Crisis Lab Podcast Episode 8
===
Alex Fullick: [00:00:00] Executives couldn't care less that you did 40 BIAs. It means absolutely nothing to them, but it does mean something. If you report, we had 10 incidents last month, we activated business continuity plans six times. So we had zero declarations. Oh, that's good. So our plans really work. Oh, great. So there's a shift there in, in reporting and how we're presenting business continuity management.
Kyle King: Welcome back to another episode of the Chrysler podcast. I'm your host Kyle. And today we are continuing our discussion on the critical role of business continuity planning. With our guest, Mr. Alex Fuller in the first part of our discussion, we hosted on the preparing for the unexpected podcast. And by Alex himself, we discussed the macro level impact of business continuity planning on maintaining global stability and security.
We explored how business continuity plays a significant part in supporting economic stability, securing supply chains, and aiding in crisis management, as well as [00:01:00] navigating geopolitical risks. So if you haven't listened to the first episode. Then definitely go check out and subscribe to Alex's podcast, preparing for the unexpected.
It's available on any one of your preferred podcast platforms. Now, in part two of this podcast series, we will go deeper into the practical aspects of business continuity at a community level. We aim to offer some actionable insights and possibly a blueprint for local stakeholders and small businesses to demonstrate how business continuity principles can effectively be implemented and ensure resilience.
Adding more micro level. So Alex, welcome to the show. Thank you for having me. And before we get started, just I think, uh, maybe a quick background introduction from yourself and from your side, because I know you're well known on your podcast and maybe Crisis Lab has a few different listeners. So just a quick background will help us get started.
Alex Fullick: Sure. Alex Ick, I've been in business continuity, operational resilience, or whatever term you want to use these days, uh, for nearly 27 years. I remember planning for Y 2K. [00:02:00] Uh, way back when, uh, that's when I got started and I've worked with many different clients since then, financial institutions, pharmaceuticals, HR companies, marketing, doing all the business, uh, continuity aspects from business impact assessments to developing business continuity plans, disaster recovery plans, the IT side of things, crisis management, lots of testing and, uh, and, uh, the bad word.
Auditing as well, different programs that are in place seven years ago. Actually, we are about a week away and it'll be exactly seven years that I started the internet talk radio show on voiceamerica. com and about three years ago, because of the overflow and the popularity, I started the YouTube channel of the same name and here we are today.
And the nice thing is I've had you on my show and I get to be on yours. So this is quite the honor.
Kyle King: Yeah. Thanks for that. And thanks for joining us on the show. And in part one, we were discussing really these more macro [00:03:00] level issues and how business economy plays a role in terms of national security and overall global stability, and really just this.
50, 000 foot view of life as we know it. And even raise the point of even organizations, international organizations like NATO, or looking at business continuity planning, which you would think has been happening for a while and surprisingly hasn't, but it does feed into this larger recognition that's happening, especially since the Russian invasion of Ukraine, that businesses play a role in community and national resilience and that relationship between the public and private sector Is only becoming more critical, more important.
We even saw this during COVID was the supply chain crisis and everything else that is wrapped up inside of that event that we went through. And so we discussed all these things and dived into that a little bit. But I wanted to bring this down to a topic and a discussion of where we can give some practical steps from your perspective in terms of what businesses can be doing or what they [00:04:00] should be doing.
So if we've set the tone of the discussion on part one of our series and we say, okay, there's a turbulent times ahead and in crisis, it's going to be more complex and that we're looking at more frequent crisis. And what are we really looking at in terms of scaling that down in terms of our local economies and our local businesses and what should it mean for that local business owner?
And let's just start with that. And then we, how do we interpret these things and what should we be worried about? I guess I would say
Alex Fullick: it's been its name, business continuity management or planning terminology is different for everybody, but start right off the bat. If you are a one team person or a small mom and pop shop.
Business continuity. So ask yourself, how do I continue my business? Just start with yourself. If you can't start with yourself, there's no way you can look to a wider audience. How do I create networks and how do I work with other groups and things like that to, to keep businesses and the community going, if you haven't looked at [00:05:00] yourself first.
So take a look at yourself. Where are my pain points? Am I receiving all my parts or services from one supplier only? What happens if they go down? Or they have an issue or it's another mom and pop shop with only one or two people and they go away on vacation or, you know, it can be that simple. What do I do?
How do I address that? Should I look at someone else? Sometimes you, you may find another supplier and go back and forth between the two, uh, You know, to, to build that network, that supply network, but often you can just join a local, uh, chamber of commerce and then find out you attend some of the meetings and meet some of these people, meet some of your suppliers that maybe you've never met and start having those discussions.
