Site icon The Security Student Podcast

Show Notes: Empowering People, Not Plans: Rethinking Business Continuity with Jeff Donaldson, PhD | Episode #35

Travis

Overview

In this next episode, I was once again joined by Jeff Donaldson, PhD, to continue the conversation on emergency preparedness, this time discussing it in the context of enterprises and business continuity.

This episode starts by looking at the topic from a business perspective. Specifically, we covered a range of ideas, including adaptive business continuity compared to the traditional approach, empowering business leaders to support planning and response, prioritizing people over technology, and so much more.

Jeff brings a tremendous amount of experience and education directly relating to preparedness and business continuity to the podcast today, from his experience as a military officer in the Canadian Army (28 years!) leading logistical operations, as the principal researcher at Preparedness Labs Incorporated, and as an Associate Faculty member at Royal Roads University. Plus, he’s earned his MA in Disaster and Emergency Management and his doctorate in Public Policy. I’m excited to bring you all his expertise.

He even hosts a highly acclaimed podcast on preparedness and leads training sessions where he communicates (as he says), “Non-Apocalyptic evidence-based strategies for rational people with dreams.”

— Learn more about Jeff and his projects here —

– Preparedness Labs Inc

– Inside My Canoehead (Podcast)


Highlights from This Episode

  1. Reactive vs. Proactive Business Continuity: Many companies focus on recovery and response rather than creating insulation from the effects of a disaster.
  2. Importance of Social Capital: Building trust and relationships across teams and divisions is key for business continuity success, especially in times of crisis.
  3. Minimal Acceptable Standards: Many organizations, particularly small municipalities or corporations, meet only the minimal standard of preparedness for compliance purposes.
  4. Prioritization of Critical Functions: The Business Impact Analysis (BIA) allows companies to determine what systems must be restored first and how much downtime they can tolerate.
  5. Impactful Exercises vs. Minimal Disruptions: The idea that exercises for business continuity should reflect real-life, potentially disruptive scenarios rather than choosing the least disruptive options.
  6. Empowering Business Continuity Teams: Success in business continuity relies on empowering specialized teams to make key decisions without constant oversight.
  7. Investing in Employees’ Preparedness: Investing in employees’ personal preparedness (e.g., first aid training) can reduce stress during emergencies, as employees will be more likely to show up at work.
  8. People over Technology: The London Underground bombing showed that when technology failed, people and processes mattered most in managing the crisis.
  9. Adaptive Business Continuity: Instead of rigid plans, adaptive business continuity trains teams to manage unpredictable disruptions by focusing on flexibility and trust.
  10. Training and Empowerment Leads to Better Business Continuity: Employees who feel empowered and trusted to make decisions are more likely to contribute to business recovery efforts.

Memorable Quotes:

RESOURCES MENTIONED


Use CONTROL + F to search the transcript below if you want to learn more!

Transcript from this episode

*Note: this transcript was generated using automated software, and may not be a perfect transcription. But I hope you find it useful.

Travis Lishok  0:00  
...

Jeff, welcome back. It's great to have you again. For listeners, they know that in the very last episode that we did, you and I chatted on the personal preparedness side, and we talked about everything from taking the non apocalyptic view to preparedness being a mindset rather than a stockpile, and we talked about, like, some very tactical methods and ideas for increasing preparedness and even working with others in your community. And today, I'm really excited to chat still about emergency preparedness, but more on the business context, on the business side. So I've been really looking forward to this conversation for some time now. Jeff, welcome.

Jeff  2:28  
Oh, it's a pleasure to be back, Travis, and yeah, any any opportunity to continue the discussion that I think is important for everybody, for all of us to have on preparedness and understand that. And exactly like you said, it extends far beyond just what we traditionally consider to be you. I Our family sitting in our basement during a power outage, and I think that's where it's really important to take the conversation.

Travis Lishok  2:55  
Yeah, and especially in recent years, we've seen so many state and local and national events that have impacted businesses, everything from covid pandemic, maybe some different weather and electrical issues. There's so many challenges out there for organizations. And I wanted to first start out and see if we could touch on this. First I want to see how you see emergency preparedness being conducted today in organizations.

Jeff  3:25  
So really, when you think about and a general and general idea, the general literature organized a society into four spheres, if we, if we can start in that kind of idea, one is the civil that's you and I, that's the population itself, then we have the public sector, which is our government agencies at all three levels of government. Then we have the corporate sphere, which incorporates every private enterprise that exists, whether it's from Walmart to the corner store. And then the last part is your not for profit, often referred to as your NGO, your non government. So that's your community, everything from your local community, neighborhood association, whose meeting I have tonight to go talk about preparedness all the way up to the Red Cross and the Salvation Army. So if we think about society, organizing those four spheres, preparedness happens to some degree in E and we've talked a lot about the civil side. So we talk about preparedness in the other spheres. It's about thinking it through the lens of, is my organization, whether it be public, private or not for profit, ready to navigate realistic disruptions, things that are likely to or unlikely to happen to us that are rapid onset, right? It's like we can, everybody can see a hurricane coming, even though we can laugh at length about the lack of preparedness in Florida. But hurricanes don't show up overnight. Tornadoes show up in 20 minutes, right? A fire, and I've talked about this. This morning on a podcast episode about a building can burn down because of a fire that was beyond your control, an electrical short, and now your business is gone. Right? That impacts you and I, because our income source is now gone. So generally, businesses are poorly prepared for the environment in which they live. Community organizations are all across the spectrum. Some are very well prepared, mostly because they deal in that space, but in a general sense, there is a dramatic last lack of preparedness in the corporate and the not for profit sector, and the government is far more concentrated on continuity of government, plans and processes than they actually are executing the task of government in a calamity. Because those are two different things. You know, I'm a policy nerd. I did my PhD in public policy. There are some pretty amazing continuity of government plans written that if you read them, there's no hope they'd ever be able to execute them. They've made them so complex and so detailed. So generally, to address your question, the state of preparedness in the larger, wider community is exceptionally low right now.

Travis Lishok  6:23  
Ah, yeah, I see that, yeah. And as you mentioned, corporate about maybe, like a general lack of preparedness or less enthusiastic, yeah, I feel like it definitely makes sense when we think about, like, the mission of so many of these organizations, if you think about maybe like a software organization or a small consulting organization, or, you know, as you just go along, the broad range of organizations, it's a little difficult to get decision makers of which their input is going to be incredibly important, and putting together these plans And them guiding things, I could definitely see it being difficult for decision makers and executives to initially, initially make that investment of their time in enlisting the technology people and enlisting the business continuity people, the the Leaders of the different business units to at least begin their to initiate their exercises and to begin drafting documents, plans and training for something like emergency preparedness is like, what do you what challenges do you see there in terms of corporate?

