Business Continuity Management (BCM) – Are You Going Out or Staying In?

Colin Jeffs MBCI, Head of Operational Resilience Consulting, examines the advantages and disadvantages of outsourcing versus in-house business continuity management (BCM). As a provider that supports customers with both options, Daisy offers an unbiased perspective on the factors that influence this critical decision.

In the past two years, the importance of business continuity management (BCM) has grown significantly. Risks that organisations believed they were prepared for turned out to be more damaging than anticipated, with some even facing dire consequences due to the pandemic and its associated challenges. As a result, companies of all sizes have re-evaluated the true meaning of business continuity. It is now recognised as a necessity rather than a luxury, extending beyond theoretical risk management protocols.

With this realisation, the next pivotal choice revolves around whether to handle BCM internally or outsource it to a specialised third party. Each approach has its pros and cons, but either way, you don’t have to navigate the path alone. Daisy, as a provider, offers support for in-house BCM while also delivering it as a managed service. We understand the complexities involved and can guide you towards the right solution for your organisation.

The pros and cons of internal business continuity management

The advantages and disadvantages of implementing in-house BCM vary, although it is generally more suitable for larger organisations.

The effectiveness of in-house BCM is not solely determined by the size of the enterprise but rather by the complexity and uniqueness of their IT and operational environments. Larger organisations with intricate business structures often have more nuanced department responsibilities, specific compliance protocols, and intricate reporting networks.

Having someone within the organisation who possesses a comprehensive understanding of the business’s strategic, tactical, and operational details is advantageous for identifying risks, potential failure points, and appropriate mitigations. One significant benefit is that internal personnel have immediate access to all relevant internal resources related to the risk landscape. They are also available to the company at all times, exclusively dedicated to the business, and already contracted to handle these responsibilities.

However, there is an obvious challenge: finding such a highly skilled specialist in the first place.

As the company grows in size, the number of potential risks also increases. Entrusting one person or a single department with the oversight of these challenges is a demanding task, and recruiting for such a specialised role is not easy. If the company does not hire a dedicated specialist, it may result in the individual’s attention being divided between their regular responsibilities and the additional function, leaving the business vulnerable.

Another consideration is the potential for “change creep.” When everything within the business feels familiar, there is a risk of becoming complacent or overlooking the changing external environment. Similarly, challenging the status quo may be difficult for someone who has personal connections, friendships, and loyalty to those who established the existing rules. On the contrary, a consultant or external resource can provide unbiased insights and recommendations without being influenced by internal politics.

However, the most significant drawback of in-house BCM is the possibility of the ideal person leaving the company in the future.

Losing an internal resource who has successfully addressed all the aforementioned challenges to ensure optimal business continuity is not only detrimental but also highly likely in most cases. Therefore, regardless of the pros and cons of in-house BCM, it is sensible to seek external support as part of the overall equation.

Bringing a third-party in to provide discrete consultation, assessment, validation, audits and workshops can help to free up internal resources and help drive further internal change as required. Vitally, it also adds another pair of eyes to mitigate against any complacency and any subconscious resistance to progress.

The pros and cons of outsourcing business continuity management

While an in-house BCM function may rely on a single person or a small team to handle internal operations, outsourcing BCM provides access to a dedicated provider with a team of specialists who take an outside-in approach based on real-world experience.

Cost is always a factor to consider when outsourcing, but it can often be more cost-effective than hiring and maintaining in-house staff. Outsourcing allows for more focused BCM spending, leading to potential cost savings in the long run.

By working with a dedicated provider, companies can establish clear expectations and deliverables, enabling them to directly measure the success of their BCM investment. This clarity can sometimes be clouded when BCM activities are conducted in-house.

However, it’s important to exercise caution. Since the provider may have multiple clients, there is a possibility that they might use templates or generic approaches to expedite their activities. Therefore, enterprises should clearly communicate their specific BCM requirements from the outset.

The advent of Business Continuity as a Service has elevated the BCM landscape through specialised providers. However, it’s crucial to foster a relationship based on mutual understanding. Providers who recognise and demonstrate that there is no one-size-fits-all solution will be the ideal partners to guide your enterprise successfully through the business continuity journey.

Guidance for every journey

There are similarities between both in-house and outsourced approaches to business continuity management (BCM). For example, the need to challenge the status quo is important regardless of whether it’s an internal specialist or an outsourced consultant. To determine the best approach, a tailored perspective must be applied.

While business continuity impacts all businesses, it does so in unique ways. It’s crucial to start the BCM journey by focusing on the specific company itself, including its objectives, strategy, ambitions, strengths, weaknesses, and vulnerabilities. From this foundation, the level of assistance and technological intervention required can be assessed. This may involve utilising software for administration, tracking, control, and reporting, which can be managed internally or guided by an outsourced provider.

Ultimately, BCM is vital for companies of any size. The key is to determine early on whether an in-house, outsourced, or hybrid approach is best suited to meet your requirements. The ultimate goal is to have the peace of mind that your business will not come to a standstill in the face of adversity.

About the author

Colin Jeffs MBCI moved into the realm of business continuity from IT project management where, as part of implementing IT systems, he had to implement resiliency. Colin has worked in business continuity/operational resilience and crisis management for more than 28 years, holding senior roles in these disciplines for many years at major financial institutions in the city of London. Colin now heads up Daisy’s award-winning operational resilience consulting and software division.