Here's where my pain points are. Here's what's important to me and my little business and in my employees. I don't know how to address it. There's probably somebody in your chamber of commerce who can turn around, I can help you with that. Sure. That may sound like a sales pitch, but at the same time, you're also starting to build a network [00:06:00] because then you can meet other people and say, Hey, I can help you.
If that goes down, I can turn around and help you. And then you start creating that resilience and that network in your local community, in your business network. And when something does happen down the road, a fire or flood, or whatever the case may be, you can turn around and step in and say, Hey, I know how to help.
Instead of waiting for someone to call you asking, can you help? And then you're, you're sat there. What do you need? I don't know what I should do, but if you created your network and you've had some of these discussions, you know what your pain points are and what's important to you. You also know what the pain points are now and what is important to other small businesses.
And you can now step in and help. And that goes up because it's the chamber of commerce goes up to local government as well, who is obviously close with chambers of commerce. And they can then step in and say, okay, well, if something happens, Hey, we've got five different suppliers who can provide [00:07:00] fuel or can fix hydro poles.
If, um, your local provider isn't available because they're busy on a national level or a wider scale level. And there's only so many people to go around. We can create and identify these other people that can step in and help. And you have the contact information where everyone would step in and then you can.
Practice that, now that you know who all these people are, you bring them together and you practice it. You have the drills and you see them on TV, newscasts every so often, local airport has a big simulation exercise, or a company has something. Now that you've created that network, like I said, you can expand that a little bit.
Okay, it's not just the first responders now. How do we, because of the, the scenario we're using, how do we go beyond just the first responder now? Because of the impacts, how do we get these other groups involved? The Chamber of Commerce and the small mom and pop shops who have learned and created this network can now step in and say, [00:08:00] okay, here's where I would step in.
Here's all I need from you, but that takes time. And you have to develop that over time to help respond to a local situation that helps keep the community resilient. It'll help keep mom and pop shops going because they've stepped in and helped out and they've become a part of a chamber of commerce or, and it could be a different group.
I'm, I know I'm saying chamber of commerce a lot, but it could be called something different in different areas, but something along those lines, uh, what is it to business improvements? Areas, I think, are one is another group that you can look at and work and start to build that resilience and learning from each other and understanding what each other does and understanding how.
That business down the street impacts me. There's no way I think a small mom and pop shop is going to do a big business impact assessment and risk assessments and things like that. They, they don't have the resources for that and [00:09:00] they don't have the financial resources to pay someone to do it for them.
So it's really on a personal level, you have to start with yourself to reach out. And start meeting some of these people in these groups, join them. They're usually non profit groups, so you can, you'll learn a lot from them. And that's, that I think is a good starting point for everybody.
Kyle King: As I was listening to you explain that, the first thought that came to my mind, because we do a lot of work internationally, and when we go to a lot of cities, and we've had a real significant interest in cities lately in terms of how we implement national sort of security policy and resilience policy and all that.
And it's interesting because when you're saying go out to the local chamber of commerce, which is one, Well, probably many resources there to reach out to in your community, especially if you're a small business owner. The question popped up in my head, which was, okay, but who's really responsible for that from like a city perspective?
And then there's always, maybe always is too tough of a term, but there's seems to be a, um, a lasting divide, I guess I would say, [00:10:00] in terms of public private entities. And so there's the sort of continuity of government planning with the city administrations and continuity of services. And then we have the private sector and business continuity piece.
Who's responsibility is it in your view to bring these things ultimately together? Because I understand your point of, okay, if I'm a small business owner, I want to reach out because I care about my own business and my own ability to recover from a business or a disaster, I should say, and that my business services continue during a disaster and maybe contribute to recovery of a community.
But ultimately who's pulling all of these various different strands of efforts together at the end of the day?
Alex Fullick: I think it's a shared responsibility. I don't think we can expect local government to do everything. That's impossible. They're looking at the wider perspective of things. And I know we elect officials to represent ourselves, but they're in some of these cities.
[00:11:00] One representative is representing tens of thousands, if not more, people, and that would include, I don't think one person or one area can actually do that. I think it's a combination of local officials, and many local governments have an emergency response team of some sort. They, I know my city here in Guelph, Ontario, Canada, we have a local, I forget their name because they changed their name a little while ago and I keep calling it something else, but they have a local preparedness where they give a direction to small businesses via the chamber of commerce.
They have things on their website that for people to read, follow, whether it be on an individual level or small business level, things that you can learn, do, expectations, some of the things like that. But then it's also on me as a small business owner to go do that. I can't expect that one representative, that director [00:12:00] of that emergency management group To reach every single business, every single individual.
So it has to be a shared responsibility to do that. And it takes some kind of looking in the mirror sometimes to understand that, you know what I do at the first, what's, what's this stat? I think it's, uh, first 72 hours, if I'm not mistaken, I've got to be responsible for myself. So if there is something that happens after 72 hours, I have to take that initiative.
