Rawpixel.com - stock.adobe.com
Change management in business continuity
Change management and business continuity share a common goal: Preventing future disruptions. Find out where change management fits into business continuity planning here.
Change management requires an organization to use careful planning and analysis before introducing changes. Including change management in a business continuity strategy ensures that critical plans and processes are always up to date and ready to use when a disaster strikes.
Change management is a structured process that manages changes to a product, process, or system. Changes are introduced and implemented in a controlled and coordinated manner, reducing the possibility that an organization will introduce unnecessary changes and disrupt a system or process.
Business continuity is all about avoiding disruptions. Organizations must regularly review and test business continuity plans to eliminate any faults or weaknesses. However, changes to a business continuity strategy must be made judiciously. Business continuity plans guide an organization through downtime to get operations back to normal as soon as possible. Change management ensures that any changes the organization makes to the business continuity plan and its related activities are carefully reviewed.
This article will explain how change management benefits business continuity, what the change management process looks like and how to implement change management in a business continuity strategy.
How does change management benefit business continuity?
Change management is an important process for business continuity programs for several reasons. It can deliver benefits by improving business continuity plans and updating critical information. Also, it helps avoid potential problems, such as failing to respond appropriately to an incident because the plan was not up to date.
Maintaining business continuity plans as part of an existing corporate change management program can increase the likelihood that the plans will receive the attention they deserve. Additional benefits of change management include the following:
Risk mitigation
Periodic updates to risk assessments can help identify potential threats and vulnerabilities that might not have been identified when the assessment was first conducted. This helps business continuity and disaster recovery (BCDR) teams be better prepared to respond to changes in risks.
Knowledge preservation/documentation
Business continuity activities are ongoing and should reflect the organization's current state. Change management safeguards that the plan and its associated documentation are up to date.
Recovery readiness
If BCDR plans and teams work with the most current information, and if tests are regularly conducted, the organization's readiness is likely to improve.
How change management works
There are six principal steps to the change management process:
- Identify potential changes.
- Analyze change requests.
- Evaluate requested change(s).
- Establish a plan for initiating the change.
- Implement the change(s).
- Document, test, review and close out the change process.
If an individual or group experiences an issue with the business continuity plan or its related activities, they might seek a change. Whoever requests a change to the plan must prepare and distribute a change request. This request typically goes to a project manager, who reviews it to determine its technical feasibility, costs, benefits and time frames for the proposed change.
The project manager or committee responsible for implementing changes must also determine the effects of the proposed change on the organization. The thorough nature of the change management process is critical to making sure that any proposed changes are appropriate and have been examined from all angles. Test exercises and audits can help make sure that the changes will work as planned, and can reveal any issues before the change is implemented across the organization.
Once the proper testing has been done and the change is approved, the responsible parties must update documentation, such as BCDR plans. They must then distribute details on changes to all employees and other relevant parties, such as key clients and vendors. Organizations should also schedule a follow-up review for six months to see if the changes are proceeding as planned, or if updates are needed.
While many organizations have a formal change management process, BCDR and IT teams might not always participate in the process. To keep business continuity and disaster recovery plans and their associated databases up to date, it is a good idea to include them as part of the overall change management process.
How to implement change management for business continuity
Assuming a change management process exists, taking business continuity into consideration should be relatively easy. Activities to perform include the following:
- Identify business continuity elements that are likely to need updating. This might include plans, contact lists, emergency resource lists, alternate work locations, schedules, budgets, documentation, training programs and testing activities.
- Establish an internal process to identify prospective changes.
- Assign a member of the business continuity team to coordinate change-related activities.
Paul Kirvan, FBCI, CISA, is an independent consultant and technical writer with more than 35 years of experience in business continuity, disaster recovery, resilience, cybersecurity, GRC, telecom and technical writing.
