Lots of things! You’re dealing with people, your measures aren’t robust, you don’t know if things are actually getting better, you don’t have the time to investigate properly, and you certainly do not have the time to celebrate. And of course, nobody wants to amend the process as we all operate using the PDCA method –Please Don’t Change Anything!

In this article, we highlight simple things that an organisation might try, some practical tips for continual improvement. And this can be applied across the organisation as a whole or to single departments or individual processes.

1. Decide what it is you do, and your objective.

What is it that your organisation does? Try and put this into a simple statement and be as specific as you can. Don’t say “we want to be the best” or “we want to delight our customers”; say things like “we answer our phone within three rings” or “we clean up after ourselves”.

Recently, I was helping a transport business and I introduced them to the term DIFOT (delivered in full on time). However for this business, the term did not adequately capture the essence of what they did. They needed to include “undamaged” and “to the correct address”. So their overarching objective became:

All Items delivered undamaged on time and to the correct address.

This is not as succinct as DIFOT, but it does better represent what they do.

2. Measure it.

There is the old saying: ”If you can’t measure it, you can’t improve it” from management guru Dr. Peter Drucker. There are of course people who disagree, but I think Drucker is onto something. Measure how the organisation is performing against what it has decided it does – and in the example I used above, this means measuring things like time of delivery, damage, correct address and quantity delivered.
In many cases, the information is already available, so it’s simply a case of accessing it. And just pick the main measures. Many organisations collect far too much data, then do nothing (absolutely nothing!) with it.

3. Involve your people.

Once you sort out which measures are needed, have those who are directly involved collect and collate the data. This involvement will not only interest them but it will also motivate them – and if you don’t believe me, look up “The Hawthorne Effect” and the research done by Elton Mayo at the Hawthorne Works (a Western Electric factory near Chicago) in 1924-1932.

A crucial element in Mayo’s findings was the effect that people working in groups had on each individual.

4. Make it visible.

Have those people collecting the data clearly display the results up on the wall on visual indicator boards. Using whiteboards and coloured marker pens, they can graph and plot the data to show where things are improving (or getting worse). Nowadays some people use monitors or data projectors, but (and this is the key) the monitors or the projected images need to be big and clear so that everyone can see the information. The information should not be buried in a spreadsheet and require a login for someone to view. It needs to be big, it needs to be clear, and it needs to be visible to all.

By displaying the information out in the open and by using colours (green for good and red for less good), it will be clear for all to see what is working well and what is not.

5. Lock it in.

Once the team has worked out what works and therefore what should be changed, the changes need to be locked in. In many cases, this means updating a procedure and re-issuing it to those who need it – but does that really mean that the change has been locked in? The Japanese use the term ‘Poka Yoke’ which means mistake proofing; and in the OHS hierarchy of control, an engineering control sits higher than an administrative control. So do something that actually locks the change in rather than just changing something in a document that most probably nobody will read anyway.

‘Poka Yoke’ was invented in the 1960’s by a Japanese engineer called Shigeo Shingo, author of the brilliant book “Zero Quality Control: Source Inspection and the Poka-yoke System”.

6. Celebrate the win.

I don’t know why, but for many people, celebrating a win seems quite hard to do – and it shouldn’t be. When you have decided that the project is over, that it has reached its objective or achieved a certain milestone, arrange a celebration for those involved. Have a barbeque, order in sandwiches, go and play bowls, give everyone a certificate. It doesn’t have to be much, but you should do something to reward people’s good behaviour and celebrate their success. And make sure the celebration is about them, not about you. Remember to thank them!

The simple task of expressing genuine thanks will go a very long way; and it will leave a lasting impression, ensuring even greater success next time.

In summary…

This is by no means a comprehensive list of every possible activity that an organisation should do to improve itself. But hopefully it does explain that if you want to improve something, then put it out in the open, be visible and transparent about it, and have those people involved work it out for themselves.

For more information on continual improvement, come along to our three-day Risk and Business Continuity course. It includes a whole day on our six-step continual improvement methodology including many practical tools and tips.

• 3 Days

  Risk and Business Continuity

  Learn principles of risk management how to manage disruptive events to your organisation with ISO 22301.
  Exemplar Global – BC – Business Continuity

  In House delivery

  Find out more

The post Practical Tips for Continual Improvement appeared first on PwC's Auditor Training.

Are you a bit concerned about the point of this ISO standard for business continuity? Particularly when you consider there are management standards that already exist to look after your customers (ISO 9001), the environment (ISO 14001), your information (ISO 27001), your risks (ISO 31000), your assets (ISO 55001), and your people (ISO 45001).
If you’ve addressed the requirements in those other standards, you might ask yourself if this business continuity thing is just ISO trying to sell another standard and generate more revenue for themselves?
Actually, it is a bit more than that – and here we hope to explain the real point of ISO 22301. Firstly, the full title helps us…

Societal security – Business continuity management systems – Requirements

It’s the “societal security” bit that is interesting, because the ultimate purpose is not to protect the business so it can continue to make money, but to ensure that the business can continue to function to protect our society. Secondly, the definition of “business continuity” helps too…

Capability of the organisation to continue delivery of products or services at acceptable predefined levels following disruptive incident

This standard is about having a management system that will ensure “society” is protected if a disruptive incident occurs to your business. Now that sounds ever so much like risk management – and that’s exactly what it is! Normal risk management is about protecting the business, and it tends to be internally focussed; whereas this focus is on protecting those external to the business.

