Fall World 2014

Conference & Exhibit

Attend The #1 BC/DR Event!

Summer Journal

Volume 27, Issue 3

Full Contents Now Available!

What can your BCM Tool do for you?

Written by  Timothy J. McCormick, CSQE, Sr. Manager of QA and Product Services, Paradigm Solutions Int'l March 16, 2010

How to demonstrate measurable ROI from the implementation of an effective BCM tool.

Introduction

In the economic landscape of today, it is no news to anyone that we see companies that have been in business for generations closing their doors.  Organizations that remain are forced to have leaner operations, coordinate just-in-time inventory levels and manage the highest levels of employee productivity; all to drive sustainable profit margins and positive cash flows for the stakeholders.  Even government agencies, especially at the local and state levels, are struggling with dwindling revenues from their private sector constituencies, facing increases in unfunded mandates, higher costs, lower budgets and cut-backs in services and operations.  Needless to say, all spending is highly scrutinized no matter the industry or sector, and discretionary spending items are omitted from budgets without even a second thought.

This being the case, why would any organization choose during these critical times to implement a Business Continuity (BC) or Continuity of Operations (COOP) program? 

It is interesting to actually sit back and think about the question, since the purpose seems self-evident.  However, in many cases, BC/COOP is seen narrowly as the implementation of a disaster recovery infrastructure that the organization will never use, or just a “check-in-the-box” item to show auditors, resulting in the program being viewed as a cost item visible only from the expense side of the ledger.

However, Business Continuity has evolved over the decades from where it started as a DR-centric approach, as historically owned by IT, to a full enterprise Business Continuity Program which is owned in part by all stakeholders and with fiduciary responsibility and accountability held by the organization’s highest officers.

BS25999 defines BCM as: “A holistic management process that identifies potential impacts which threaten an organization and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities.”

In the spirit of this definition, the true mission of Business Continuity is to allow organizations to become more efficient in their existing processes, with defined and optimized resiliency and continuity strategies to sustain those key processes in the event of a disruption. 

Therefore, if the goal of the Business Continuity Program is to reduce exposure factors and optimize resiliency strategies of the key processes, then the goal of any BCM tool is to provide practical and logistical support for implementation and management of these goals.

In the following sections, we will explore the value proposition and goals for the BCM program as the basis for the benefits and return on investment (ROI) for a BCM tool.  From the BCM value proposition, we will formulate the ROI calculation specific to BCM.  Then, we will consider potential offerings for automation and BCM tools that can help to implement and leverage the maximum return on investment for BCM, with suggestions for the practical application and tangible methods to measure the benefits.

BCM Value Proposition

The value proposition for the BCM investment has the potential to provide the following three benefits: 

  1. Optimize response times.  Quickly and efficiently respond to an incident by gaining an understanding of the organizational threats and risk thresholds (both quantitative and qualitative.) Demonstrate alignment of defined emergency response and operational recovery processes consistent to these thresholds. (“Where are the pain-points for an outage within my organization and where or how do I need to respond first, second, third, and so on…?”)
  2. Reduce downtime losses.  Sustain or recover critical functions more quickly and efficiently.  Demonstrate gains from a reduction in the observed tangible and intangible losses stemming from an outage. (“Was I able to manage and reduce the level of pain encountered during the incident?”)
  3. Increase productivity for normal operations.  Provide gains in the efficiency and resiliency of the organization’s key processes. (“I now fully understand the requirements of my process and dependencies to other processes, and have been able to align expectations to other stakeholders and implement productivity gains for normal operations of the process within my organization.”

Implementation of an effective BCM tool will enable the organization to facilitate and demonstrate the ability to define, manage, communicate, train, exercise, maintain and perform ongoing process improvement as related to these BCM value proposition items.

