Business Continuity Planning in the Real World
- Published on Monday, 19 November 2007 21:31
Okay, time to get real. If someone were to believe in the above scenario, you would have to inquire about what they were smoking and cart them off to the funny farm. I guess you could idealize the above situation and wish that this were the way it should be. If you did so then you would need to add an addendum to our tale … your company would probably be filing for bankruptcy protection.
Financial service companies, all companies, are in business to make money, to make a profit. They are not in business to develop a business continuity plan. The obvious bottom-line is that if the company is not generating income and a profit then it won’t be around for very long and, consequently, won’t need a business continuity plan. But a business continuity plan is an indispensable, although too often, unrealized, unacknowledged, and unappreciated, valuable asset of the corporation.
What is needed but too many times is missing in developing and maintaining a business continuity program is a mutually respectful partnership between the operational elements of the company, the profit generators, and the overhead expense business continuity manager. There needs to be developed a balance between both parties and a clear understanding of the valuable roles each other plays in the overall success and future of the company. A “we” versus “them” approach by either party delays the process of completing the BCP project with resultant inefficiencies regarding time, cost and scope, which nicely leads into the subject matter of this article.
Developing and maintaining a BCP program is like going to the dentist or preparing your tax returns. These are things we must do, know we must do them, and know if we really admit it they are good for us but still don’t like doing them. As business continuity managers, we need to escape our parochial perspectives. We need to appreciate what profit center managers are faced with on a daily basis to accomplish their job objectives and realize that the accomplishment of their objectives pay salaries and expenses. By the same measure, we need to convey to them the necessity and importance of the work we are doing for them. We need to explain to them that we are also preserving their salaries, benefits, and employment.
Let’s look at the importance of developing a mutually beneficial working relationship between the BCP staff and the operational, profit-centered staff through the “triple constraints” of time, cost, and scope associated with project management and how these three elements relate to the job of the BCP manager.
The Triple Constraints
Both the profit center managers and the BCP manager are subject to the triple constraints of time, cost, and scope in the performance of their daily jobs. In fact, I can’t think of any successful capitalistic endeavor that does not have to daily contend with time, cost, and scope. In this article we will consider the triple constraints in the context of their applicability to the daily workings of both the profit center performers and the BCP manager.
The BCP manager must think beyond his parochial perspective in accomplishing his job objectives as they relate to the development, implementation, and maintenance of a BCP program for a profit-centered business area. The BCP manager must be aware of the triple constraints challenging the operational manager with whom he is working, let the operational manager know he is aware of these constraints, and he will work with the manager to let him get his job done while at the same time completing the necessary work to obtain an effective BCP program.
The BCP manager must be flexible in accomplishing his job objectives while at the same time getting the operational manager to realize he also has a job to do, and they must work together so they can both be successful. Since the BCP manager is “infringing” on the time, cost, and scope objectives of the operational manager’s daily job function, he must take the initiative in establishing with the operational manager a mutually respectful relationship so he can get his BCP objectives successfully completed. Obviously, the way to establish this relationship is to get the operational manager to fully understand the benefits of a BCP program in his business area. Now, let’s review how the BCP manager can accomplish a mutually beneficial relationship with the operational manager in the context of each of the triple constraints.
The Time Constraint
Time relates to money (cost), which in turn relates to scope, which we will define as job objectives, both operational and BCP. The triple constraints are dependent on each other and any change in one will most likely lead to changes in the other two. This dependency on one another is complex and cannot be standardized or easily categorized. For example, it is conceivable that a negative development in one of the constraints can lead to a positive development in another.
In his interaction with the operational manager, the BCP manager must be flexible in regard to the scheduling of time for both the operational manager and his staff. But the BCP manager has time constraints of his own, and he must accomplish his BCP objectives to meet his schedule deadlines. It would be nice if senior management were to allow both parties to “get to it when they can” but that is not going to happen because the reality is the BCP objectives would never get done. So the other reality is that both managers must meet their objectives within the time allotted by senior management.