Jeff  7:40  
I think the big side of corporate is, is it's a reactive posture. It's not a proactive posture. And a reactive posture means you are setting up the business to be prepared to react. You're not setting up the business to be insulated from the effects of the shock. Those are two different lenses they look through. And a lot of what's taught today in business continuity grounds in the idea that it's about recovery, it's about response and recovery and getting the conditions. Now every publicly traded company is going to have some form of business continuity. It's something that the shareholders will demand, right? There's, there's in today's world, larger companies are going to have some degree now a lot of the time, what they do is they go after an ISO framework designation. And there's several different ISOs on business continuity. I mean, the numbers don't necessarily matter, but there are standards put out there as to what you need to be able to do to meet what is considered a generally acceptable standard of business continuity. Publicly funded companies will do that as a nature of a requirement to protect shareholders. Privately held companies and not for profit, aren't under the same regulatory framework that requires them to, for example, in the United States of America and here in Canada, corporations, privately held corporations, I think you call them LLCs or C corps, are not required under law to have a business continuity plan. Now when you buy business insurance, business insurance can influence not every broker does this, but you can reduce business costs if you have a business continuity plan through some providers. So there is an incentive to have a business continuity plan. But again, it gets back to a lot of organizations in their reactive posture. I'm creating a business continuity plan because I want a lesser insurance cost. I want it. I'm creating a business continuity plan for the purposes of a regulatory framework. When you look at business continuity through that kind of lens, you're meeting the minimal acceptable standard to get some type of benefit for your business. You're again setting yourself up for a reactive posture at what is likely the minimum. A standard. When you look at the staffing and the funding of been of some business continuity programs in corporations, you might have two or three people in a several 100 million dollar corporation. And really we talked about the value of social capital last time, we talked about the importance of building those relationships. And there's nothing more important than a business continuity team, building relationships across the network and the divisions of businesses, in the larger sense, because when the bad day happens and you start issuing communications, if email is still available to you, if you that's the first time you're introducing yourself to the team, they're not going to pay attention to you. They're not going to drop what they're doing. They're not in the middle of a plan going to restart their computer because of some viral infection that has happened, and you're doing an IT response to protect to mitigate against loss. And I've never heard of you before, I'm probably going to think you're a spammer on the network, and you're going into my delete report as junk file. And I don't know how many times I've heard a business continuity professional say that it's it's almost impossible to connect with them. And my answer to that is, is, what effort are you doing to build the relationship? But really, I think the big problem is, is the initial steps in business continuity, when they're done, they're done in corporations through a reactive frame for regulatory requirements. Yeah,

Travis Lishok  11:36  
that's a good point too. Yeah, essentially for corporations, when they're guiding star for all for their approach to business continuity and all resilience related initiatives. If the guiding star is just compliance checking a box for an audit, you're never really going to get the you're not going to get the end result that you actually want in real life. That's that's a very good point there.

Jeff  12:02  
And that's the the require. That's where you switch over like, for example, I'll give a an example in the public sector that that may be appropriate. So here in the province of Ontario and Canada, and this is reflective in a lot of sub national governments, so many of your state governments will do the same thing. We have 444 municipalities and bylaw, each one of the municipalities has to have an emergency management plan. Okay, check one. The second thing, they must do an annual exercise. Now that can be a tabletop exercise with three people standing around discussing an issue, or it could be a full on mask has 300 actor exercise. But they have to do an exercise, and they have to send a report in, telling they did the exercise, right? So that's the idea of a minimal, acceptable standard. So you have municipalities out there that have literally nine public servants, including their entire public works. These are small, rural areas. So what do you think they're running for their emergency management exercise? Right? The mayor and the chief administration officer and the fire chief are sitting around a beer one night, and they're going to talk about how they're going to handle a, a a multiple building fire in their three buildings that exist in their downtown, and they're going to click off, and they're going to send it off, right? That's a compliance issue. That's what happens in a lot of corporations, is that the corporates governance structure requires the business continuity to run an exercise. Every year they run an exercise, they meet the business continuity standards, the shareholders are happy, and everybody else is totally unaware of what the intent and the plan is.

Travis Lishok  13:39  
Yeah, and then also in terms of, in terms of running the exercises, I feel like there's probably a bias to run exercises that are going to be the simplest, that require, you know, the least amount of work, where you're not going to be doing some of the more difficult things. If, if you're a corporation, you probably rely on many different vendors. You rely on vendors for your software, for your data center, for for your email. You rely on local vendors that are servicing the building and the people. Yeah, I also imagine for those exercises, it's probably very tempting to check the box and do the simplest exercise possible, not necessarily the high likelihood, high impact one for whatever your local area might be.

Jeff  14:28  
Exactly. It's incorporating the local Hira into what you do, which is obviously important, the thyra, as they call it now, it's a threat, hazard identification and risk assessment that your local municipality does should form a good part of your business continuity plan, but you're exactly right. So if you have an exercise requirement, even if you don't you conduct an exercise, it usually is the least disruptive, because, again, because you're reactive and you're not considered the C suite level or an essential. Part of the organization, they will not tolerate you disrupting normal operations to conduct an exercise, to consider what might happen when a real event does occur, like I've always said, Turn off, turn off the internet access. That's a great exercise, and just sit back and see what happens, see what the leadership of the different organizations do. See how it rolls out. But organizations don't do impactful exercises. They do them on the side, out of the way, not impacting current operations, and by doing that, they're not involving the people who conduct current operations. You know, I did what you spoke about is absolutely true in my Army career as a professional logistician. So, you know, I dealt with everything logistics to support the army, wherever it may be on the face of this earth. And obviously I relied on first tier, second tier, three tier suppliers across every single thing, I had to make sure that my supplier had a business continuity plan. I had to make sure that that was a quality plan, and that in my heart of hearts, they actually had the probability of of executing something. And then I also needed to know who I would go to when they failed. That's part of business continuity as well. When my supplier fails and when I actually, I wrote my master's thesis on business continuity in small, non, non franchise businesses, and I was asked business owners like, what is your plan when your main supplier, like, if you're a beauty products salon, what is your plan when your main supplier simply goes out of business because they're not telling you that they're financially in trouble, and generally, we don't find that out until the evening news or there's a lock on the door. That's when you find out a business is in trouble, right? That's generally, most businesses aren't public about their failing financials. So if you have a supplier that is critical to your operation. And like you said, if it's it could be software, it could be trucking, right? Why does Walmart vertically integrate its entire system? All of the trucks are Walmart trucks. All of the truckers are Walmart employees. All of their distribution warehouses are Walmart owned distribution warehouses, right? And if you've ever seen and read a contract, and I've done this in the logistics world, read a supplier contract for Walmart, there are some pretty robust conditions you need to meet, or you're punted. Ask yourself, if you're a business owner, you work in the corporate environment, do we have the same set of conditions with our suppliers? Because if you provide a service, say you're a business service, or your business is in the service industry, and you rely on a critical piece to execute that role, and that's pulled out from underneath you, it's your reputation that went down the drain. You can't stand up at a microphone and say, I failed you, because it's Jimmy's fault, right? Company X failed me. Don't get mad at me. No, your suppliers aren't going to care that company X failed they're going to care that you weren't able to provide the service you promised and that you did not have a short term disruption plan. When we look at the research for company loyalty, generally speaking, your customers are loyal when you have a disruption and it is short term and it is seen to be well managed. Everybody talks about the Tylenol example versus the BP oil example, the Tylenol, when that Tylenol was tampered with or suggested to be tampered with in the United States of America, Tylenol literally pulled its entire stock of hundreds of millions off the shelves and threw them in the garbage, not that I'm going to test the lots, not that I'm going to mitigate it. They stood up and said, we are going to take this hit, because our customers, health is the most important. We're going to throw everything in the garbage. We're going to fix all of our problems. And they were the ones that started the seals on the jars, the sealed coverings that then were now adopted by the rest of the industry and were subsequently added to the the regulatory framework, right? That's an example of where loyalty with Tylenol stuck. Yes, Tylenol was not available for a short period of time while they fixed the problem, but they were fixing the problem. Look at BP Oil dumping all that oil in the Gulf of Mexico. What does Buddy do on the what is the billionaire do on the on the the owner on the news conference, I just want my life back. Is what he said in an international news conference. Forget the shrimp shrimp boat owners in Louisiana and miss. Sippy pounds, they can pound salt. I want my life back as a multi millionaire billionaire, because this is such an inconvenience to me, right? Look at the two different handlings of it. If you your corporate reputation is directly correlated to your ability to earn revenue, and if you live in a capitalistic, competitive environment, you what you have to protect your ability to deliver service or goods to your clients. That's what business continuity does for you. You can't control exogenous shocks. You can't stop things from happening to your business, but what you can do is take steps so that you are disrupted for the least amount of time to the least degree possible, and that you're able to return to normal operations as quickly as possible, so that you can continue the service to your customers. That's where business continuity pays. The bottom line, the companies that get it invest in it. And I've been in a cncp or KC Kansas City, Southern or whatever. There's Canadian railway and an American Railway joined. I've been in their op center. It would dwarf anything FEMA has ever created. And it's the center of their emergency operations. They take rail safety seriously, dead seriously, and they invest 10s of millions of dollars voluntarily into a program that ensures continued operation. Why? Yeah, I'll sure take it that it's all about being a great citizen, and I'm sure part of it is but let's not kid around this is a capitalistic environment. It is about earning an income, and don't let an exogenous shock take your company down. Because if you're a service company, if you're a software company, you don't live in isolation. How many other software companies are out there that are able to keep running when you weren't. Do you think your customers are going to just stay with you when another brand over here for a reasonably similar price, a reasonably service level, doesn't have an outage problem, or when they do, it is very short lived, you're not getting those customers back. Yeah,