So I have to look into what these plans say, how I can prepare, whether it be a business continuity plan or whether it be a just sit safe, but what do I do in that 72 hours? What should I have on hand? In those 72 hours, how do I contribute? I have to take that initiative. Then after a time, if you've created that network, like I said earlier on, then you can start building that together.
You can reach out to your local fire department when you're having a small [00:13:00] test or, Hey, how do I become a part of. One of your simulation tests that you have downtown where you evacuated city hall and you have people with fake blood on them. How do I get involved with that? Just sometimes it could be fun, but you're going to learn a heck of a lot.
And I, so I think it can't really be on one specific. I think it has to be, uh, a joint effort in business continuity. We say you have to build a network. between, if you're in an organization, between all the vice presidents and the managers and getting them to understand what each other does and their dependencies between each other and understanding that, hey, when I finished this service, I had no idea you pick it up.
And you take on and do this piece. I'm just aware of mine, but you create that network where everyone understands. So if you can step out and learn what these websites say on government sites, and the government provides some guidance, whether it be local, provincial, state, federal. Provide some of these [00:14:00] resources.
They can only go so far. So you really do have to look at yourself and reach out to learn what some of this stuff is to be able to move forward. I don't think one person or one area is responsible. I know at the end of the day on the headlines, it's going to say the government didn't do this and that, but it's like leading, you can lead a horse to water and you can't make them drink.
They can only provide so much that at some point I have to step up and do something for myself too, whether a business owner, a contractor, whatever. I have to make some of my own decisions and learn things for myself, and then that will help bring those together because the more I learn, the more questions I'm going to have, the more I'll get involved, the more government can then turn around and say, yeah, hey, we do have this, we do have that, and hey, we have this training program that I may never have known about, so I, I don't think it's one side Or the other.
We both have to work together, the individual or small business side. [00:15:00]
Kyle King: Hey there, just a quick pause in our show for a second. Did you know that most of our guests on the Crisis Lab podcast have courses inside of Crisis Lab? And so if you're finding value in these conversations or they pique your interest and want to dive deeper into the topic, just head over to crisislab.
io for more information. Our courses, webinars, and resources are all designed to equip professionals just like you with the knowledge needed to succeed. Navigate complex and changing environments. And we recognize that your time matters. So everything we do is accredited. So don't forget to subscribe and join our community of over 17, 000 professionals who follow crisis lab and are committed to enhancing preparedness and strategic thinking, because at crisis lab, we believe in empowering you with cross domain knowledge and learning blended with international perspectives.
Which is going to ultimately make you better every single day. Now, let's get back to the show. And I think, and we hit on this last time, but as we're starting to see more complex crisis and more frequent crisis, large scale disasters, hurricanes, what's happening now in the U. S. at the end of the hurricane season, there's obviously this aspect of [00:16:00] the 72 hours and you have to take care of yourself, but there's I think of growing consensus that it's beyond 72 hours these days.
So the more complex the crisis, the more that, okay, maybe it's just a power outage for 72 hours, but maybe you lose internet connectivity for a week. Right. Or whatever the case is, or maybe you need to filter your water and boil your water for two weeks. It doesn't all just get resolved at once. And so with that and, and the, the continuity of services from the city.
And as you're talking about on the business continuity side, wanting to take an active role or participate in your own community resilience, business continuity and was really, at least in my perspective, really driven around that economic resilience piece, especially if we didn't have an issue of economic resilience or needing to be resilient with our business.
And we could essentially close the doors for two months and wait for recovery and then reopen back up. But that's just, it's not the case for the vast majority of small businesses in the United States or Canada or anywhere else in the world. And so when we look at that and you start to see that [00:17:00] small business and business in general, private sector is really a key component of community resilience and economic stability.
But while I am a business owner, I am interested in, in maintaining my own revenue and keeping that consistent and having continuity of operation. There is our workforce. And so the workforce as well. So you mentioned before about understanding each other's positions, especially at more managerial leadership positions and trying to build out that common operational picture.
But what do we do as a business owner? If I do want to say, I'm getting engaged at the city level, I'm starting to figure out how things work, what the limitations are, which is also very important. And I have a desire to maintain my business operations during. A very stressful times, but I do have a workforce.
So what are some of the things that I should be looking at with specifically for the workforce that are things that would need to take care of?
Alex Fullick: There's two, there's the workforce activity side of it, and there's the workforce people side of it. I'll do the activity side first. [00:18:00] A lot of organizations, if you're a small business, and I, like I said earlier, this wouldn't be for mom and pop shops of one, two, three, four, five.
Five people. But if you're a small business with 50 people, even a small manufacturer or something like that, understand what it is you're doing. Perform a business impact assessment or whatever you want to call it. Sometimes people don't like to use that term anymore, or they say, don't do it. However you do it, understand what you do and understand how it all links together and not look at it from the point of here's what finance does.
