Fall World 2014

Conference & Exhibit

Attend The #1 BC/DR Event!

Summer Journal

Volume 27, Issue 3

Full Contents Now Available!

What Do I Do If My Business Continuity Program Is Failing?

Written by  Stacy Gardner, CBCP May 25, 2010

Most organizations experience a lack of effectiveness in their program execution at one time or another – there’s no shame in this! The important thing is to not point fingers or assign blame, but to assess where program improvements are necessary and implement effective solutions. This article discusses specific actions you can take that will help you determine root issues and get your program back on track.

Once you realize your program is having efficiency and/or effectiveness issues, don’t halt all program activities. Instead, take a step back and wait to implement “big” initiatives until you have a clear understanding of what is working, what needs a better approach, and the prioritization of these activities.

To start, perform a self-assessment, with a focus on organizational alignment and overall effectiveness. Programs cannot be fully effective unless they align with organizational objectives, culture, and priorities, and have built-in methods to increase efficiency and effectiveness. Reach out to key stakeholders within the business to get their feedback. This can be done by developing a list of interview questions regarding their experiences and thoughts on the organization’s business continuity program, as well as requesting suggestions for improvement.

Additionally, assess management support and determine where limited involvement and/or resources (equipment, business unit time/availability, staffing, etc) may be negatively affecting the program’s performance. A lack of resources is one of the most frequent complaints or issues that hinder business continuity program growth and effectiveness, and management involvement in the process is an effective way to communicate any justifications for additional resources. Some key questions for each group may include:

 

Business Focused (Tactical) Questions

Management Focused (Strategic) Questions

  • What are the organization’s business continuity program strengths? Biggest performance issues or areas of weakness?

  • Is the business continuity program focused on recovery strategies that are aligned to the needs of our customers?

  • What suggestions do you have to improve the quality of analyses and plan documentation?

  • What existing preparedness activities do you feel are misaligned with the goals of the organization and business continuity program, or do not add value in understanding and protecting your area of the business?

  • Do you feel comfortable in your ability to respond effectively to protect critical assets (specifically personnel), recover your area of the business using documented resources and procedures, and communicate with key stakeholders during a disruptive event? Where can these activities be improved?

  • Do you feel the business continuity program is well aligned to the strategic needs of the business? In what ways can the business continuity program become better aligned?

  • Is the business continuity program delivering a real capability to recover the organizational resources required to deliver core products and services to our customers? If not, what improvements are necessary to enable this?

  • What concerns are you aware of regarding potential program performance issues?

  • What analysis do you feel will help quantify business interruption-related risk in a way that will enable the organization to prioritize risk treatment?

  • Are you comfortable that the program currently addresses the recovery of critical products and services?

When selecting your interview pool for both the business and executive management, try to select individuals who:

  • Are somewhat impartial or ambivalent to the value of business continuity, or who will at least take the time to give valuable, constructive feedback

  • Have the time to sit down for 30 minutes to give quality feedback

  • Come from diverse areas throughout the business

These attributes will enable the collection of honest, detailed commentary from the stakeholders on whom you depend to develop and maintain actionable strategies/plans, as well as the management team responsible for guiding and supporting the program strategically.

Another effective activity is to review best practices and published standards to determine if you are performing relevant, recommended activities that may enable a more effective, efficient preparedness effort. Management system-focused standards help with repeatability and offer ways to structure organizationally-aligned and management-involved preparedness processes. For more information on potentially valuable standards and management system concepts, review “What is a Management System?” and “NFPA 1600 2010 Edition: What You Need to Know”. Pay special attention to activities specific to “CAPA”, management review and continuous improvement.

One critical concept to remember is to start small, prioritizing key activities and resources to focus on adding response and recovery effectiveness. Don’t try to perform every improvement opportunity at once – especially if time and resources are the limiting factors. Developing realistic, actionable strategies supported by quality data that address the most critical activities or threats is more important than developing detailed, extensive strategies for each possible threat. This is where prioritization is useful. Tackle items one at a time, doing so in an order that makes sense and adds value. Possibly consider building a maturity model to develop a phased improvement approach that allows your organization and its stakeholders to measure progress.

Once core elements are in place, build upon the program as it begins to work effectively. Revisit the prioritized list of feedback and action items to see “what’s next” on the agenda. As mentioned before, continue to solicit feedback from stakeholders to make sure they understand the value in the program and their role, as well as provide suggestions for improvement.

An additional activity that adds significant value for a maturing program is a “dashboard” of business continuity activities that truly captures response and recovery performance capability (specific to the products and services within the scope of your program), rather than metrics such as the “number of documented plans” or “the number of updated BIAs”. Evaluating whether each aspect of the program truly adds value and enables an actual understanding of and protection against business interruption-related risks will help gauge program strengths and weaknesses and identify areas of focus for future program activities. For example, reporting on the business’s ability to meet a 72-hour recovery objective to resume distribution of a specific product provides management with a straight-forward view of the organization’s ability to meet a specific customer or internal risk management need.

In order to increase management involvement, present this “dashboard” of activities, as well as a summary of program successes, issues, and topics of concern, to management on a periodic basis. Consider leveraging the “management review” concept that’s described in management systems standards such as BS 25999-2. This will help ensure that management is aware of the program’s effectiveness and allow them to provide feedback on any issue or capability that may not align with organizational need.

Overall, to ensure your program stays on track:

  • Continually reassess the program by soliciting feedback from key stakeholders regarding alignment and performance;

  • Work with management to assure appropriate allocation of resources; and

  • Work with the business to invest time and focus efficiently to assure an efficient and effective program.

Prioritizing activities will help prevent the business participants from feeling burnt out from the demands of the program, enabling them to focus their time and energy on the most value-adding activities. Undertaking the steps described in this article will help you understand program weaknesses, identify opportunities for improvement, and implement valuable solutions aimed at improving program interests and effectiveness.

About the Author:

stacy_gardner_avalution.jpgStacy Gardner, CBCP, is a consultant with Avalution Consulting, a firm specializing in business continuity strategy design, development, implementation and long-term program maintenance in both the public and private sectors. At Avalution, Gardner has worked in a variety of industries to help clients develop and enhance their business continuity programs. Gardner also has extensive knowledge on pandemic preparedness and planning. In addition to serving as a consultant, Gardner is a frequent author and may be reached via email at stacy.gardner@avalution.com