Travis Lishok  22:22  
that's a good point when it comes and I think that's also a really important factor when it comes to selling the idea of business continuity to executives and leaders. It's that noting, hey, although I know we have all of this fancy language in all of our business agreements about uptime and how quick we'll do this and how quick we'll do that, but outside of the the legalese that's written into the contracts on top of that, it's really, it really comes back to building confidence in your users that you're going To be there when you need them. And like you make that point about how Walmart has a degree of vertical integration at the same time bringing in any type of outside vendors. If Travis owns his own trucking company and he's someone supporting Walmart, it's not just good enough to or excuse me, yeah, when those incidents do happen, and Travis can't bring the trucks on time, and Travis doesn't meet the agreement, he's going to be in trouble on the legal side, because there's going to be some type of repercussion for not delivering on the contract. And then also, it's just the damage to the name and the brand overall. So that also sticks out to me as like a useful tool in selling the idea of business continuity, getting back to brand loyalty and confidence from the end users of the product.

Jeff  23:52  
And this is where business continuity really begins. This is where we see the investment in business continuity, professionals, people that have there's DRI, there's several other organizations that offer professional certifications, from associate to business professional to master business continuity designations through and they're very well done, and the education is very good. So the original structure of Business Continuity is based upon something they call the business impact analysis, the BIA, and it's based and is grounded in the idea that these are the primary functions of our business, both the functions that enable us to deliver the service and the service itself. Then business continuity professional looks at them and determines what is the priority? What is the most important, and what is the least? What is the most amount of downtime that we can tolerate, and how fast do we must get them back up and running. Now the business continuity professionals will train so they understand zero is not possible, like zero downtime is not possible. So. The answer from the CC C suite will always be, I want it all back. I'm running in five minutes. Okay? I want $100 million budget to set you up for that bud. Not possible. So the business continuity professionals are well trained to set it up in a cascading effect. What must I get up and running first, etc, and then what a business continuity professional will do is take that business impact analysis and then set up a set of plans, a set of processes of how to recover first identify the problem, because it's key to identify a problem. A lot of times you know, you'll see in the IT world, which you're more familiar than I am. People will be inside your software network for a long time before you know they're there, or they'll be bleeding off secret and for business information before you know they're there. But how do you know your system is compromised? What are those indicators that your system is compromised? Business Continuity professionals will start working with the it to look at where, where. When will we know, other than to denial of service attack or I can't get access to my database, how will we know that we're under some type of intervention, just for just from an IT perspective, right? So business continuity preventers, then look at what could cause these disruptions to happen, and then they start building plans against it. The challenge that they have in today's world is there are so many things that could go bad, right when you think about from as I put it, you have political, economic, natural, familial and cultural disasters that could occur, and each one of those have a myriad of other possibilities. At what point do the plan structure become impossible to manage? Do you expect your business continuity plan holder, however you've structured that in your organization, to maintain 125 plans for all possible contingencies. In the original we talk about, I need a plan. So if I've got these five areas of my lines of business and I must recover them, I've got a plan to recover them. That's the late that's the best natural adaptation of Business Continuity is to not for a plan for the incident, but for a plan for recovery of this. How do I get my IT system up and running again? Let's not spend a world of time worried about why it went down. Let's worry about how to recover it, right? So that's the first step forward. But again, when you think about that and the complexity involved and the requirement to integrate knowledge with the other business sectors, like a business continuity professional doesn't need necessarily to be tied to the logistics and the marketing and the HR side on a regular basis. But they have to understand how the HR does its business, how supply does its business. You know, how do you do business to support it, so that I know how to help you recover that, right? So your business continuity professional when they get integrated into the system, pretty much know, has to know how everybody, from a general perspective, accomplishes all of their tasks that together enable the organization to be successful, because they're going to have to influence some type of strategy as to how to recover HR. But if you know nothing about HR, how do you recover HR, right? So a great business continuity professional will take that step forward and understand how HR works, so that you can help HR, right? And then you go, Okay, I gotta help. HR, I gotta help these seven business units. How do those seven business units work alongside of the five systems that need to be up and running as fast as possible? And you start to see how those relationships work together. This is why I talk at length about the power of building positive, trusting relationships with people at work, don't assume you're gonna they're gonna listen to you on the bad day. You can't right. You need to know them by first name basis. You need to see them in the lunchroom. However you do that. We talked at length. I won't rehash all of that that we talked about last time, but that's really where business continuity is today in organizations that are successful?