And here's why finance is critical. Here's what we do. And here's what's critical to the organization. You'll break down those silos because a lot of times people just don't want to give up their, they think they are giving up their control if they provide too much information in their area, but really they're causing a hindrance.
You want to know what you do and you want to know how you keep doing [00:19:00] it so that one, you can still be operational, depending on what happens. Or if there is an impact, know how to get up and running as fast as possible, who needs to be involved, what skill sets need to be involved. And it's not a case of who's critical and who's not.
It's who do I need right away that has that skill set I need so that the rest of you then can then do your, your daily activities. You know, somebody who can rebuild a mainframe or a server when there's a technology outage or a little fire or something. Okay, you're going to need that person right away, but that doesn't mean someone who's doing data entry is not critical.
It just means that person has to wait until this other one is done. And unfortunately, a lot of times people look at things that way, which creates. Some internal turmoil is who's critical, who's not. No one wants to be told they're not critical. And then that comes down to the people side, where you've got to look at, at, um, the mental health [00:20:00] and how people behave.
You look at the organizational culture of what's going on. There's the operational resilience, which is all the plans and processes and systems, et cetera, and dependencies between groups, et cetera, et cetera. You can expand that all you want. And there's The organizational resilience part of it, which is the people and the culture.
And you've got to look at that as well. And I think sometimes organizations and leadership mix the two together and you have to You, you can't, they're two different things. I may provide plans and processes. We may test and exercise and build your capabilities, but yet I give no one any decision capabilities.
I don't really support or praise people. I don't walk around the floor and smile and go and get to know my employees. That's the culture side of it. If I'm only addressing one side of it, the other side is going to fail. If I'm too lovey dovey on one side, we're not going to have the right plans and processes in place.
If I look at plans and processes to put in [00:21:00] place so that I address a regulation or a compliance concern, And I'm not focusing on people, then I'm just doing a tick box exercise and people are going to participate and they're not going to be involved. And no matter what you have sitting on the shelf, it's not going to end up helping you because no one's going to care or support it.
So you have to look at both sides of this, the people side and the activity side of it. And bring it all together. Break down the silos and not point out that, hey, You're critical. You're not critical. I, I don't think we should be using that word. We just prioritize what it is we need to do so that we can continue to do what we do when we have an adverse situation.
And I think that some of that has to start from the top. I'm a firm believer that if you are a leader and you're not resilient yourself or you have your head on straight, then guess what's going to happen to your organization? They're not going to follow things. They're not going to be resilient. And then when something does happen, they're not going to be in a position to help somebody else.
They're [00:22:00] not going to be in a position to help themselves. And they're not going to be in a position when they get a call from local government to say, Hey, we need your assistance. It's going to be a mad scramble. But if you're highly respected by Each other, the finance VP has respect for the IT VP who has respect for the sales and marketing VP.
And they all get along. They all understand, Hey, I can't do my stuff until you've done yours. So I'm okay. I'm ready to go. What do you need for me? Working together on that level, then the employees will feel good. The you'll have a good reputation in your neighborhood or your community. And you can be looked at.
As somebody, Hey, we need your help. Or you've already stepped in. Like we said earlier on, maybe we've already gone that route and looked at things in the community where you can help and what you can learn from it. So you really got to take a look at yourselves and both sides, the activity and the people side of things for business continuity to really work and practice what you're doing too.
[00:23:00] I don't know if you've noticed, but there's a lot of articles on LinkedIn and different trade magazines and websites. Talking about testing and exercising now, and I look at testing as plans and processes, exercising as people. We exercise our minds and our knowledge and our skills and things like that, and that actually helps create resilience.
You don't have to have these huge simulation exercises where you, somebody walks in and unplugs the whole server rack. You don't have to go that far, but you can sit around a table and bring different people together and start talking through, Hey, what would we do? And you start identifying assumptions and dependencies.
Sometimes things you didn't even know because you're bringing people together that sometimes may not have even worked with each other before. I had no idea. Oh, you do that? Yeah. I thought that came from so and so. No, that comes from us. Oh, my God. I've been thinking about this wrong. And you start identifying all this stuff that you can then take.[00:24:00]
The business continuity person can then take and say, let's address this assumption then. Oh, here, let's identify this dependency. So if something happens internally, we're better prepared now. And because tabletops, you can have a bunch of small ones. You don't have to have These big, massive things, identify and bring in different people together and you're addressing some of this, update your continuity plan or your crisis management plan or emergency management plan.
I remember a long time ago, we were putting an emergency response plan together for a facility. And I got talking with the facility manager and he goes, we already have one of these. But I just received a directive from my VP to have this plan in place, but we already have it. And I said, why am I recreating the wheel?