The BCM ROI Method

The return on investment (ROI) for any investment type is generally calculated as:

ROI = [Gain from the Investment]-[Cost of the Investment] / [Cost of the Investment] 

A result is produced in one of three possible categories: Negative ROI, Breakeven, and Positive ROI.  For example:

  • If I spend $25 to gain $20 in efficiencies, there is a -0.2 or -20% return on investment;
  • If I spend $25 to gain $25 in efficiencies, there is a 0.0 or 0% return on investment;
  • If I spend $25 to gain $40 in efficiencies, there is a 0.6 or 60% return on investment;

If we apply this formula to the BCM investment, the BCM Investment Cost factor is based on tangible data gathered from:

  • Program Implementation Time in Resource cost per hour,
  • Program Administration Time in Resource cost per hour,
  • Plus any upfront and ongoing Equipment, Software or other services and expenses.

The BCM Investment Gain can be based on tangible factors from data or test results showing:

  • The value of optimized response times. 
  • The savings from reduced downtime losses. 
  • The benefit from increased productivity output. 

Therefore, the BCM ROI formula is:

BCM ROI = [Optimized response gains + Reduced downtime losses + Increased productivity gains]-[BCM Investment Cost]/ [BCM Investment Cost]

The investment in a BCM tool will have the multiplied benefit of providing savings and efficiencies in both the Investment Cost part of the equation by reducing the impact of implementation, administration and ongoing maintenance; as well as the Investment Gain part of the equation by facilitating and generating even higher returns on gains for managing organizational response times, downtimes, and operations as compared to a manual or paper-based solution.

Increase ROI with effective BCM Tools

The value of an effective BCM tool can be attributed to:

1. Speed of Implementation.  Tools can significantly reduce the implementation time (duration) of the organization’s BCM Program, thereby reducing the actual risk of not having a plan or not having an effective plan in the event of a disruption.  [Saves X weeks for implementation.]
2. Effort of Implementation.  The amount of effort and resources required to build the methodology, define the references and hierarchies, templates, forms, libraries, and creating and managing the activities leading to an operational business continuity program can be a staggering endeavor.   Tools and automation can help to minimize the implementation effort. [Reduces Y FTEs over X weeks for implementation.] 
a. Predefined and customizable out-of-the-box methodologies.
b. Suggested activities, forms and templates tailored specific to your industry, framework or requirement guidelines.

i. Planning templates
ii.Sample documents, forms
iii.Out of the box surveys
iv.Predefined tasks and activities

c.A definable reference document library with full document control capabilities to centrally import and manage vital BC/DR documents and records such as:

i.Policies & Procedures
ii.SOPs
iii.Facility diagrams
iv.Forms
v.Checklists
vi.Charts

3.Ease of Administration. Effective tools will provide the ability to easily modify and update the dynamic organizational data as changes occur over time.  This will maximize accessibility and minimize the change management effort to publish updates to the planner and recovery team members. [Reduces ongoing administration time to manage planners, hierarchy and data changes by an average of Z FTE hours per week.]

a.Definable organizational hierarchy and locations structure.  When changes in the functional or geographic layout of the organization occur, the organization unit structure, locations and relationships will be able to be added, modified, moved or deleted.  The reference data changes will automatically cascade and move with any data tied to this structure.

b.Role-based Permissions.  Plan developers will be able to be added into definable user groups with preconfigured role-based privileges, easing the effort to define, add, modify, filter, maintain and delete user access to proper data and functions.

c.Data Privacy and Security.  With BCM tools, planners will only be able to view, access or edit data and content based on specific need and requirement.  All data and content is filtered based on the user’s access privileges.  Planners can perform activities and updates within respective workgroups without having access to sensitive data from other planners or work groups.

d.A centralized resource library with the ability to import and inventory asset data and resource information that will be defined once and leveraged in multiple places for impact analysis and plan development.

e.Automatically synchronize contacts (employees, vendors, customers, etc.) with external databases.

