisis that threatens the
viability and continuity of the organization.” Business
continuity planning (BCP) is the consideration of the factors
and steps necessary to prepare for a crisis so that the
organization can manage and survive the crisis and ensure
its continued viability. Where disaster preparedness puts
the priority on preparing for what seems unlikely to occur,
business continuity puts the priority on the organization’s
ability to function at a sustainable and viable level in spite
of an emergency or disaster. Business continuity aims to
protect a commercial entity.
Business continuity is a comprehensive managed
effort that allows organizations to consider the factors and
steps necessary to accurately assess risks, prepare for a
crisis (disaster or emergency), manage and survive the
crisis, take all appropriate actions to ensure the
organization’s continued viability, and secure assets.
Business continuity planning (BCP) is not a static process,
but like emergency management it represents a continuum
of activities. Business continuity has five (5) major
elements; readiness, prevention, response, recovery, and
testing/training/ evaluation/maintenance.
Business continuity readiness embodies the
foundational steps necessary for a successful business
continuity plan. These foundational steps include senior
level organizational sponsorship and support, performance
of a risk assessment, performance of a business impact
analysis, development of strategic plans to mitigate risks
and to respond to any crisis, and the development of crisis
management and response teams.
Business continuity prevention focuses on those
areas where planning will allow an organization to avoid or
limit the impact of a crisis. Typical prevention elements
include the development and implementation of mitigation
strategies. Effective mitigation strategies include the
identification of actions that can be taken to prevent or limit
the impact of a crisis, such as a technology disaster
recovery program to mitigate the loss of key documents
and data, but also to identify and provide resources needed
for mitigation. This can include essential personnel,
technology, and facilities, as well as resources such as
external vendors, alternate worksites, and emergency
response equipment.
2
Business continuity response is the timely execution of the
steps required to respond to a crisis. A business continuity
response could be triggered by a catastrophic event, but
unlike a response in emergency management, a business
continuity response could also be triggered by a variety of
other factors, such as legislative changes, changes to the
competitive environment, changes in cash flow, or hostile
labor negotiations. The response triggers can vary
significantly from organization to organization and are
directly related to the risks and priorities identified by the
risk assessment and BIA. Business continuity response
steps are very similar to those in emergency management
and include recognition of a potential crisis, notification of
team, situational assessment, declaration of a crisis,
execution of response plan, effective communication of
information to internal and external audiences, and
resource management.
Business continuity recovery is similar to the recovery
phase of emergency preparedness; it is the assessment of
damage or impact of the crisis on the organization, the
resumption of critical and remaining processes, and the
eventual return to normal operations. In the event of a
natural or man-made disaster, a business continuity
damage assessment would be identical to that seen in
emergency management, but not all crises involve physical
damage. Crises, such as technology or societal issues,
can impact business operations without resulting in
physical damage. Effectively assessing and documenting
the damage resulting from a crisis is critical to mobilize the
resources necessary to effect recovery. Once damage is
assessed, business continuity prioritizes the restoration of
critical business processes. The end result of the recovery
phase is to bring the organization “back to normal”. The
American Society for Industrial Security (ASIS) points out
that a “new normal” may exist following the crisis that is
different from the pre-crisis “normal”, but the establishment
of the “new normal” state is important in that it helps the
organization phase back into productive work.
Business continuity testing/ training/ evaluation/
maintenance consists of the training and education of team
members and organization employees in the execution of
business continuity operations, the testing of established
business continuity plans and the evaluation of their
effectiveness on an on-going basis. This consists of the
use of drills and exercises to test management and
response teams and the evaluation and modification of
plans where improvements can be made. Consistent re-
evaluation of an organization’s business continuity plan is
an important element of this phase since the plan can be
impacted by a number of different variables, including
industry trends, regulatory requirements, newly emerging
risks, and event or crisis experience.
Integration of business continuity and emergency
preparedness principles in healthcare
The basic elements of emergency management
are referred to as the “disciplines of emergency
management.” Conceptually these emergency
management “disciplines” are very similar to the basic
elements of business continuity.