Travis Lishok  29:48  
Yeah, I see that. Yeah. So one big piece with that, with the BIA and doing the business continuity generally, is going to be working with some of the business unit leaders to understand. Understand what their needs are, what their core responsibilities are, and then all of the different factors that feed in and make that possible. It's everything from it's your people, resources, it's your technology, it's hardware, it's also relationships with vendors, and it's so much more. And Jeff, you talked to about how some of the challenges with the standard or the traditional business impact analysis approach might be that, you know, it's impossible for any organization to document a plan for the pen, for the upcoming pandemic, for the election, for if chip manufacturing stops in Taiwan, for you know, any unlimited number of events. Are there any other challenges with that traditional approach that you see?

Jeff  30:51  
Well, again, the challenges when they reside there. The big challenge is when they sit there and they're trying to cover that like I recently saw something on LinkedIn where somebody announced that they've proudly have 42 plans of their business for business continuity, and they're ready to go. And I'm I'm laughing internally, because I know the reality of maintaining 42 plans at an accurate, usable state requires a team. This person doesn't have it doesn't you? It's not possible you can create the plan, don't get me wrong, but a plan is a living, breathing document that needs regular help, needs regular review, regular assessment and regular check against structures and operations of the business, right? You can't create a plan. Print it out, put it in a folder, stick it on the shelf and pull down pandemic number two book, when the next pandemic comes, right? It doesn't work that way. Plans need to be regularly, and if you have 42 plans in your business, especially if we add the other complexity that you're multi jurisdictional and you're multi location. Now take a business that's not sitting in California, but it's sitting in California, New Jersey, Maryland, North Dakota and Florida. Oh boy. Now we have multi jurisdictional regulatory environment that's going to be different based upon how the governors have set up that structure. You're going to have transportation networks that are governed by different levels of government. You're going to have a whole bunch of extra complexities, and you have 42 plans, you're not going to be successful. This is why I always championed what I said next is you move away from a stack of plans and move into my role here is to get the system up and running. And that's where we see the emergence of a really innovative idea brought out by a gentleman by the name of Mark armor. It's called adaptive business continuity.

Travis Lishok  32:57  
Yeah, and that's exactly where I was heading to next. I wanted to hear a little bit about what the alternative approach might be to what so many organizations have been doing traditionally. Can you share a bit about adaptive business continuity?

Jeff  33:11  
So adaptive business continuity, and he's got some great work on it, but it's generally based on the premise that we exercise the team, not the plan. So adaptive Business Continuity is about setting up a team of individuals that are trained and empowered to run and manage the organization through a disruption and out the other side. So your exercises are grounded in your ability to get the team up and running, and your ability of the team to navigate the situation. So you're far less concerned about why a disruption happens. You're very you're concerned that the disruption happened. What do we need to do? What do we know? What systems are up and running and you exercise the team so adaptive Business Continuity is about taking your time and investment, not in business impact analysis. Obviously, you have to be aware of what the business does and prioritize how to get it up and running, but your efforts are concentrated solely on the team that you've put together to respond to the business interruption, whatever that business interruption might be. So your exercises are around, how do I get the team? How does the team relate? What it does the team have the right it supports, if the team needs it supports to run a business continuity program, it better not be the same it that runs the company, because what if that's the source of disruption, right? Like, I've seen adaptive business continuity teams running off a completely different set of software, like I've seen them run off WhatsApp,

Travis Lishok  34:58  
yeah, alternative communications and. Case, absolutely thing goes down. The

Jeff  35:01  
entire thing they don't your business continuity team should not need anything the business has to run business continuity because that could be affected, right? So your business continuity and adapt, especially in adaptive Business Continuity is this separate, unique group of individuals who are empowered, and part of that key is empowering, right? It's one thing to say that I'm a Business Continuity professional in a reasonably major corporation, and I have the responsibility to get us up and running again when the bad day happens, but do I really have the authority and the power to make critical decisions, or do I have to continuously and repeatedly run those decisions through higher levels of authority to get approval to do what needs to be done? Trust? One of the grounding principles of adaptive Business Continuity is trust in the people you put in the team. In other words, when they get up and running, if they take a system down to bring another system up, they're not asking you permission. You've either put them in there with the trust to do what's right, because they're the professionals. Obviously they're back briefing the key individuals, right? Obviously they're doing this. They're not doing this in isolation, but they're doing it. Listen, we're about to take down the logistics system, because I need to get the HR system up first, because of what we do for a living, for example, um, for example, the HR system goes down. Try not paying your employees. How well is that going to work for you? Right? And I'm dead serious, like we have this monstrosity of a problem in the Canadian public service called the Phoenix pay system. We upgraded to a new software, and it totally crashed the system. You know, we've got, like everybody else, we've got hundreds of 1000s of public servants weren't just stopped getting paid. The bank doesn't care that the pay system is down at your business, your mortgage is due and your credit's going to take a hit when it's not they don't care that the company can't pay what is the company's plan to pay their employees when their HR system is no longer accessible, right? If that's kind of important thing to have, right? So business continuity professionals are empowered to make those key decisions. Obviously, back briefing the C suite as they go right? This is a key part of adaptive business continuity, and it gets back to the saying it's about exercising the team, not the plan. Are there plans? Yeah, absolutely, because they have to know the cascading systems they have to know the key business operations that need to be up online. But adaptive business continuity allows them to move around the environment, right, to move around the threat profile as a threat profile changes, right? So as your new threats emerge, whether they be political, economic, familial, cultural, natural. It doesn't matter economic. It doesn't matter where your threat profile comes from, but it does that your adaptive business continuity teams are able to move around much more agility is given to the team to do that. But it's a trust. It's a trust that has to be done. And when you do that, then you see that trust. You see teams that are far more capable, right? You know, in any business when, if, every darn time you need to make a decision, I'm trying to be politically correct, not swear in your podcast, when you're political, when you're trying to make that decision, and every time you have to do something. You have to go after approval. It it gets it's really quick. Way to kill the motivation of great employees is to tell them, I need you to do this great stuff for me. But don't do a thing without asking first. I

Travis Lishok  38:55  
know we hired the business continuity expert with all the credentials and 20 years of experience, but go run it by the non. Go run it by the non business continuity person, and HR first,

Jeff  39:07  
right? And, and it's funny because it reminds me of a conversation I had, uh, oof 18 years ago when I was the quarter master of an infantry battalion, and I sat with a Deputy Commanding officer who was my boss for the purposes of logistics and support, and I basically asked for my marching orders, and he pointed to the Manning officer's door and said, keep that man out of jail. But you cannot fail to deliver the beans, bullets and gas that we need to deliver to conduct our operations. But in doing so your only restriction is keep that man out of jail, and as the commanding officer, like a CEO, he's responsible for everything that happens. So I'm not allowed to break the law, right? As a business continuity professional, I'm not allowed to break the law, but the level of. Freedom that you assign to your business continuity professional, I'm gonna argue, is directly correlated to the quality of service that you'll get if you put them in a little box and you dump a bunch of regulatory framework requirements on them about what they can and cannot do. You know, run an exercise, but when you do, don't you dare disrupt my business. Okay, sure, you'll get the box checked, and then you'll realize the folly of your ideas when the big, bad day happens.