4.Perform routine BIA and Risk Assessment.  Organizations are evermore dealing with dynamic structural, operational and technology changes which have a direct effect on the appropriate recovery strategies and recovery resources.  The BIA and Risk Assessment are needed to be performed more frequently; however the effort to perform a manual BIA and Risk Assessment is a significant endeavor for the typical organization.  BCM tools will enable the organization to perform a routine BIA more frequently and with less effort as compared to the manual process. [Reduces Y FTEs over X weeks to perform the BIA and Risk Assessment.]

a.Web-based BIA Questionnaires can be performed remotely and with the ability for the participant to collaborate answers with stakeholders, versus time-consuming face-to-face and on-the-spot interviews.

b.BIA Questionnaires can integrate with the sanctioned organizational resource library.  This will increase awareness on gaps and expectations, increase accuracy in reporting and eliminate free-text anomalies. (e.g. – ‘Outlook’ vs. ‘MS Outlook’ vs. ‘Email’ vs. ‘E-mail’, etc.)

c.View dynamically-generated dependency data and diagrams on inflows and outflows to quickly and easily understand relationships between processes and functions within the organization. 

d.View system-generated Recovery Time Objectives, Maximum Allowable Outages and Recovery Ranking scores to identify the priority order in which the organization units need to recovery.

e.Perform ‘what-if’ scenarios to refine organizational parameters, thresholds and outcomes.

5.Efficient Program and Plan Administration.  BCM Tools provide the ability to manage and monitor progress on program and plan development.  [Streamlines or reduces Y FTEs over X weeks to manage and monitor Program and Plan development as compared to constructing manual status reports, manual interviews on progress, etc.]

a.Provide a visual dashboard of progress information.

b.Plan management, Task management and exception reports related to progress on activities.

c.Workflows for plan development, review and approval.

d.Automated alerts and status updates to affected stakeholders.

6.Efficient Plan Development and Approval.  At the core of an effective BCM tool should be the ability for organizational staff to easily, efficiently and effectively build and maintain their functional recovery plans (without the need to be re-trained every time they need to perform an update.)  Enables various stakeholders as plan reviewers and approvers to be able to view and approve online plans with automated triggers and alerts.  [Reduces Y FTEs over X weeks to perform plan development, review and approval compared to the manual process to build, update and review plans.]

a.Enables a decentralized plan development approach where persons closest to the process can easily build and maintain their own continuity plans.

b.Effort to build, review and maintain plans is efficiently shared by all across the organization.

c.Utilize predefined planning templates and centralized reference documentation in order to build plans and maintain plan updates in significant less time than with a manual or paper-based process.

7.Meaningful Plan Testing and Exercising.  The value and benefit of the continuity effort is measured most directly when plans are put into action and evaluated for accuracy and effectiveness.  BCM tools will allow the organization to demonstrate the operational effectiveness of the BCM Plan. [Reduce operational and planning flaws or omissions by N defects.]

a.Verify remote and non-remote access to current plans.

b.Simulate the activation of plans and implementation of recovery procedures.

c.Measure the actual versus estimated time to complete tasks.

d.Verify the actual tasks and resources required to be performed by Recovery Team Members in order to sustain critical functions.

e.Perform lessons-learned and ongoing plan improvement activities based on findings and recommendations from the event archive.

8.Recovery Management and Emergency Communications.  BCM tools will allow the organization to perform crisis management and sustain critical processes using approved and verified continuity plans.  [Optimize the response and recovery timeframe by X hours compared to a manual process.]

a.Declare an event and quickly activate a filtered selection of plans based on the type, location and organizational unit(s) affected by the incident.

b.Perform crisis communications using predefined contact lists and contact profile information as documented on the dynamically-updated plans.

c.Change or update the implemented version of the plan on-the-fly in recover without affecting the approved version of the plan.

d.View the Recovery Management dashboard information regarding progress on the recovery effort.

Summary

The investment in an effective BCM tool will enable the organization to increase their understanding and management of exposure factors and key operational processes, while optimizing the resiliency and continuity strategies to sustain those key processes.

BCM tools will be required to provide increasing capabilities for analytics, metrics and reporting in order to realize the optimal return on investment. 

The best BCM tools will provide efficiency and ease-of-use for a lower total cost of ownership and decrease in the overall Investment Cost, while at the same time provide advanced features to optimize crisis response, minimized downtime, and improved operational productivity in order to increase the overall Investment Gain. 

