Business, Interrupted: Scaling Business Continuity Through Shared Ownership

When it comes to scaling your business continuity program, there’s no one tried-and-true way to do it. Scaling depends on a range of factors, many of which are unique and specific to your organization, products, the market, and your customers.

While that’s true, there are some general best practices you can consider to guide your business continuity program so it can flex alongside your organization’s changing and evolving needs.

That’s what we talked about recently with Scott Baldwin, Head of Enterprise Resilience at Netflix during the fourth episode of season two of Castellan’s podcast, “Business, Interrupted.”

Carrying the Business Continuity Burden

Many business continuity practitioners often feel the full responsibility of maintaining their organization’s business operations in a crisis falls squarely on their shoulders—and their shoulders alone.

That’s not surprising for anyone who’s managed a crisis or disruption. Often, when operations come to a halt, people will turn to you and ask, “what do we do?” even if you’ve had extensive planning and exercises to manage this exact moment.

But, the good news is. That doesn’t have to be our industry’s present or future. There is a much better way.

For Scott Baldwin, that better way focuses on transferring responsibility for organizational resilience to the actual stakeholders.

Instead of leaving the next event up in the air for your resilience management team to handle, that shift in focus empowers real stakeholders to be able to respond and adapt—and in the best cases anticipate—disruptions. From there, your resilience management team can evolve as a resource that both educates and equips those stakeholders with all of the tools, knowledge, and resources they need. It’s a break away from traditional business continuity methods, moving toward a more holistic approach that unites program goals with the organizational strategy and direction.

Career Lessons

For Baldwin, this was one of the biggest lessons of his career.

When Baldwin first got into business continuity, he worked for a well-known, large scale financial institution that’s heavily regulated. That means a lot of review from auditors to ensure business continuity meets standards and follows best practices and required frameworks.

But when Baldwin switched positions and went to work for a well-known online marketplace he quickly learned that traditional approach just doesn’t work within a rapidly scaling organization.

“Traditionally, the way people run these programs is you have a central group and they go out, they have a schedule January through December,” Baldwin explained. “You go and you would approach different departments and you make sure that they have their plans and their exercises, and you do that all year.”

Then, at the start of the next year, you rinse and repeat.

“The problem is, it’s not scalable at all,” Baldwin said. “If you cannot do the whole enterprise in that 12 months, you have to hire more people in order to do that.”

If anything goes off schedule during that time, such as an actual unexpected event, then the entire process gets behind and you’re constantly playing catchup instead of planning forward. It’s a difficult way to manage business continuity for modern businesses.

Instead, it’s about using those standards and best practices to develop those bend-but-not-break resilience management programs that help your organization maintain operational resilience, regardless of event type or complexity.

“Now, from that point forward, I was always trying to do things differently in a way that achieves the objectives that we were trying to achieve, but we didn’t necessarily need to do the things the way that everyone else did,” Baldwin said.

Flipping the Ownership Script

For those traditional business continuity programs, it’s long been the method for a business continuity team to approach each department/team and get them thinking about doing routine business continuity planning. Frankly, it’s often a process non-continuity professionals dread.

So, how can you flip the script on that approach?

For Baldwin, it was about building understanding and engagement. It was about changing the way his teams thought about program ownership. Instead of full responsibility falling onto the business continuity program manager or team, he worked with his executives to make resiliency everyone’s objective.

It was also about building collaboration and instead of seeing business continuity as a requirement, shifting focus to where team members understood it’s critical for everyone to help with the program and that the business continuity team is there to provide the education, tools, and support to make that happen.

“It completely changed the engagement—the dynamics of that relationship—where we are then helping them. And instead of them rolling their eyes and being upset that we were coming to approach them, they’re now grateful for our help.”

Building Engagement

Learning to prioritize things differently within an industry that’s long done things in relatively methodical ways is not without challenges, but these are challenges every business continuity professional can overcome.

Baldwin suggests starting out by asking, why does this program exist? What’s its goal? Is it here primarily to meet regulatory requirements? Is there a specific event type our organization wants to be able to handle? Is operational resilience considered?

“There is no one way to do it,” he said. “There are the best ways for the culture and for the organization and for the objectives. And if I had known that earlier in my career, I think I could have been more effective earlier in identifying maybe a better way of making the organization prepared.”

He also recommends not getting bogged down in the details of the ways you think things have to be done and to remember that best practices are recommendations. Strong programs take those best practices into account, adapt, and flex.

 “Look ahead,” he said. “See how you can integrate resilience.”

That means making a shift away from traditional business continuity practices that focus mostly on recovery to more focus on availability and responsiveness.

Want to hear more from Scott Baldwin and explore how you can evolve your business continuity program into one that’s more focused on resilience? Listen to the full episode, “Scaling Business Continuity Through Shared Ownership with Scott Baldwin,” which is available on the Castellan website or wherever you listen to your favorite podcasts.