As Business Continuity Consultants, we frequently review organisations' Business Continuity Plans (BCPs) and response arrangements. Many have adopted the Gold-Silver-Bronze (GSB) team-based approach, which works well for UK emergency services, large global corporations, and public bodies. However, it’s not always the best fit for SMEs and mid-sized businesses*.
*In our business, we refer to organisations of around 50 to 1,000 staff as mid-sized. Whilst this is quite a broad range, and overlaps with the more formal definitions of SME and Large Enterprise, we find that when it comes to BCP, mid-sized organisations face unique challenges due to high complexity, limited resources, and high expectations from stakeholders.
In this article, we’ll compare the GSB approach with the Incident-Crisis-Recovery (ICR) approach, which is often more suitable for SMEs.
|
Gold-Silver-Bronze Approach GSB categorizes incident response command roles into three levels:
|
Incident-Crisis-Recovery Approach ICR defines three functional teams:
|
Both approaches provide a clear structure with defined roles, capable of handling various disruption scenarios.
When deciding which approach to use, consider these three questions:
The GSB approach was designed for incident response. Once lives are saved and fires are extinguished, there is no expectation on fire crews to salvage or rebuild what’s been lost (business recovery), or on Gold Command to manage affected parties’ relationships with stakeholders (crisis management). GSB in its intended form is incident-only and requires additional components for a full response.
In contrast, the ICR approach is ideal for mid-sized organisations that need a comprehensive plan covering the entire disruption lifecycle with minimal resources.
GSB’s three-tier response hierarchy relies on mobilising many trained individuals, which can be complex and slow for mid-sized organisations. Most need an intuitive BCP that works out of the box and imposes few new operating principles. ICR is focused on making the transition from business-as-usual to continuity response fast and instinctive with negligible delay.
The UK Emergency Services use GSB to respond to life- and property-threatening incidents, and this forms a vital part of their expected operation. It is proven, well-documented, and responders are trained to a high level, building on their experience of real-life events. Large organisations using this approach typically aim to replicate this, with intensive regular involvement by personnel at all levels.
For mid-sized organisations, responding to an existential threat or incident is a rarity, and few will buy into an additional, complicated, or heavyweight system. The response plan needs to be memorable, intuitive, and familiar, imposing low overheads on participants with light-touch documentation. ICR offers this.
GSB unquestionably works for larger, corporate organisations. However, it raises questions for mid-sized organisations and SMEs:
Ultimately, your organisation’s size, structure, culture, objectives, partners, and specific needs should determine the approach you take. By understanding the strengths and weaknesses of each model, you can make an informed decision that ensures your business continuity plan is robust and effective.