How to demonstrate measurable ROI from the implementation of an effective BCM tool.

Download in PDF format


Introduction

In the economic landscape of today, it is no news to anyone that we see companies that have been in business for generations closing their doors.  Organizations that remain are forced to have leaner operations, coordinate just-in-time inventory levels and manage the highest levels of employee productivity; all to drive sustainable profit margins and positive cash flows for the stakeholders.  Even government agencies, especially at the local and state levels, are struggling with dwindling revenues from their private sector constituencies, facing increases in unfunded mandates, higher costs, lower budgets and cut-backs in services and operations.  Needless to say, all spending is highly scrutinized no matter the industry or sector, and discretionary spending items are omitted from budgets without even a second thought.

This being the case, why would any organization choose during these critical times to implement a Business Continuity (BC) or Continuity of Operations (COOP) program? 

It is interesting to actually sit back and think about the question, since the purpose seems self-evident.  However, in many cases, BC/COOP is seen narrowly as the implementation of a disaster recovery infrastructure that the organization will never use, or just a “check-in-the-box” item to show auditors, resulting in the program being viewed as a cost item visible only from the expense side of the ledger.

However, Business Continuity has evolved over the decades from where it started as a DR-centric approach, as historically owned by IT, to a full enterprise Business Continuity Program which is owned in part by all stakeholders and with fiduciary responsibility and accountability held by the organization’s highest officers.

BS25999 defines BCM as: “A holistic management process that identifies potential impacts which threaten an organization and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities.”

In the spirit of this definition, the true mission of Business Continuity is to allow organizations to become more efficient in their existing processes, with defined and optimized resiliency and continuity strategies to sustain those key processes in the event of a disruption. 

Therefore, if the goal of the Business Continuity Program is to reduce exposure factors and optimize resiliency strategies of the key processes, then the goal of any BCM tool is to provide practical and logistical support for implementation and management of these goals.

In the following sections, we will explore the value proposition and goals for the BCM program as the basis for the benefits and return on investment (ROI) for a BCM tool.  From the BCM value proposition, we will formulate the ROI calculation specific to BCM.  Then, we will consider potential offerings for automation and BCM tools that can help to implement and leverage the maximum return on investment for BCM, with suggestions for the practical application and tangible methods to measure the benefits.

BCM Value Proposition

The value proposition for the BCM investment has the potential to provide the following three benefits: 

  1. Optimize response times.  Quickly and efficiently respond to an incident by gaining an understanding of the organizational threats and risk thresholds (both quantitative and qualitative.) Demonstrate alignment of defined emergency response and operational recovery processes consistent to these thresholds. (“Where are the pain-points for an outage within my organization and where or how do I need to respond first, second, third, and so on…?”)
  2. Reduce downtime losses.  Sustain or recover critical functions more quickly and efficiently.  Demonstrate gains from a reduction in the observed tangible and intangible losses stemming from an outage. (“Was I able to manage and reduce the level of pain encountered during the incident?”)
  3. Increase productivity for normal operations.  Provide gains in the efficiency and resiliency of the organization’s key processes. (“I now fully understand the requirements of my process and dependencies to other processes, and have been able to align expectations to other stakeholders and implement productivity gains for normal operations of the process within my organization.”

Implementation of an effective BCM tool will enable the organization to facilitate and demonstrate the ability to define, manage, communicate, train, exercise, maintain and perform ongoing process improvement as related to these BCM value proposition items.

The BCM ROI Method

The return on investment (ROI) for any investment type is generally calculated as:

ROI = [Gain from the Investment]-[Cost of the Investment] / [Cost of the Investment] 

A result is produced in one of three possible categories: Negative ROI, Breakeven, and Positive ROI.  For example:

  • If I spend $25 to gain $20 in efficiencies, there is a -0.2 or -20% return on investment;
  • If I spend $25 to gain $25 in efficiencies, there is a 0.0 or 0% return on investment;
  • If I spend $25 to gain $40 in efficiencies, there is a 0.6 or 60% return on investment;

If we apply this formula to the BCM investment, the BCM Investment Cost factor is based on tangible data gathered from:

  • Program Implementation Time in Resource cost per hour,
  • Program Administration Time in Resource cost per hour,
  • Plus any upfront and ongoing Equipment, Software or other services and expenses.

