Business continuity management has rapidly emerged as an important business activity. But because business continuity lacks a traditional mandate within the business world, companies are unsure where it fits within the corporate structure. Is it an IT specialization, an aspect of physical security, or a part of risk management? Without a widely recognized space, business continuity gets placed in different locations in different organizations, often landing wherever space happens to be available. “The IT folks are short a position, let’s put it there;” or better yet, “The security director needs more reports, and the IT director is overloaded, so we’ll put it under security.”
This puts the business continuity manager into a difficult position. He or she must develop an enterprise-wide business continuity program, bringing together disparate – if not hostile – elements of the organization into a cooperative program. The business continuity profession must not only manage without authority – a trick in itself – but also without the support and status afforded to traditional functional areas within the organization.
The lack of an accepted place within an organizational structure also leaves the business continuity manager without any discernable career path. The manager can orbit like a satellite on the periphery of the organization, looking for a segue into the decision-making nucleus of the firm.
One source of the problem is that most practitioners come to business continuity management from other fields such as IT or emergency management. This leads those outside of the profession to wonder if there really are any unique skills that distinguish the business continuity professional from those in other areas.
For business continuity management to become recognized as an essential element of good business practice, it will need to be associated with a unique set of skills and competencies that are on par with other recognized functions, such as marketing, accounting, human resources, and the like.
Higher Education
Enters the Picture
Business continuity professional associations such as ICOR, BCI, and DRI International have done much to define the common body of knowledge for professionals through certifications and certifying exams. But the recognition of these certifications is primarily internal to the profession. Those within the profession understand what the CBCP means, but not many outside of it.
Legitimacy to those outside of a profession comes with recognition from an external source. Traditionally, this source has been higher education. College degrees bring legitimacy to a field. This has been true of nearly all professions, from law to medicine to engineering. People outside of a profession understand what a degree means. It signals the recognition by academia that the profession has its own unique skills and body of knowledge which merit extended study.
A Texas college recently launched a certificate in “equine therapy.” No, it’s not therapy for horses, but rather the use of horses in therapy for people. While it may be odd, the mere fact a college program exists in the field lends it legitimacy in most people’s mind. There must be something to horse therapy if there is a degree for it.
Colleges are just starting to take notice of the business continuity field. The first degree devoted solely to business continuity was Norwich University’s online master of science in business continuity management. Designed for the working adult and completed in 18 months of continuous coursework, the degree covers all aspects of business continuity management, as well as associated fields such as risk management and organizational resiliency.
Boston University takes a somewhat different approach with its master of science in business continuity, security and risk management. Their program provides a straight-forward MBA core with a business continuity, security, and risk management specialization.
Beyond these two offerings, there are a large number of emergency management programs at the associate, bachelor’s, and master’s degree levels. In the post-9/11 environment, many universities quickly rolled out emergency management and homeland security programs targeted to public sector first responders and emergency management officials. These can be found at FEMA’s College List of Emergency Management programs at http://www.training.fema.gov/emiweb/edu/collegelist.
The proliferation of emergency management programs was partly fueled by Department of Homeland Security initiatives to cultivate programs for public officials. The Naval Postgraduate School even went so far as to develop an entire homeland security master’s program – complete with assignments, readings, lectures, and exams – which they gave out free of charge to any institution willing to use it. Dozens of institutions have adopted this curriculum under their own label.
Unfortunately, far less attention has been paid to the private sector preparedness, despite the fact that most of the nation’s critical and economic infrastructure is in private hands. Only very recently have programs emerged focused on business continuity, including the more general category of continuity of operations, to produce practitioners who will create programs to sustain organizations during an emergency. Nearly all of the emphasis until recently has been on the public sector emergency management side.
Benefits to the Profession
The emergence of professional degrees in business continuity will distinguish the field from other professions and put it on the same footing as other areas within the corporate world. Eventually, graduate degrees may even become expected of a business continuity professional, just as MBAs are expected of certain business positions.
A master’s degree in the field will provide business continuity professionals with a spot at the table of corporate decision-making. As business continuity professionals know, it is critical that continuity considerations be included in the development of new systems rather than after the fact, and moving the professional to the table will further that effort.