I think let's follow yours. I'll just link to whatever you're doing in business continuity. And if we had done that, we would have, if we hadn't have done that, we would have had two different plans conflicting. So you really have to take a look and bring [00:25:00] everything together and understand, create that network internally, and then you can create that network externally.
Kyle King: So we've got the, we've got the people, we have the processes, there's a desire, let's say from a leadership that we want to be prepared, not only for our own economic well being for our business and to stay in business, but also as a contribution to the community. And I just, I pulled up a stat really quick, which was that.
The U. S. government contracted or awarded 178. 6 billion in federal contracts to small businesses in the U. S. in 2023, which is a substantial amount of money, not even just including normal private sector business, B2B2C, things like that, but that's a large portion of government contracting, which means there's a large foundation of small businesses that are providing services to the government, and that thereby contributes to overall national government functioning and national security and all these things that we talked about.
But coming back to you, to your point, uh, I do want to touch on the training, the education piece, but before that we've established the, the operations piece and the processes [00:26:00] and, and so the people in processes. But if I'm starting out and I'm just looking at this now, and where would I go to find information on what are the actual threats to my business?
We've talked about the community. We talked about maybe there's different threats for every different community. I can tell you. Living in Europe that tornadoes are pretty rare, but if you're in the Midwest, the United States, maybe not so much. Right. And so this is where, you know, the threats and the environments and the risks are all very different.
But where would I start it just as a business owner and trying to understand the things that I need to plan for.
Alex Fullick: You can start with, depending on the size of your business and how you're configured. And if you've got the resources, a risk assessment, just sit there. And what can go wrong here? What could possibly go wrong?
Whether it be missing people, whether it be a tornado, if you are in the Northwestern Ontario, Canada, no, a tornado never gets that far because. It's never warm enough to even have a tornado. You, but snowstorms? Yeah. [00:27:00] Okay. Yeah, we can be. Oh, we get a lot of product from Taiwan. Is there an issue there considering geopolitical aspects?
But sit there and identify things that could go wrong, no matter how bizarre it may sound. There, this sounds awful, but there was a time when I started. People used to make jokes saying, Oh, what if an airplane crashes into your building? Oh yeah. Like that's going to happen. Oh yeah. Okay. And we move on. Is that a joke anymore?
So no matter how bizarre it may sound, just sit there and identify a bunch of things and then rank and find out, okay, what has the biggest impact? Oh, a snowstorm has the biggest impact, or Hey, this product that comes from Taiwan has the biggest impact. Can we get it from someone else that's closer? That may be a, not so risky or that we have run the risk of not getting that product anymore and identifying that.
So a risk assessment of some [00:28:00] sort, whether it be just sitting around a table, identifying things or having a formal spreadsheet or software, whatever you can afford, whatever your resources are, and then just identifying the things you can address, putting mitigating factors in place, Hey, you know what? Uh, this And it's not just cost, I can get this other piece from this other company because it's cheaper.
Yeah, but it may be cheaper, but the risk may go up too. Oh yeah, it's cheaper, but it comes from Taiwan. So maybe I want to get this other one that's from the other side of the country instead. So just start there. Understand where you're, and I said it earlier, your pain points. Understand where they are.
What could impact me? Who could impact me? And. Then start, use that as your starting spot to, to build either a contingency plan. Here's what I would do, or a mitigation plan. If this happens, then I've got this in place. I can go here and do something different to retain my product or service from somebody else, but start [00:29:00] with just identifying what could go wrong in your business and you don't have to be huge.
To be able to do that, you can be a one, two person shop and just sit there. Okay. What could go wrong? We are a small place. What could happen if I don't get this sheet metal from, uh, Calgary, Alberta? What happens if I can't get that sheet metal? Oh, I can get it from, uh, a place in Illinois. Okay. Then that'll be our alternative.
We'll put that in place and it doesn't take a lot of effort, a bunch of stickies and just a conversation between a few people and under, if you're a little larger, you may have somebody who is already in charge of enterprise risk management and may have things already identified that are key risks to the organization.
Because those items are being reported on to the, either if there's a board of directors, a board of directors, or at least the president, and she will be aware of what's going on. So. Take a look, if there is something in place, take a look at [00:30:00] what's there already and how you contribute and what you do that contributes to those risks on that register, the enterprise risk, uh, register, or if you're really small, sit around a table and say, what could go wrong?
What could impact us? And just start spit balling ideas and then understand the priorities of what you can mitigate, what you have control over and what you don't have control over. Sometimes that's a big thing to identify too, is I have no control over what's going to happen in Taiwan. No, you don't, but you do have control of that product that you get from Taiwan.
So how should you address that? So that's where I start. And of course there's information sites out there. You just do a Google search and you'll find all kinds of organizations that can help with risk templates or risk assessments and things like that. And in business continuity, risk assessments is a core.