The operational manager must meet his profit or growth goals while at the same time accomplishing the BCP goals. So before the accusations start flying in regard to why objectives, either BCP or operational, aren’t being met, the BCP manager must take the initiative to avoid such conflicts. (And besides, whom do you think will win most of these confrontations … the managers bringing in the income into the operation or the support function?) BCP managers must avoid any potential conflict by taking a proactive approach to time management.
The BCP manager must be organized when occupying the time of the operational management staff and the various process staff that will be involved in the development and implementation of the business unit’s BCP program. Meeting dates and times need to be scheduled within realistic but flexible timeframes, and, once agreed to, they need to be adhered to. In establishing meeting dates and times it is important the BCP manager give the operational manager the estimated time frames for the beginning and completion of the BCP interaction (whether developing, maintaining, or testing a plan) and the various time estimates for the completion of each phase of the interaction. Once dates and times are agreed to, you need to try to avoid rescheduling if at all possible. If there is a need to reschedule, it needs to be a senior management priority and not a “convenience” postponement. Otherwise, your BCP interaction will drag out ad infinitum and both you and the operational manager will be looking for new employment opportunities.
If you, as a BCP manager, feel you can complete the interaction in an hour and a half, then schedule for two hours. However, do not go beyond the two-hour limit. There is nothing more frustrating for an operational manager to acquiesce to committing valuable time for himself and his staff, which you have convinced him to do, then to have that time abused by miscalculation on your part and keeping his people from performing their profit-centered objectives.
We need to digress here for a moment to discuss BCP ownership. In the development of a BCP program for an operational area, when you first begin, the BCP manager and his staff own the program. We are the experts; we know the lingo, format, and purpose. Most operational managers only know the general purpose of a business continuity plan. They are relying on our expertise to get them and their staff through the process and a plan developed for them.
So, in the beginning, you are the boss. But in the end, they have to be the boss.
At the end of the development and implementation of a BCP for an operational business unit, the senior operational manager must sign off on the project. At that time, he and his staff are the owners of their plan and you are there to support and assist them in any way you can. From day one of your interaction with the operational business leader, the transition begins from ownership by the BCP manager and his staff to the operational manager and his staff. If you have done your job well and emphasized this point throughout your BCP interaction, this transition will proceed smoothly. You must let the senior operational manager know in the very beginning of the process that at the conclusion of the BCP interaction, he will be required to sign off and acknowledge responsibility and control of his BCP program.
There never seems to be enough time in the life of most operational managers, especially in a thriving and profitable corporation. In the very beginning of your interaction with an operational manager, as you explain the general timetable for your BCP interaction and then zero in on more specific phases with more definitive time guidelines, it is important that you be realistic in your scheduling estimates. The operational manager is committing the precious commodity of time for himself and his staff. Don’t sandbag your estimates to get this commitment. It is better to have senior management resolve those very few and rare cases regarding scheduling where negotiation fails between you and an operational manager. Remember you have only one shot at intergrity.
The Cost Constraint
Obviously, the operational manager of a business unit is going to incur the expense associated with the time he and his staff spend developing, implementing, training, maintaining, and testing their BCP program. And the BCP manager will incur his own costs assisting the business unit with these endeavors. Both managers have budgets to cover these expenses.
Poor planning and coordination by either or both parties will increase both of their expense budgets. Canceling airline flights, having to revisit business areas because there wasn’t enough time to complete whatever it was that needed to get done, and continually rescheduling process meetings because of other “priorities” can lead to expense budget overruns. For the operational manager this means cutting into his profit and for the BCP manager this means exceeding his expense budget for the project. Neither party wants this to happen. It is a no-win situation and most senior managers don’t want excuses or accusations, they want results.
A less obvious aspect involving the cost constraint is extraordinary expenses that are a result of the BCP process. These are expenses that neither the operational nor the BCP managers have planned in their budgets. These expenses are only incurred as a result of the BCP work being done, usually as a result of the business impact analysis and prevention/mitigation reviews, but also as a result of real life scenarios.
