As Business Continuity Consultants, we frequently review organisations' Business Continuity Plans (BCPs) and response arrangements. Many have adopted the Gold-Silver-Bronze (GSB) team-based approach, which works well for UK emergency services, large global corporations, and public bodies. However, it’s not always the best fit for SMEs and mid-sized businesses*.
*In our business, we refer to organisations of around 50 to 1,000 staff as mid-sized. Whilst this is quite a broad range, and overlaps with the more formal definitions of SME and Large Enterprise, we find that when it comes to BCP, mid-sized organisations face unique challenges due to high complexity, limited resources, and high expectations from stakeholders.
In this article, we’ll compare the GSB approach with the Incident-Crisis-Recovery (ICR) approach, which is often more suitable for SMEs.
What Are the Two Approaches?
|
Gold-Silver-Bronze Approach GSB categorizes incident response command roles into three levels:
|
Incident-Crisis-Recovery Approach ICR defines three functional teams:
|
Both approaches provide a clear structure with defined roles, capable of handling various disruption scenarios.
How to Choose the Best Approach for Your Organisation
When deciding which approach to use, consider these three questions:
What is the Scope of Your Response?
The GSB approach was designed for incident response. Once lives are saved and fires are extinguished, there is no expectation on fire crews to salvage or rebuild what’s been lost (business recovery), or on Gold Command to manage affected parties’ relationships with stakeholders (crisis management). GSB in its intended form is incident-only and requires additional components for a full response.
In contrast, the ICR approach is ideal for mid-sized organisations that need a comprehensive plan covering the entire disruption lifecycle with minimal resources.
How Agile Does Your Response Need to Be?
GSB’s three-tier response hierarchy relies on mobilising many trained individuals, which can be complex and slow for mid-sized organisations. Most need an intuitive BCP that works out of the box and imposes few new operating principles. ICR is focused on making the transition from business-as-usual to continuity response fast and instinctive with negligible delay.
What is the Workload Involved?
The UK Emergency Services use GSB to respond to life- and property-threatening incidents, and this forms a vital part of their expected operation. It is proven, well-documented, and responders are trained to a high level, building on their experience of real-life events. Large organisations using this approach typically aim to replicate this, with intensive regular involvement by personnel at all levels.
For mid-sized organisations, responding to an existential threat or incident is a rarity, and few will buy into an additional, complicated, or heavyweight system. The response plan needs to be memorable, intuitive, and familiar, imposing low overheads on participants with light-touch documentation. ICR offers this.
Implications for Your BCP
GSB unquestionably works for larger, corporate organisations. However, it raises questions for mid-sized organisations and SMEs:
- Is GSB effective for everyone? Arguably. Most of our clients find ICR aligns more closely with what they want to achieve.
- Does ICR satisfy best-practice? Yes. Several of our customers are ISO certified.
- If you have a BCP written using GSB, is it fit for purpose? Perhaps, depending on its design and the validity of any add-ons used to cover the full effect of disruption. You can demonstrate effectiveness by carrying out a realistic simulation or test exercise.
- Can a BCP that uses the GSB approach be easily converted to ICR? Yes, however, doing so potentially involves changes to structures and definitions, and the addition of any missing components.
- If you are looking to implement BCP for the first time, what route should you take? Study the options and carefully select the approach that best fits your organisation’s objectives, operation, and culture.
Ultimately, your organisation’s size, structure, culture, objectives, partners, and specific needs should determine the approach you take. By understanding the strengths and weaknesses of each model, you can make an informed decision that ensures your business continuity plan is robust and effective.