Travis Lishok  40:35  
Yeah, and one thing that comes to mind as you're talking when you talk about empowering and trusting the leaders that you've hired to do the job. The first thing I think about is decentralized command, just being able to give we'll call them the troops, to give the troops the commander's intent. They know exactly what the mission is, what needs to be done, but we're going to leave it to the people on the ground, the people that understand the different business unit leaders that understand their requirements that we're going to give them the ability to execute and carry it out the way that they see.

Jeff  41:12  
Yeah, and I think to just extend what you just said, I think one of the big parts that we don't advocate well enough for is the communication going the other way? If you are not a business continuity professional, but you do work in a corporation, you should be reaching out and figuring out, how do we do this here? How do we do business continuity? How do we do recovery, loss and impact, because business disruption so clear to everybody, right? The pandemic certainly reinforced that. A hurricane reinforces it. When you're a trucking when you're a company like WalMart, and three or four of your main lines of communication where you move your trucking up and down are no longer available. You better have some pretty smart logisticians in demand, in transportation planning, right? So if I'm the transportation planner, I need to know how we intend to deal with these disruptions. So we not only have to empower the business continuity professionals and promote, you know, business analytics or but what we need to do is get it part of the business culture to be acceptable to ask questions like that, to ask questions and inquire about adaptive business continuity. How do we do it here? How if I'm the logistician or I'm the HR or I'm the IT, it has always been correlated with business continuity, because everybody talks about offshore server firms as backups. That's great. What you know, and I know there's a lot more to it than a server firm, right? So how do we recover this? What if? Our if, if we're a SaaS company, but we require somebody else. What if that company goes away? What are we planning to do? Do you only want that knowledge to be sitting in your business continuity office? Because what about confidence building? What if it's shared amongst the employees? What if the employees, writ large, generally understand that business continuity is there. It's handled by these team of people. This is how we intend to navigate things. When you build that out, it builds not only trust, but loyalty, right? Because think about this in North America right now, and I'm sure in America it's very much close, like Canada. I don't know your data, but as well as ours, but not a lot of people are living well right now, economically speaking, right? A lot of people are fairly close to paycheck to paycheck. You remove two paychecks in a row, and most North American families are in significant trouble, right? That adds a level of stress and anxiety if the employee is worried about the conditions of the business and the health of the company, right? You could work for the banks. And we see this in banking and financial sector, especially in the last year, there has been considerable number of layoffs in the banking and the financial industry, right? They're making billions, but they're still firing 1000s of people, right? So when you understand that your business has business continuity protection and is that that gives that may reduce a bit of anxiety people have about worrying whether was, are we headed for a recession or not? We can argue politics on that. But I know in Canada, our unemployment rate is headed upwards, and I think it is in the United States as well, which means, should you be fired? You're in a more competitive environment, they replace and if you in, for example, if you're in the business financial industry, and you're shedding employees, nobody's hiring business financial people right now, right. So if everybody's getting moved out of one place, it can place a lot of stress. So a good part of building that loyalty within a corporation helps through communication of the business plan, business continuity plan, that yeah, we do consider this here. We know this here. We have people that do this here. And, oh, by the way, this is generally and just from a generalist perspective, how we intend to handle these things. Boy, does that go a long way in companies, really, to to build loyalty and to build brand understanding and and, you know, when come employees have always said that the number one thing people are looking for is recognition and thanks that their job matters, right? That's always important. But knowing that it'll be there next week is pretty cool, too.

Travis Lishok  45:53  
That's a big deal. And Jeff, as you're talking another thing that comes to mind when you're talking about, the need to empower teams and to really trust them. I was doing some research recently. This is less about, you know, the typical continuity incidents, but I was reading some research about there was a July 7 2005 bombing for the London Underground. There was a terrorist attack there. And I was I was reading a lot of the research put together by the London Assembly, by other independent groups that kind of documented the incident, some of the lessons learned and some of their big takeaways. And one of the things in the report that really stood out to me, I forget who it came from. It was one of the big stakeholders, it could have been the mayor or one of the elite, one of the leaders, who was executing the response. They said that one of one of the big takeaways from them was that in the future, they need to put far more emphasis on people and process rather than technology. Because in their case, what had happened was the communication systems, what had gone down. Their radios weren't operating underground. The cell phones were cell phone towers were completely overwhelmed. People didn't quite understand, maybe, like, what action to take in terms of some of the rescue operations. So that really stood out to me when they said, in the going forward, in the future, people and process need to be emphasized in terms of training, in terms of education, and then even possibly in terms of educating riders, so that they could understand that some that help is on the way when an incident happens and they might be in the tunnel. So that just really stood out to me as you talked about the emphasis on the team itself, rather than technology and some of these other factors.

Jeff  47:49  
And it's so true that people, people are the should be the focus, and people are your solution. The quality and success of your organization is directly correlated to the quality of the people. And I don't mean the quality of the people from a sense, you've got good people and other people have bad people, but the quality of investment that you've made in the people, right? So it's everything from building loyalty, you know, Costco understands this. Costco is a very low turnover rate, and it's very hard to get hired by Costco because they have a very loyal employee base, because they have great benefits, because they pay them more than, considerably more than the consumer average for that kind of work. But they do that because they understand that their success is grounded in the quality of their people. I've never met an angry Costco employee in my life, even when the typical Karen is going off about something, right? I've never met an angry Costco employee. They're always smiling. They're always there to help you. They're always, you know, yes, you're in a zoo of humanity with 1000 people stuffed in a big box trying to grab, you know, 25 jars of ketchup. But the point is, is that they've invested in their people, and they understand that their people are their key to success. And organizations that do that in the emergency preparedness space are far more successful, right? Because people who are empowered, people who are well educated, which means they may come with the education, or they're provided the education, people who are empowered and trusted to do their role, and people who have influence in the process. And it's important to have influence in the process, not one superimposed on you, right? If you're the one executing the process in the IT division, do you feel like you have the ability to influence that process, or are you just a monkey pressing buttons and pulling levers? Because not every organization's the same, right? But when people see that and they can influence and make you know, I've got a better way to do this, and here's why I think it's a better way, and it might actually work, and the company invests in it, etc. Yeah. Right? For example, this guy that I met about 25 years ago. His name is Cliff Howard. He's long since retired from he was the head of the Honda parts distribution plan. So in this city that we were at, Honda had 19 dealerships. It was a city of a million. There's 19 dealerships in the greater area. None of them had parts on hand. They found it more efficient to have all the parts in one central warehouse, and the trucks delivering four to five times a day back and forth between them, right? So he was the individual in charge of the entire warehouse and efficiency. He would go to them and say, I need $2.7 million for a new conveyor belt system. It's going to save us $3.1 million over the next 24 months, and they get his money because he could lay it out, right? He was empowered with the responsibility that he had to make fundamental changes to make the company more efficient and more effective in his area. When you empower people to do that, the people will be there when the bad day happens, and they will fix the problem right. Your warehouse can deliver supplies on paper. When people understand the process, and people see the process, and they can follow the process, it won't be as fast because it's not technologically enabled, but they understand the process, the responsibilities, and they see value in continuing doing it, right? They're not going to sit back. Well, let's give you an example. You've seen businesses where the it goes down and everybody just sits down and goes on

Travis Lishok  51:33  
lunch break, right?