The implementation of a business continuity process bears
many similarities to established emergency management
processes. Both have been motivated, at least in part, by
the events of September 11, 2001 and of Hurricane Katrina
in 2005. Both are intended to help an organization prepare
for, respond to, and recover from a crisis or disastrous
event. Both utilize an on-going process of risk analysis,
preparation, response, recovery, and risk mitigation. The
major difference between emergency management and
business continuity is their focus. While the focus of
emergency management is specifically on natural and
man-made disasters, business continuity takes a broader
view of what might constitute a “disaster”, and takes into
account events that could negatively impact an
organization’s ability to remain financially viable and their
fundamental credibility in the marketplace.
Because the current political climate results in a lack of
attention being paid to mitigation and long-term recovery,
and that they only become priorities as a result of some
major catastrophic event, it is time to “take a fresh look” at
emergency management. What is needed in emergency
management is an overhaul of the current federal
management system, where the emergency management
disciplines of mitigation and long-term recovery are
separated from those of preparedness and response. The
entire culture of emergency management needs to adopt a
more holistic focus that balances the long-term benefits of
mitigation with the short term necessities of preparedness
and response.
An objective review of the performance of emergency
management mechanisms in the wake of major events
supports this position. Federal-level programs are in need
of creative changes that permit both a more effective
response, but also prioritize long-term mitigation and are
better able to support long-term recovery. However, the
challenge is greater than simply overhauling the federal
administration of emergency management. These new
approaches must be utilized by all organizations involved in
emergency management, including state and local
governments, as well as private sector and non-
governmental agencies such as hospitals.
3
Facts that continue to emerge from post-Katrina New
Orleans demonstrate the need for different and more holistic
approaches to emergency management. There seems to be a
common myth that emergency management is used only to prepare
for events that seem unlikely to occur. One constructive approach is
to combine the individual efforts by both the public and the private
sector to create a longer continuum of emergency management
planning. The integration of business continuity concepts with those
of emergency management offers an iterative step in this direction.
Private and non-governmental agencies face the same
shifting priorities and funding difficulties experienced by
governmental agencies. Hospitals and other healthcare providers are
no exception. As long as emergency management is viewed as not
contributing to the financial viability of the organization, it will remain
at best a secondary function, and at worst, it will be viewed as an
unfunded government mandate. By integrating the concepts of
business continuity with emergency management, the focus of the
effort is broadened. Rather than focusing effort on preparing for what
seem like unlikely events, efforts are broadened to encompass
everyday business drivers. Business continuity planning
encompasses a broader definition of crisis, including events that
occur with greater frequency and with some degree of predictability.
Major storms and earthquakes are relatively rare and are completely
unpredictable, which makes the effort of preparation for, and
recovery from them harder to justify, let alone sustain. Broaden the
focus to include labor negotiations, legislative or regulatory changes,
civil instability, and competitive or supply environment changes and
suddenly the value of the having mechanisms in place capable of
dealing with these issues represents good business.
The broader focus of business continuity makes it practical to
integrate emergency management concepts into everyday business
operations. The more broadly they are integrated, the more
frequently they are used. With greater use, comes greater
acceptance and understanding of their application by a greater
proportion of the organization’s employees. Greater use also brings
more feedback that helps improve the process, making it more
relevant and increasing its usefulness to the organization. Effective
integration of business continuity and emergency management
concepts breeds a culture of preparedness and organizational
learning, communication and memory.
In the healthcare industry, this represents a change from
established practices. Hospital preparedness is mandated to
conform to specific standards. Changing this approach requires the
education of hospital leadership to both the value of business
continuity planning and in creatively applying business continuity and
emergency management processes in ways that demonstrate value
to the organization.
CONCLUSION
Emergency management, even when mandated by
regulatory agencies, does not by itself provide a compelling
motivation for its broad and general application. In order for this to
happen, emergency management must be able to show real world
value for the organization. The integration of business continuity
concepts helps broaden the applicability and increases both the real
and potential value of such programs. While it is certainly not a
perfect solution, it is an iterative step in the development and
implementation of improved “disaster resiliency”.
More information on the ECEM
program can be found online athttp://urbanaffairs.unlv.edu/pubadmin
APPLICATIONS FOR ECEM FALL,
2010 ACCEPTED NOW – DUE DATE:
MAY 7, 2010 * START DATE: JULY 5,
2010 *
doc_148082064.pdf