Piece of the overall framework [00:31:00] for business continuity. So you can go to disaster recovery Institute or the business continuity Institute and other places like that. And they have things that can help you start free templates as well. And that's the best place to start is just understanding what could go wrong.
Kyle King: Hey, there, just a quick pause in our show for a second. Did you know that most of our guests on the crisis lab podcast had courses inside of crisis lab. And so if you're finding value in these conversations, or they pique your interest and want to dive deeper into the topic, just To crisis lab. io for more information, our courses, webinars, and resources are all designed to equip professionals just like you with the knowledge needed to navigate complex and changing environments.
And we recognize that your time matters. So everything we do is accredited. So don't forget to subscribe and join our community of over 17, 000 professionals who follow crisis lab and are committed to enhancing preparedness and strategic thinking. Because at crisis lab, we believe in empowering you with cross domain knowledge and learning blended with international perspectives, which is going to ultimately make you better.
Every single day. Now let's get back to the show.[00:32:00]
Yeah, absolutely. And I think you made a couple of really good points there, which is one, if you are large enough or in a large enough organization, there's this issue of sort of perspectives, like different departments will have different perceptions of risk and in what they would prioritize. And that's a very important conversation to have.
And then what's always helped me in my career is just hearing what other organizations are doing. And then add to your previous point about, so go to the, for example, the local chamber of commerce, meet with other businesses and that are, you know, equal size or maybe even larger and understand what they think are risks because maybe they've done a lot of work in that area.
And I tend to say, right or wrong, there's no plagiarism in policy, right? If they are planning for risk and it's an earthquake, there's nothing wrong with using that same risk in your own planning. These are common things across the community. And so I think that's where you can also get some added value and, and as well as the different institutions that you mentioned and organizations which have these templates out there.
I think that's [00:33:00] also really. Important as well, and also informative and you, you did mention the supply chain and we've seen this, I think we touched on it in our last discussion that the risk with the supply chain ship gets stuck in the Suez canal or the Red Sea issues with the Houthis or whatever the case is, prolonged shipping times, the increasing cost of shipping or just geopolitical tensions overall can have a real impact in our supply chains.
And you mentioned Taiwan, which is, you know, if you need a semiconductor, you might want to see how you can diversify. Bye. Bye. That's actually what I was thinking. Exactly. And so there's all these things that are out there that at least we can start having these discussions to try and just at least initially work through these problems so that we can put ourselves in a better position, but once we've done all that, let's get into that next step of this training and education piece.
And you mentioned that earlier, and I want to come back to that because there's different ideas of training education. Some people call training and education, the same thing. Some people have different views on what that means, but from your perspective in the world of business continuity, when we. Have done all this [00:34:00] work.
And now we want to get into sort of training our workforce. And so we want to bring this up and raise our sort of awareness and understanding across the workforce. You mentioned the training and the education piece, what would that look like for you and your perspective?
Alex Fullick: The training is the doing the awareness is just knowing I'm not a big fan of things like lunch and learns because when you hold a lunch and learn, and I'm guilty of this myself.
You really want the managers to show up or the senior executives so that you can then say, Hey, here's what business continuity is. Here's how we show value. Here's what we do, et cetera, et cetera. But you usually end up with people that just want a free lunch. So I'm not a big fan of some of those, unless you tailor them to specific audiences.
But it's still good on the other hand, to still get that message out there, because at some point, business continuity, and it should be, shouldn't just approach managers and senior managers for information. You [00:35:00] should approach those that are the doers, the everyday doers of activities, because they will know some nuances managers won't.
So if you do have awareness sessions. Follow up when you've met these people and say, Hey, I'd like to know more about how you do that data entry for buying a new car or something. What does that entail? Understand that. So that on one level you're learning, but that person that does that work is starting to understand what it is, how they contribute to your business continuity program.
And the education part is the doing get everybody involved with tests, review plans, participate in tabletops or real simulations, whatever they may be, get them actually doing things because. You can have a plan all you want, but when you sit there and you've got someone rebuilding a server or they're rebuilding a mainframe and, or they've got tapes being loaded, if you're still [00:36:00] doing that, they're learning and say, Hey, these have to be in a certain order.
No, we can't just take this box and start loading tapes. We actually have to go in a certain order. Oh, really? The plan just says load tapes, but you can't do that. So. You're getting them thinking, you're updating your plans as well. And when you actually do have a situation, they know in advance, no, this is the order it has to go in.
The, this is how we do it. So instead of trying to figure it out at that time, people know right off the bat. No, here's what I need to do. Here's what I have to consider. And that's all aspects too. It's not just, I know I'm using the example of rebuilding a mainframe or servers here, but it's also the crisis management piece or the, you know,
When IT is up and running and they say, Hey, all the pretty green lights are on business, go validate that what is what you're expecting to see, and that you can do a transaction, or you can [00:37:00] pull a report, the things that you identified as being a high priority that need to be up and running first, can you still do that?