Jeff  51:36  
Okay, well, what about the stuff that still needs to get done? Well, I don't have my it, so I can't do it. Oh, okay, so you're just going to sit there. You're not going to figure out another way to do it. You're not going to come up with an adaptive, ingenious way for a couple hours to get something important done while the system is down right, two different groups of people that one's empowered, one's trusted, and the other one is just a, as I like to say, a monkey throwing levers.

Travis Lishok  52:03  
Yeah, yeah. And I think another part of that too, in terms of empowerment, when someone feels like they own the plan, like it's something that they created, they're going to be far more invested in seeing the success of it, and they're going to be far more invested in terms of all of the training and preparation that goes into it. Because, you know, if you think about the alternative where you're less empowered, you're just checking boxes when the day comes and you're that person. I mean, it might be easy to have the attitude of, hey, we did what was required of us, and you only gave us limited resources. I didn't have the responsibility to do the things that I needed to do, and then now you have this employee who's essentially just dissatisfied, and now they can't do the job and keep keep the business running and recover the systems.

Jeff  52:58  
And it's and it's so true when you're grounded in exactly what you said at the end there, recovering the systems. And in project management, they call it a critical path analysis. What are all of the steps necessary to get that system and you work from the system restoration point and you work backwards, what are all the things I have to do in a row, cascading to go forward, and are people empowered and trained to do that right? And our people are aware that that's what needs to be done, right? Because the business continuity office is very much like the emergency manager. They do Incident Management, not incident response. The difference between those two is that the business continuity manager can't do it on their own. It's not like everybody in the employee, everybody in the business, throws their hands up in the air and sits back and waits for the magical business continuity people to swoop in and set everything back up and running. Right? No, they are the incident managers. They're the ones who are going to guide the business units through response and recovery. They're going to provide the advice. But the actual execution of the of the steps that need to be taken are have to be done by the business units themselves. Right? You know, business continuity is not going to take over HR, they're not going to take over logistics. They're not going to take over the it section. They're going to give instructions to the people in that organization. This is what we need you to do next as part of the incident management program as we go through response. Again, that's why the relationships are so important. But they're managers, right? They're managing the response. And if you have somebody who's empowered and they're like, Yeah, I know how to do that. I can do that without system x, that's down. I can do it this way. So they do that because they're trusted, empowered, trained, and they're see themselves as part of the solution. When people don't. Don't see themselves as part of the restoration plan. They tend to be the people who turn off, shut down, and wait for the thing to come back on. They're at the they're at the break room. They're eating their saying ease. They're getting their water, their coffees, whatever, because the system's down. Who cares? Right? As the quote, unquote, experts over there in some weird corner of the business we've never heard of before, try to recover everything. Those organizations can be successful, but they're far more successful when you have that integrated, coordinated response. An incident happens, we have a significant disruption. We identify it, we identify the root causes. We see we start, you know, the business continuity professionals come up with a strategy to get the business up and running again through exercising the teams, not plans, and the team starts issuing instructions as to how we're going to do this. You know, what are you? What's your employee's reaction? That's huge. It's huge. It's culture. It's built on culture. It's Do you have a culture of commitment and loyalty within your employees, or are they compliance with a minimal, acceptable standard to earn their wage? That's a corporate culture. It is. People are so important to your success, right? Because your success or failure in a business disruption is what the public deems, Were you successful or not, right? Because if your client base is the public, the general public at large, and you sell something to them, a good or service, and you're seem to have caused harm, right, like, if you're if your plant dumps a bunch of chemicals in a local river, you may have the world's best product, but I'm telling you, there's 30, 40% of the population that just wrote you off, right? What's your communication? How are you dealing with that? What are you going to do? You can recover the business from that, but that's only in the quality of your people, right? When half of your employees get interviewed as they're exiting the business, they're going, Yeah, wait, this place is run by a bunch of all they're cutting our breaks. They're taking their you know, we've seen it. You've seen it on the news, where people get, you know, corporate people get interviewed. What is the message that your employees are sending when they get interviewed about your corporation? It's all about public image. Nowadays, there is so much based upon public confidence. You know, it takes 20 years to build a reputation and five minutes to lose it. I

Travis Lishok  57:35  
like the way you put that. Businesses need to aim for creating a culture where people see themselves as part of the recovery effort. They're not just leaving it up to the disaster recovery or business continuity team. It's more about taking responsibility for that individual business unit that one might be part of. And Jeff also, so we talked a little bit about adaptive business continuity. We've touched on the importance of empowering and trusting the people who are executing the work and the importance of relationships. Are there any other important topics that you wanted to touch on also,

Jeff  58:15  
I think investing, and this is something I obviously call for is businesses investing in their employees preparedness. And I think that's a key part that's left out of the business culture, is that a lot every business continuity plan you have requires people, yeah, right. And when the bad day comes, you need people to show up to work. But if the people are worried about their families, they're not coming to work, right? You and I, and I've said this under many times, if my family is at risk, I don't care about my employment, even when I was in the army, or I'm a police officer or I'm a firefighter. If my family is at risk. I'm going to address the harm my family's at risk from before I consider returning to my place of employment to assist with the business recovery operations. We not many companies do it. Some do invest in preparedness, education and training for their employees. And in America, you have something called cert community emergency response team training. Yeah, you have first aid training. You know how many employers provide free first aid training to every one of their employers? St John amblins Red Cross, what a huge thing to do, because that that's not just for office place injuries that trains the employees to deal with things that happen at home. You know, we're going to give you a free Saint John Amblin standard first aid course, and we're going to give you a 50% discount on a St John Ambulance. Standard first aid kit for your home. Huge, huge benefit, right? That that's investing in people giving them like, for example, when I talked about before, about the thyra, the the threat, hazard identification and risk assessment for this Paradise California, something might have happened in paradise, California, right, right. So imagine if you were a business working in paradise California, and you had 100 employees. Imagine if you took the effort to look at that Tyra and look at the threat profile, and you informed your employees. This is what we think you're at risk for at home. These what we think the risks that face you and your family on a daily basis. And here's some great education that we're going to provide to you free of charge on how you can protect your family. I didn't say a thing about protecting the business. The message I'm sending to my employees is that I'm interested in making sure that they are resilient as possible in the communities in which they live, because that's important to the quality of life. The fact that comma that means there's a highly degree, higher degree of likelihood that my employees will be less affected by an incident and therefore more available. That's a benefit to the company. But the real envy is is I'm investing in the people. It doesn't cost a lot of money. We're not talking about buying bug out bags and go bags for everybody in your employees and stuff like that, or having a bug out location for your corporate employees or anything like that. But it's understanding that your employees live in the environment where your corporate is. Your Corporation is preparing through business continuity to navigate a significant disruption in the low that may be in the local area. Well, don't forget, your employees live there too, the very people you need to show up and sit in a desk to work on the business continuity plan or with in support of the business continuity professionals are people from that same community that face the same set of threats that the corporation does. So why not invest in the education and the safety of your employees and reap the additional benefits that come from loyalty and indirectly to your own business continuity operations. It's, it's a very low, as we like to say, it's a low hanging fruit. First aid courses are maybe 150 bucks an employee, and they're good for three years. That is not a lot of money to invest to give your sense of security in the workplace, right? And to give a valuable set of training, and even if you want to offer a discount on a kit or a free first aid kit for for your employees,