For example, the BIA may identify that a back-up power generator is essential because of an operation’s location in a hurricane-prone area. Because of the upcoming hurricane season, a generator vendor is found and a contract negotiated. Neither the BCP department nor the profit center business area would have budgeted for this contingency. Obviously, future budgets would include these expense contingencies, which would have been unknown until the BIA revealed a need.
Another extraordinary expense related to an example such as this would be the expenses incurred during an actual crisis immediately after the BCP program had been implemented. Operations management might decide to send employees to an airport out of state in preparation for travel to the recovery site if an impending hurricane were to destroy the building. Even if that did not occur, some expense would incur that had not been budgeted for.
During development and implementation of a corporate-wide BCP program all extraordinary expenses incurred as a result of the BCP project should be designated as corporate overhead in the BCP project budget and not charged to the profit center. However, after development and implementation, then senior management must decide if crisis expense contingencies should be in profit center budgets or in a corporate overhead budget. Since a body is made up of its parts and the loss of one part affects the whole body, my recommendation is that crisis expenses be handled at the corporate overhead level on a contingency basis and not in the individual profit centers budgets.
The Scope Constraint
Working in a competitive environment, profit centered business area managers are constantly wrestling with the literally daily changing scope of their annual job objectives as they initiate and react to the marketplace. The BCP manager’s job is more structured and less prone to scope change, especially after the development and implementation of the corporate-wide BCP program. However, it is during this development and implementation stage in which it is highly probable scope change will occur. In fact, I would suggest if a scope change does not occur during the development of the BCP program, especially during the business impact, prevention and mitigation phases of the development, one could question the authenticity of the BCP effort.
We have already discussed one example of a scope change in the cost constraint from a profit center’s need for a backup generator. What if the profit center’s corporate headquarters also required the purchase of back up generators to supplement its existing generators? What if a new building was then needed to accommodate the new generators? These items would be identified as a result of the completed BIA, and would not have been part of the original project scope for the development and implementation of a corporate BCP program.
Another example of scope change in a project to develop a corporate-wide BCP program may be discovered during the BIA process reviews with the various profit center business areas. It may be determined that additional operational areas originally deemed not critical were indeed critical and required the development of BCP programs, consequently expanding the scope of the project.
For the BCP manager, scope and scope changes affecting a BCP development project are present and straightforward and should be fairly easy to resolve through a structured decision making process. Not quite so for the operational manager whose decisions are not as easily structured and in many cases require gray area judgments, which ultimately affect the overall profitability of the corporation. I realize that all corporate areas have an impact on the profitability of a corporation; my point here is to recognize and understand the significance of the differences.
Senior Management Factor
A significant factor in the management of their own triple constraints by the BCP and profit center managers is the role played by senior management. It goes without saying that management does support the profit center managers and in many cases actively interacts with them.
The BCP manager also needs the support and realization by senior management of the importance of the BCP program. It’s simple, without that support the program will not be successful. Senior management has to be available if and when an impasse develops between the BCP and profit center managers. However, with both managers knowing that senior management has an interest in the BCP program, the two managers will negotiate most potential conflicts to resolution. Without that invisible big stick behind him, the BCP manager has an uphill battle.
The key to success for both the profit center managers and the BCP manager in the development of a BCP program is to develop a mutually respectful appreciation of each other’s job, and one way of accomplishing this is to realize the triple constraints that challenges each of them. This is business continuity planning in the real world.
George Kibildis is a Charter Property and Casualty Underwriter (CPCU), Certified Insurance Counselor (CIC), and Project Management Professional (PMP), having worked in the insurance business for more than 30 years. He is a former Army captain in military intelligence, which included work in the recovery and continuity environments. The views and opinions expressed in this article are solely his and personal and are in no manner representative of any company or organization he may be associated with.