The BCM Investment Gain can be based on tangible factors from data or test results showing:

  • The value of optimized response times. 
  • The savings from reduced downtime losses. 
  • The benefit from increased productivity output. 

Therefore, the BCM ROI formula is:

BCM ROI = [Optimized response gains + Reduced downtime losses + Increased productivity gains]-[BCM Investment Cost]/ [BCM Investment Cost]

The investment in a BCM tool will have the multiplied benefit of providing savings and efficiencies in both the Investment Cost part of the equation by reducing the impact of implementation, administration and ongoing maintenance; as well as the Investment Gain part of the equation by facilitating and generating even higher returns on gains for managing organizational response times, downtimes, and operations as compared to a manual or paper-based solution.

Increase ROI with effective BCM Tools

The value of an effective BCM tool can be attributed to:

1. Speed of Implementation.  Tools can significantly reduce the implementation time (duration) of the organization’s BCM Program, thereby reducing the actual risk of not having a plan or not having an effective plan in the event of a disruption.  [Saves X weeks for implementation.]

2. Effort of Implementation.  The amount of effort and resources required to build the methodology, define the references and hierarchies, templates, forms, libraries, and creating and managing the activities leading to an operational business continuity program can be a staggering endeavor.   Tools and automation can help to minimize the implementation effort. [Reduces Y FTEs over X weeks for implementation.] 

a. Predefined and customizable out-of-the-box methodologies.

b. Suggested activities, forms and templates tailored specific to your industry, framework or requirement guidelines.

i. Planning templates
ii.Sample documents, forms
iii.Out of the box surveys
iv.Predefined tasks and activities

c. A definable reference document library with full document control capabilities to centrally import and manage vital BC/DR documents and records such as:

i.Policies & Procedures
ii.SOPs
iii.Facility diagrams
iv.Forms
v.Checklists
vi.Charts

3.Ease of Administration. Effective tools will provide the ability to easily modify and update the dynamic organizational data as changes occur over time.  This will maximize accessibility and minimize the change management effort to publish updates to the planner and recovery team members. [Reduces ongoing administration time to manage planners, hierarchy and data changes by an average of Z FTE hours per week.]

a. Definable organizational hierarchy and locations structure.  When changes in the functional or geographic layout of the organization occur, the organization unit structure, locations and relationships will be able to be added, modified, moved or deleted.  The reference data changes will automatically cascade and move with any data tied to this structure.

b. Role-based Permissions.  Plan developers will be able to be added into definable user groups with preconfigured role-based privileges, easing the effort to define, add, modify, filter, maintain and delete user access to proper data and functions.

c. Data Privacy and Security.  With BCM tools, planners will only be able to view, access or edit data and content based on specific need and requirement.  All data and content is filtered based on the user’s access privileges.  Planners can perform activities and updates within respective workgroups without having access to sensitive data from other planners or work groups.

d. A centralized resource library with the ability to import and inventory asset data and resource information that will be defined once and leveraged in multiple places for impact analysis and plan development.

e. Automatically synchronize contacts (employees, vendors, customers, etc.) with external databases.

4.Perform routine BIA and Risk Assessment.  Organizations are evermore dealing with dynamic structural, operational and technology changes which have a direct effect on the appropriate recovery strategies and recovery resources.  The BIA and Risk Assessment are needed to be performed more frequently; however the effort to perform a manual BIA and Risk Assessment is a significant endeavor for the typical organization.  BCM tools will enable the organization to perform a routine BIA more frequently and with less effort as compared to the manual process. [Reduces Y FTEs over X weeks to perform the BIA and Risk Assessment.]

a. Web-based BIA Questionnaires can be performed remotely and with the ability for the participant to collaborate answers with stakeholders, versus time-consuming face-to-face and on-the-spot interviews.