Travis Lishok  1:02:57  
yeah. And as you talk about that too, I think even from like the most cold, calculating perspective, just having the ability for essentially, some of our they're going to be first responders in the workplace. If someone has, let's say, a cardiovascular incident and they need CPR to give them the tools that they need to save a life in the workplace, one you can't put a cost on the life itself, but even thinking about everything else, of business interruptions, of keeping your employees happy and healthy, of them knowing that, hey, even if something bad does happen at work, I know that three of the four people that are surrounding me in The cubicle, I know that they could at least provide a basic level of care, and they know the process for contacting EMS and getting me the help that I need. And I think that's such like a such a fascinating aspect, and it seems less traditional, just because I feel like I haven't seen a ton of it. But when you talk about the idea of an organization being very candid with the employees and informing them, hey, based on the area that we're in and things that we've seen in the past, we think that there could be a significant risk of x this coming winter, and we think that it would be helpful if you prepared in this way, and here's how we're willing to help you, here's some of the resources that we're going to provide. Yeah, I think that is that's such a huge step for businesses,

Jeff  1:04:30  
and it's an investment in the very thing that we keep hearing businesses say is the most important. It's a way of putting some oomph behind your sayings of my people are the most important asset I have. Every CEO says that at every meeting, right? Okay, now I'm going to translate that. And I off, and I often said, and I know it's some people argue it's not a great example, but I'll use it anyhow. I compare, ask a business to compare the amount of money they invest in it. Protection. Uh, and versus employee protection. Compare those two numbers. Just look at your business plan, compare those two numbers, and then stand in front of our microphone and tell me that your employees are number one, right? And it's money where the mouth is, and it doesn't cost a lot of money. That's why I get people argue with me all the time because they're not correlated. I'm like, yeah, it's a lot easier to buy a new software program. It is to replace your entire HR department. It is competing software you can buy, like, if I lose my HR software because of a ransomware attack and it's gone right, I can go buy PeopleSoft or SAP or the next thing to get it up and running. In a short order, hire a bunch of data people to populate all of the information from employee files, and bang, we're off and running again. Short disruption paid a bunch of people by cash and check. In the interim, we're good to go right. Totally different story of replacing the entire HR office. Totally different story. So I mean, investing in people is not expensive, but it's huge. And today, when you look at their competitive workplace, and you look at what differentiates, because business is success on differentiation, right? You're in a SaaS business. You're in whatever business you may be. How do you differentiate yourself from other people. And how do you keep loyalty? It is far more expensive to train a new hire, bring them on, get them to understand the culture, get them in the environment, etc. You know, it takes a couple of months before you really feel comfortable in a company when you start. It's not overnight. You don't understand the culture or past relationships, or how divisions work well together. Or, you know that old saying, Who's Who in the zoo and who really matters? Um, it's holding on to people is far less expensive than trying to replace them. And like I said, I use Costco all the time because they may be in a simple industry, and some people will laugh in a basic industry, but there's a reason why them, and another great example is McDonald's. Why do McDonald's managers and area managers make the kind of money they do, and they get paid well, because the daily operations of the business and the customer facing profile to McDonald's is so important to their bottom line, and their key position for that is their store management and their area management. And those people get paid very well and handsome benefits. People would sit back and go, what you make that at McDonald's? Oh yeah, oh yeah. Because when people think of McDonald's, they think about the minimum wage worker asking you if you want fries with that, right, right? But it's a corporate empire that requires fantastic people, so at a certain point, they they invest heavily in their people. Now I'm not saying you do something crazy, like, if our business burns down, we'll pay all our employees for the next year while we recover. I mean, those type of lauding promises are nice, but they're really hard for most businesses to have, especially in today's environment, to have that kind of capital sitting on the side. But it's more of, you know, we have to make a difficult decision and fire you. But here is your offboarding package, and it is like four times the size of the legal requirement. Wow, you know. Or when somebody says, I want to try something new, and you're like, I support you leaving the business to pursue your dreams, it was fantastic having you here, not turning them into viral, vile enemy, because how dare they abandon the corporation? Right? It's about how you deal with people. It permeates, you know, it's that old saying of, you know, nothing kills a great employee faster than you watching you tolerate a poor one, right? People see leadership in the management of people. And you know, if people run everything in your business and they press all the keys when you're not looking, I'm gonna argue it's probably a good plan to invest in them. Yeah,

Travis Lishok  1:09:09  
I think so. And one thing that comes to mind as you're as you're talking, Jeff, like you mentioned, IT spending, there's a really interesting book by a gentleman named Greg vandergast, and he's he was essentially writing like a critique of the cybersecurity industry, and he uses a series of graphs, and you can see cybersecurity spending, and it just looks like a rocket ship going straight and up to the right, and then he's comparing that with the number of security incidents that are also happening, which is just a rocket ship going straight up to The Right, so you have spending increasing, and the same amount that the attacks are increasing, and there's not a lot of evidence for is each dollar spent actually giving us a significant return on investment in terms of prevention and in terms of preventing, or at least mitigating the impact of. Some of these attacks. So as you, as you talk about that, it gives me the idea, we know that there's low ROI on some of that cybersecurity spending, because so many companies are just flush with money. That money for that specific purpose. There's definitely money out there for many of the larger organizations to do exactly what you said is to invest in their people in some of these basic BLS or CPR, AED first aid courses, and then just providing some of the basic resources for them to be prepared, so that when the emergency happens, the impact on them is lesser, and then they're able to support the business because they know the business is committed to them and committed to their family.

