How do Disaster- , risk-, crisis mngt and BCM relate?

The original question was: ‘What is the distinction for you between Disaster management Crisis management and BCM? How do you see that? That led me to do two things: I added Risk Management and Emergency Management.I departed where possible from an established or proprietary definition/interpretation of the topics, i.e. crisis for crisis management, risk for risk management, etc. That gave me the opportunity to clarify these concepts to the questioner, from my own experience

I write this text in my own title, not that of any organization.

Author: Manu Steens

What is a crisis? What is crisis management?

Looking first at the definition of crisis as I understand it.

A crisis for an organization is an event with negative impact on that organization that can no longer be resolved with standard daily process operation of that organization. In other words, it requires a special operation. The CMT (crisis management team) takes action.

Crisis management is the management ability to prepare for and guide the organization through a crisis with the goal of its survival. Often with the situation after the so-called recovery phase being a “new normal”.

What is a disaster (a catastrophe)? What is disaster management?

In my opinion, disasters are crises of great magnitude, which usually deal a serious blow to society. Some examples can be found in the BNRA (Belgian National Risk Assessment). An institute that publishes a lot around disasters is the DRMKC (Disaster Risk Management Knowledge Centre).

Thus, a disaster is always a crisis. Conversely, a crisis is more like a disaster for a smaller group. But not necessarily for a ‘whole of society’.

Disaster management can thus be defined as the ability, usually of a level of government, to prepare and guide its “organization,” often society, through a disaster to a new normal.

Preparing countries for disasters is among the objectives of the United Nations Sendaï Framework(UN) .

Often, even in ICT, people refer to a technical IT crisis as a disaster. The approach to it is then often called disaster recovery. The back-up room of a server room is often called a disaster recovery room.

What is emergency management? And emergency planning?

Sometimes emergency management (the implementation of contingency planning) is equated with all of crisis management, sometimes only the handling of an emergency or disaster.

To this end, in Belgium, a number of laws govern emergency planning.

What is Business Continuity (BC)? And BCM?

(From The Business Continuity Institute’Good Practice Guidelines (GPG)s (BCI) )

BC is “the capability of an organization to continue the delivery of products and services within acceptable time frames at a predefined capacity during a disruption.”

What is BCM? (From The BCI’s GPG)

“BCM consists of the following elements:

1. Operational planning and control
2. BIA and risk assessment
3. BC strategies and solutions
4. BC plans and procedures
5. Exercise program
6. Evaluation of BC documentation and capability”

Originally designed for organizations in the private sectors, BCM has since been picked up by many governments.

What is a risk? And risk management?

“A risk is the effect of uncertainty on achieving objectives.” (ISO 31000)

Risk management is the identification, analysis and (economic) management of those risks that may threaten the people, resources or operations of the organization

The purpose of risk management (RM) is to identify an organization’s exposure to uncertainty. It requires in-depth knowledge of the organization, its external environment and the legal, social, political and cultural context. Sometimes this is expanded to include demographic, societal, military, economic and environmental contexts

One must also know the internal environment, such as the people, resources, materials, machines,… in/of the organization. (These are non-exhaustive lists.)

What is the relationship of BCM and risk management to crisis management?

From the above, it is intuitively clear that BCM and risk management are both management capacities for making the organization resilient in preparation for a crisis. Risk management can also be used to help prevent a crisis.

This means that crisis management leverages the preparatory activities of BCM and risk management at the time of a crisis. Thus, BCM and risk management are not the same as crisis management

What is the relationship between risk management and BCM?

If we may fall short of the truth, one can say, in simplified terms, that risk management works with preventive measures, i.e., measures taken in advance that reduce the probability of a risk materializing into a crisis. Mutatis mutandis, one can argue that BCM works with protective measures, that lower the impact once a risk has materialized. It is sometimes argued that risk management would work on the causes of an event, and BCM on the consequences.

But this is actually drawing a (random?) sharp line in a zone with many shades of gray.

The best example is a pandemic plan. This is often labeled as the result of BCM work, as part of a larger business continuity plan (BCP). However, a pandemic plan is also often qualified as a contingency plan from risk management. (Risk management can also create contingency plans as a measure.) Indeed, some of the measures of a pandemic plan are preventive, some are protective, some are both. Examples include vaccination, personal protection measures (PPE) such as masks, restrictions on ability to travel, keeping distance, hand washing, …

Concluding remarks on ‘How do Disaster- , risk-, crisis mngt and BCM relate’

Risk management, BCM and crisis management are three distinguishable pillars of resilience management.

In addition, other words appear in the vocabulary used in organizations emergency planning. Much of this has to do with the personal word choice of those who use those words. Furthermore, the use of other words also has to do with the importance one places on a situation.