So now you bring people in who practice that. Okay, now I'm, I don't have a regular desktop, I've been given something different, it looks different. Because the normal look may be changed as a result of rebuilding a network or reactivating something, do they know where to go? Do they know how to access something a little bit differently?
I had a situation where we did a large simulation test, east side and a business side of things. When IT was done, business came in and they wanted to make sure all those desktops have shortcuts to our various systems that we're going to use. And we go, does IT do that for you now? No. And I go, well, why would we do it in a test?
This is now a way to figure out how do we address that gap you just identified. If people don't know how to get there, but we wouldn't have done that by talking. We would have [00:38:00] only known that by doing, and that's the part that I think is really key doing the tests and exercising and all aspects, communications, what part of a status report.
Do I need to provide up the level so that the crisis manager or whoever is designated, you know, in charge knows what's going on in my area, knows the challenges I'm experiencing, or has a decision that I need them to make the doing part. And it also gets people talking to each other. Then the server team who is now loading up all these applications that need to be there, need to be validated by the business team because they don't have access to the data, but business does.
Validate, are you seeing what you need to see? Is this operating the way you expect it to operate? And that's how you build the resiliency because, believe it or not, if you do that enough times, that plan starts to become a guide, rather than the actual [00:39:00] Bible, so to speak. Because now people have got it in their head.
They understand their role, their responsibilities, when they need to communicate, what they need to communicate and what their specific responsibility is to do, whatever it may be, whether check data or balance a worksheet or something, when data comes up, whatever the case may be. Now they know, instead of trying to figure it out at that time and the plan, which may have outlined all these different things, People now know what's in the plan.
So the binder doesn't come out anymore or rarely comes out because now people know what's in the binder. You still have to maintain it and identify gaps and things like that, because you can't always assume that the person who just learned and identified this gap is the same person who's going to be available when something occurs.
So you'll still need to refer back to the binder at some point, instead of it being in the driver's seat, it takes a backseat because now the people. Are the drivers [00:40:00] and that's, that's why testing is becoming so important these days to create that resilience and you can pull in different people all the time.
Every time you do a simulation, use different people, or you have shadow. If I am doing, I'm balancing spreadsheets for finance or something based on data that was just recreated for me. I have someone over my shoulder that I'm teaching to do this. Don't assume like I'm going to be here next time. It could be you.
Yeah. That needs to be there. Or if it's a long duration, you're going to implement shift management over a real disaster. So you may do that, simulate that in the test as well. How do I hand off this information? What I'm doing to somebody else? I've been doing it for 12, 12 hours. I'm falling asleep. How do I hand off?
What do I, what information do I need to teach this person? What do they need to know? So teaching, I find is, is great. And the more you do that, the greater awareness gets created as well. So it becomes a nice circle. But [00:41:00] if you just start with awareness, uh, with Lunch and Learns, like I did at the beginning, you're not going to get far unless you actually follow up on those lessons learned.
And those lunch and learned things, people will appreciate the free pizza, but did they pick up anything out of it? And did you pick up anything out of
Kyle King: it? I think that's some valuable insight. The more that we can make our procedures and our policies align with what we would do during a crisis, as you mentioned, as things become indoctrinated, as they become part of our SOPs and policies in a company, and the more that our line they are to our sort of crisis management plans or business continuity plans.
The easier it's going to be for our people to fall into place and to be able to follow these if something actually happens, as opposed from, you just said, pull out the plan off the shelf and be like, this doesn't sound anything like what we normally do, and then have something completely opposite. The closer that we can get to reality in terms of our daily practices, then I think that's the best spot to put ourselves in to where then it's in a [00:42:00] contingency plan.
And maybe it's just slightly different. You're reporting somebody else or getting permissions from somebody else. Or working through different channels, but this, the thought process is very much the same.
Alex Fullick: Yeah. Then you become more adaptable to the situation itself because you've practiced under control circumstances.
You've got to challenge some assumptions. You have to learn different things and understand different people that are involved, then a different situation comes along and you're better prepared to. Okay. It's not that person. It's this person I have to go to, or I can't do it that way under this situation.
Oh, but I know how to do it under this other way. So the more practice you make, the better you're adaptable and agile. You become two different situations that occur and your response times instead of let's say 24 hours to, to respond to something starts getting shorter. We can actually respond now in 12 hours, the more couple of years later, and you've done more and more practice.
Hey, we can actually respond. We have plans and [00:43:00] processes in place. Now we can respond in four hours. That's a lot better than 24 hours. A lot can get said about you and your organization and the impact on the community from four hours to 24 hours. There's a big difference between those.
Kyle King: Yeah, absolutely.