b. BIA Questionnaires can integrate with the sanctioned organizational resource library.  This will increase awareness on gaps and expectations, increase accuracy in reporting and eliminate free-text anomalies. (e.g. – ‘Outlook’ vs. ‘MS Outlook’ vs. ‘Email’ vs. ‘E-mail’, etc.)

c. View dynamically-generated dependency data and diagrams on inflows and outflows to quickly and easily understand relationships between processes and functions within the organization. 

d. View system-generated Recovery Time Objectives, Maximum Allowable Outages and Recovery Ranking scores to identify the priority order in which the organization units need to recovery.

e.Perform ‘what-if’ scenarios to refine organizational parameters, thresholds and outcomes.

5.Efficient Program and Plan Administration.  BCM Tools provide the ability to manage and monitor progress on program and plan development.  [Streamlines or reduces Y FTEs over X weeks to manage and monitor Program and Plan development as compared to constructing manual status reports, manual interviews on progress, etc.]

a. Provide a visual dashboard of progress information.

b. Plan management, Task management and exception reports related to progress on activities.

c. Workflows for plan development, review and approval.

d. Automated alerts and status updates to affected stakeholders.

6.Efficient Plan Development and Approval.  At the core of an effective BCM tool should be the ability for organizational staff to easily, efficiently and effectively build and maintain their functional recovery plans (without the need to be re-trained every time they need to perform an update.)  Enables various stakeholders as plan reviewers and approvers to be able to view and approve online plans with automated triggers and alerts.  [Reduces Y FTEs over X weeks to perform plan development, review and approval compared to the manual process to build, update and review plans.]

a. Enables a decentralized plan development approach where persons closest to the process can easily build and maintain their own continuity plans.

b. Effort to build, review and maintain plans is efficiently shared by all across the organization.

c. Utilize predefined planning templates and centralized reference documentation in order to build plans and maintain plan updates in significant less time than with a manual or paper-based process.

7.Meaningful Plan Testing and Exercising.  The value and benefit of the continuity effort is measured most directly when plans are put into action and evaluated for accuracy and effectiveness.  BCM tools will allow the organization to demonstrate the operational effectiveness of the BCM Plan. [Reduce operational and planning flaws or omissions by N defects.]

a. Verify remote and non-remote access to current plans.

b. Simulate the activation of plans and implementation of recovery procedures.

c. Measure the actual versus estimated time to complete tasks.

d. Verify the actual tasks and resources required to be performed by Recovery Team Members in order to sustain critical functions.

e. Perform lessons-learned and ongoing plan improvement activities based on findings and recommendations from the event archive.

8.Recovery Management and Emergency Communications.  BCM tools will allow the organization to perform crisis management and sustain critical processes using approved and verified continuity plans.  [Optimize the response and recovery timeframe by X hours compared to a manual process.]

a. Declare an event and quickly activate a filtered selection of plans based on the type, location and organizational unit(s) affected by the incident.

b. Perform crisis communications using predefined contact lists and contact profile information as documented on the dynamically-updated plans.

c. Change or update the implemented version of the plan on-the-fly in recover without affecting the approved version of the plan.

d. View the Recovery Management dashboard information regarding progress on the recovery effort.

Summary

The investment in an effective BCM tool will enable the organization to increase their understanding and management of exposure factors and key operational processes, while optimizing the resiliency and continuity strategies to sustain those key processes.

BCM tools will be required to provide increasing capabilities for analytics, metrics and reporting in order to realize the optimal return on investment. 

The best BCM tools will provide efficiency and ease-of-use for a lower total cost of ownership and decrease in the overall Investment Cost, while at the same time provide advanced features to optimize crisis response, minimized downtime, and improved operational productivity in order to increase the overall Investment Gain. 

tim-mccormick-3.jpgTimothy McCormick, CSQE - Sr. Manager, Quality Assurance and Product Services, Paradigm Solutions International, has over 14 years of software, quality assurance and project management experience with leading edge software products and four years experience in Business Continuity and Disaster Recovery Planning software.  For more information please e-mail info@paradigmsi.com, visit www.paradigmsi.com or call 800-558-9568.