Jeff  1:10:46  
Oh, absolutely. I mean, it's, it's funny when you see that. And this is why I love Mark's work on adaptive business continuity, because when you empower a business continuity team to look at that ROI on the on the security spending, right? They're going to look at that and say, This is how we're doing it now. But comma, is this the only way that we can deal with this threat profile? And the answer very well may be yes. But I would argue that in most of those corporations with exponentially growing expenditures, they're not asking that question. They're simply saying, it just costs more. It just costs more. Well, really is that the only way to do it is there a different strategy in a different way, and again, it's about empowering people, right? I'm paying people to think of new and innovative and disruptive ways of rescuing the business, and if I give them the freedom to do that and the limited resources to do these investigations and go out and see what else is going on in the world, and come up with innovative new ways of navigating disruptions that are beyond our control, you find a you start to see that spending curve go down. The results haven't changed, the outcomes haven't changed, but they found innovative new ways to do it. It doesn't mean it's always out there, but I would argue that most companies aren't even asking the question. They're not empowering people to go out and investigate right? I'm going to pay the two minimum business continuity people I need to do the regulatory framework that I need, and that's it. Or I'm going to hire a third person, and the job interview is going to be I need you to think your job is to think of new ways of doing the same things we do. You have no deliverables. Your job here is to think innovative and disruptive ways of protecting our business. And when you start empowering that kind you start to see really innovative things. Now. Comma caveat, obviously, if you're a small company, it's hard. Oh, yeah, and right now it's a dog eat dog world in the business continuity professional services right now, I've got some friends who are consultants in here, and I won't name them by name, but they charge it an amazing amount of money to come in and write a business continuity plan for you. It'll look beautiful. It'll be on one of those binders. It'll be flashy. It'll have all your company logo on it, cool pictures of your employees in action, and all this great stuff. And they'll put it on a shelf, and they will charge you handsomely for

Travis Lishok  1:13:34  
that, right? That's the dusty red binder that's on the shelf behind them. Yeah,

Jeff  1:13:38  
absolutely. And companies will do that thinking. I need to do something in business continuity, and I don't know what to do. And the answer to that question is, empower somebody to answer that question, right? Yeah, and for me, it's always been, promote internally somewhere in your organization you have a really cool, intelligent thinker. You do. I can. I want that type of thinker. I can teach them to do business continuity, but it's like the old business adage, what's the best business education? It's liberal arts, not a Bachelor of Business Administration, because a liberal arts individual learns how to think all right, and learns how the human animal operates. I can teach them accounting. I can teach them the stuff you learn in an MBA. Nothing against MBAs. They're well, they're wonderful people, but I can teach that, right? What I can't teach is people who can think, people who are innovative, people who who are very, very curious people about new things. You can find one of those in your organization and you say, Hey, listen, I don't want you to do this anymore. I want you to come over here and do this new thing for us. Smaller organizations benefit that way when they do that from internally, right? Because. I would say that's a far better investment and a far better return in your investment than hiring a business continuity consulting firm to come in and write you a plan that, oh, by the way, for an extra amount of money, they'd be happy to run it for you in an emergency.

Travis Lishok  1:15:16  
Yeah, that's a really that's a really interesting perspective, thinking about promoting someone internally and providing them the business continuity training, because you know that they already understand the business. They have all of this institutional knowledge where they saw what happened seven years ago, when this incident occurred, and they know who works in each department, and they know the personalities of the individual departments. I think that's, that's a really fascinating way to go about it, and then thinking too about just the cost, the cost of hiring shiny consultant to create you this brand new laminated binder versus, you know, maybe like a small promotion, to take on a new responsibility, and then that person's going to feel like they have more ownership, rather than getting a binder from a consultant saying, Here you go. Carry out. Carry out what it says. I think that's, I think that's such a fascinating perspective about promoting internally. And Jeff, we're starting to get up against time here, this was a really fascinating conversation for me, and I think it really brought together a lot of the ideas that we had from talking about personal preparedness, and really framed them in the context of thinking about how we can protect our businesses and how we can get them up and running, and really just the philosophy for how to go about it, and so many of the human factors that really influence things. Jeff, before we go, Are there any other ideas that you wanted to share? And then also, please, let know, let people know how they can contact you and how they could find you.

Jeff  1:16:57  
Well, absolutely, absolute pleasure to be here. It's a lot of fun. And I really think if we remember in the framework that corporations are residents as well, they're residents of our communities as well. And in a capitalist society, in a democracy Republic, whatever phrase you would like to choose depending on your political affiliation, we survive because corporations hire people. People need those incomes and those salaries. So we our own success is vested in our corporations that we work for or own. In my case, I own a corporation. My future success invested is vested in that corporation being successful. So investing in the people, but the people also seeing that. It's not just a salary I'm earning, but I'm part of a culture and a relationship. And the more I can do to help this corporation be successful, the more likely I will have continued employment and be part of a team. And this is really where the social capital and the building of relations is key, and we just remember that corporations are not big bad enemies that are here to gouge us and steal all of our money and build millionaire yachts, but actually the residents of our community that we work for them and that they will have someday, they will hire our children, they will hire our relatives, and this will carry on we, you know, the vast, vast majority of the population the United States of America earns a salary. When you compare it to the number of entrepreneurs, every one of those people earn a salary work for a corporation, be it a public sector or private sector. It's kind of important that that corporation keeps working, so we just remember that we take away that corporate enemy thing and bury that off to the side and realize where to help. And so, yeah, so I have my own podcast. It's called inside my canoe head. Your listeners can't see but I'm wearing a t shirt that says, inside my canoe head, and I have a canoe head tattooed on my arm. It's basically my history as being a backcountry paddler. It's my activity in life that I love to do so that's available on all platforms we have today. We recorded the 290th episode since we've been out four years. And all the episodes are based on emergency preparedness. Our website is preparedness labs.ca.com, but.ca for good Canadian. And right there is all of our offerings. We've got a bunch of free downloads, new newsletters, and a couple of paid products, if people are interested. But really, there's a whole bunch of free products on there that people can that people can download and follow, etc. And the podcast has its own website at triple W inside mycanuad.ca and so our mission as a corporation, and I'll just give this little plug here at the end, is to provide non apocalyptic, evidence based Preparedness Education for rational people. So we do not believe society is collapsing. You don't need to become a prep doomsday prepper, and you. Don't need to live in a year in the woods. However, the 2020s are going to be spicy. They're continue going to be disruptive, and those disruptions will occur in political, cultural, economic, familial and natural circumstances, and you need to be ready to navigate those. And that's the type of information that we provide, things that help you rock an incredible life and chase your dreams, not something that tell you you need to bunker down in your basement and wait for the apocalypse to pass. I apologize to all those that are hoping that the society collapses so all that 10s of 1000s of dollars they spent on all that Gucci gear is useful, because there's nothing worse than buying all kinds of stuff for an event, and the event never happens. And that's why, like you open the the podcast was saying, we believe that preparedness is a lifestyle, not a stockpile, and you can't buy your way to preparedness. You have it's cultural. You have to adopt it as a lifestyle, and that just enables you to do whatever you want to do, knowing that when the bad day happens, you've got a plan in place, but it was an absolute pleasure to be here. Um, fantastic topic. I could talk about business continuity for hours,

Travis Lishok  1:21:15  
of course. And congratulations on 290 episodes. That's a huge milestone, Jeff. So yeah, I'll be sure to link to your podcast, link to your website and some of the articles and other content that you're producing, and then yeah, for listeners, get out there. Check out Jeff's podcast. Share it with your family. Share it with other people in your community. The more, the more the community can be prepared, the better resilient we're all going to be if any type of unforeseen event impacts us. So definitely get out there, consume some of the content, and if you have any questions, definitely reach out to Jeff and seek out his resources for more education. So Jeff, thank you very much for joining me today. It was great,

Jeff  1:22:02  
absolute pleasure. Take

Travis Lishok  1:22:03  
care. Take care. And that concludes today's episode....

Share this
Exit mobile version