The standard is also about recognition of the business and its context within a supply chain, and proving to other businesses both up and down the supply chain that if something disastrous happens, the business can continue – or at least recover with minimal disruption to any contracts and agreements that are in place.

Now if the standard is about protecting those external to the organisation and not about protecting the actual organisation, why should business continuity be so important to the organisation itself?

First of all, governments and regulators recognise the role of contingency planning, and how to mitigate the effect of a disruptive incident on society. They want assurance that the key players they engage with have adequate plans in place to recover from any disruption to their services or products.

Similarly in industry, good businesses understand the threat to them if a disruptive incident occurs within their supply chain. Therefore these businesses want real assurance from their key suppliers that they will be able to continue to supply and to meet contractual agreements, if and when a serious event occurs.

So how does a business show that its supply will survive a disruptive incident? A sure way to demonstrate is through certification to ISO 22301 because this shows stakeholders (customers, regulators, top management, legislators and anyone else interested) that good business continuity management is in place, and that a certain benchmark has been achieved.

You’ve heard a lot so far about “disruptive incidents”, but what exactly what is a disruptive incident? Here are some scenarios, and the possible impacts they may have…

• A manufacturing plant suffers a major machine failure and is unable to continue supply to customers. The customers now can’t function.
• A pilot leaves a small airline. Some flights may have to be cancelled, leaving customers stranded.
• A severe weather event causes a workplace to flood. Important data is lost. The business is then unable to supply information to external parties.
• A medical outbreak occurs and a number of staff become sick and cannot work. The organisation has reduced service offerings to clients.
• A training provider fails to meet compliance requirements and is unable to issue certificates. Students are not able to complete courses.
• Civil unrest causes a food supply business to close. The local community suffers due to lack of food.
• A public transport failure prevents people reaching their workplaces on time. For many businesses, economic disruption occurs.
• A failure of EFTPOS facilities prevents customers from using this common payment method. Customers are unable to purchase goods and services.
• A WIFI failure prevents staff and customers gaining access to information. Lack of information leads to poor service and incorrect decisions.

As you can see, disruptive incidents can be anything from intentional (or unintentional) human acts, natural hazards or disasters, or even technical failures.

You may argue that all these “non-conformances” or “emergencies” are picked up in other standards – and you would be correct. So where are the requirements of ISO 22301 different?
While this is not the place to point out every single little difference, we will highlight key areas. And it’s not really that ISO 22301 is different – it’s just that it is stronger in these areas and uses different terminologies.

• Business impact analysis – A formal documented evaluation process is required for determining continuity and recovery priorities, objectives and targets.Here you have to explain (in priority order) what you will do before the incident has happened, and specifically what you expect to happen and when during the period of recovery.
• Incident response structure – Procedures are to be documented to ensure continuity of activities and management despite a disruptive event. These procedures need to include the management structure for the incident and impact thresholds that justify the initiation of a formal response. Who does what during an incident may be quite different to the normal management structure of the organisation. Here you need to detail what those new structures will be – and they may be different for different event types.
• Business continuity plans – Documented procedures are required to respond to a disruptive incident, then to continue or recover activities within a determined timeframe after the incident. You will need written plans to show what, how and when things will happen in response to impacts on activities, then how the activities are eventually recovered. Importantly these need to include timelines.
• Recovery – Documented procedures are needed to restore and return the business to normal after an incident. Once the disruption has finished, you have to explain how the business will return to normal.
• Exercising and testing – The procedures that have been mentioned above need to be checked through exercises and testing to ensure they will work. It is interesting here to look at what differentiates an exercise from a test – and again the definitions help us.
• Exercise – process to train for, assess, practise, and improve performance in an organisation.
• Test – a unique and particular type of exercise, which incorporates an expectation of a pass or fail element with the goal or objectives of the exercise being planned. These exercises and tests are far more than a group of people sitting around a table and agreeing that what they have written down will work. People actually have to roll their sleeves up, get their boots dirty, and go and see if what they expected to happen does go according to plan. And they have to test more than once – and they have to review – and they have to improve!

As mentioned, these requirements are contained in other standards, yet in this standard they are more demanding and prescriptive. For example, both ISO 14001 and the new ISO 45001 require emergency response procedures and the testing of them, but they don’t go into anywhere near as much detail as ISO 22301. So the responses you currently have may have been acceptable before, but they won’t be strong enough under ISO 22301.

What is also interesting is that when a nonconformity occurs in the other standards, you can decide what to do to correct it and prevent its recurrence. In ISO 222301, you have to determine what you will do before the nonconformity happens and be prepared even if it never happens (and of course hopefully it doesn’t!).

So is this business continuity a good thing? Absolutely! And is it already adequately covered in the other standards? No, we don’t think it is.

Learn more about Business Continuity

Risk and Business Continuity

The post ISO 22301 Business Continuity – Isn’t it already covered by the other standards? appeared first on PwC's Auditor Training.