And so we're getting close to our time, but I did want to ask a question, bringing it back up, maybe not as high as the macro levels we were talking about before on part one, but when you're looking across your space and business continuity now, what are the things that you're seeing? You mentioned testing and now that's becoming a trending topic, but what else are you seeing that we should be aware of?
I know
Alex Fullick: we've touched on a bunch of stuff, so I won't recreate, uh, or restate any of that, but one of the things that's happening now is I like to use the analogy of a wheel at one point, business continuity was one of the spokes in the wheel, what I'm seeing now over the last [00:44:00] year or two, especially since COVID, of course, is business continuity management is becoming the hub for Of the wheel where it's bringing together all these different people to help break down silos, to understand how everybody works together and what each other's expectations are and knowing that, Hey, if Kyle has a question about, uh, finance, I know who Kyle can go see to address Kyle's question rather than Kyle trying to figure out.
Yeah, endless emails. Who do I go to for this? Oh, who's this? Business continuity is starting to get looked at. I hope for many organizations as a wealth of knowledge and a real business partner of a proactive business partner who can bring people together and address what needs to get done and identify things.
That, uh, we see in the paper, we may see a, uh, a flood in, there's floods in China right now, uh, quite a few [00:45:00] happening with the rainstorms. Hey, we, we're not that far away from a flood plain. What if we flood here and bringing that back to your own organization? And say proactively identifying, would we be okay, is there anything we need to consider proactive measures and also seeing that it's, I've already mentioned the test and exercising, that's a big piece, but, and we've already mentioned the supply chain, but also understanding how we link to the overall strategy of the organization, instead of being looked at as business continuity management is response, something has to happen before business continuity gets involved, we're changing that to Let's get involved earlier, proactively identify things, make those relationships with the enterprise risk manager.
If we're reporting, let's get the right reporting and the metrics in place so that it's understandable and aligns to executive expectations. Executives couldn't care less that you [00:46:00] did 40 BIAs. It means absolutely nothing to them. But it does mean something if you report, we had 10 incidents last month, We activated business continuity plans six times.
So we had zero declarations. Oh, that's good. So our plans really worked great. So there's a shift there in, in reporting and how we're presenting business continuity management. And I think that's something that we'll be continuing over the next little while is aligning to strategy, not just the tactics of doing a test or a business continuity plan or a BIA, or even the risk assessment.
But I mentioned at the beginning, so I think that's some of the big shifts that are happening right now.
Kyle King: Thanks for that, Alex. I think that was really helpful to understand the landscape that we're facing and some of the things that we're looking at in terms of business continuity. So if somebody wanted to reach out to you and get in touch with you, what's the best way to do that?
Alex Fullick: LinkedIn, I'm the only Alex Fulick there, so I'm [00:47:00] really easy to find. Actually, I say this at the beginning of every show. I'm, if you want to find me, I'm on LinkedIn. I'm the only Alex Fulick there and I'm easy to find and I respond to everything I get.
Kyle King: Perfect. Thanks for that. And of course, any listeners who haven't done so already, please go over to Preparing for the Unexpected and subscribe to Alex's show, both on podcast form and on YouTube.
Is that right? Yes. Yep. Both. All right. Even better. Alex, thanks for joining us again today. It was really interesting discussion. I'm so happy that we did this part one, part two series and started. Talked at a more macro level and the impact and all these sort of global challenges that we're facing and then bringing it really back down to what we can do individually at a business level and how we can take care of our people.
As well, their own economic stability. So thanks for joining us.
Alex Fullick: But thanks for having me. It's fun to be on the other side of the microphone now and then.
Kyle King: All right. Thanks a lot. And that's all the time we have for today. And again, a huge thanks to our guest, Mr. Alex Fulich for sharing his knowledge and experience as we discuss the ever relevant topic of business continuity.
And to our listeners, [00:48:00] thank you for tuning in to the crisis lab podcast. We hope that today's episode has provided you with new insights and perspectives to better navigate the challenges in your own field. Remember, each episode is a step towards mastering the complexities of crisis management, and we're here to share the knowledge and support you.
If you're not subscribed already, head over to your preferred platform, hit subscribe, and keep up to date with our latest episodes. And, for more resources and to become part of the 17, 000 professionals following Crisis Lab, head over to crisislab. io, and make sure you follow us on social media, LinkedIn, and YouTube.
And lastly, if you haven't heard about it already, we have an All Access Pass. It's the opportunity to lock in your personal data. Pricing for 2024. And you'll get 20 accredited courses released during the year, along with 10 CEUs and even access to a NATO certificate. If you attend the NATO crisis management and disaster response course, so lock in your costs now, lock in those prices as they will go up every single year.
And until next time, stay prepared, stay resilient, and let's continue to make a difference together. [00:49:00] Thanks for listening.