Higher education degrees will also open up more positions within the field. The fact that there is a professional degree in the field will elevate the importance of the position in the eyes of the organizations. Coupled with initiatives such as the forthcoming voluntary (and perhaps eventually involuntary) Private Sector Accreditation and Certification Preparedness Program currently under discussion at the DHS, and the ANSI North American Business Continuity Standard, credentialed professionals will be in greater demand to develop the programs and manage them on an ongoing basis.
Higher education will also advance knowledge in the field through research. A field needs systematic research to take it forward, and business continuity is no different. Some critical questions are yet to be explored.
For instance, David Lindstedt points out that we cannot justify the value of a business continuity program simply by appealing to the amount that is lost without a program. It could be that just as much would be lost with a business continuity program. The business continuity field needs to demonstrate that business continuity programs result in less loss to the business. This sort of research is currently lacking in the field and can be fostered through the academic program.
Research is also needed to answer questions like, “How prepared is prepared enough?” Every month a dozen “Oh my, we’re so unprepared” reports emerge, warning that we would not be able to fully handle a particular type of disaster. A report recently warned that charities would be unprepared for the human toll of a major disaster.
But this raises the question, do we really expect charities to handle the human toll of any disaster? More importantly, is it even possible to be fully prepared for any contingency, and can we even know what that would look like? How would we know that we were prepared for anything? The point is that anybody can claim that we are unprepared for some contingency.
The field also needs to move beyond vague standards like “adequate protection must be in place …” to more substantive best practices to measure programs against.
A surgeon cannot be held liable (at least in principle) just because a procedure fails. A lawsuit requires demonstrating that accepted medical practice was not followed in the situation. The medical field has defined these best practices expected of practitioners. The business continuity field will need to do the same to allow practitioners to make the case to their organization to invest in continuity programs because they are not up to best practice.
This research will come not only from the higher education scholars but also the students who emerge from professional programs. A graduate program is forward-thinking. Students do not just learn the current common body of knowledge, but question that common body by putting accepted orthodoxy under pressure to identify the cracks. Graduate programs engage the students in research that will itself advance understanding in the profession.
Benefits to the Practitioner
But what benefit will a degree provide the practitioner in the field, especially one who already has a professional certification?
Certifications have a place within any profession, including business continuity. A doctor needs not only a medical degree from an accredited medical college to practice, but must also be board certified through an exam. A degree does not replace certifications; it supplements them.
A degree program fills in the gaps of a professional’s experience by providing a guided journey through the profession. Professional conferences are good places to get updates on the most recent events in a profession, but the cafeteria-style options do not lend themselves to a well-rounded understanding of the profession. Conference attendees explore what they want to know, not necessarily what they need to know. By contrast, the curriculum in a degree program is chosen by professionals who determine what the student needs to know to be a competent practitioner in their field. A professional degree is a good entry point into the field.
A degree program also provides the practical application of concepts needed for real learning. This may come as a surprise, since higher education is often criticized – and rightly so – for being divorced from practice. But a good program can meld theory and practice. Norwich University uses a unique case study approach in which students apply what they learn to their own organization, analyzing their organization through consulting reports that apply what they learn in their classes. The students get to see how the concepts play out in real life and the experience of making recommendations to those outside of the profession.
For instance, imagine that the week’s topic is physical threats to the information infrastructure. Students not only learn about those threats, but then examine the vulnerability of their own organization to those threats. Where they find gaps, they suggest solutions. It’s a win-win situation. The student sees how theoretical concepts apply to practice, while their organization realizes the immediate ROI of consulting reports that improve its security.
This kind of practical application of concepts is not possible in a week-long certification exam course because the course is focused on passing the exam. The exam itself covers different facts related to the profession, such as the parts of a business impact analysis. The exam does not test the ability to apply those facts in an organizational setting.
A degree is focused on acquisition of enduring skills to be applied in the workplace. Students are not just tested on facts, but discuss topics and demonstrate the ability to synthesize knowledge in written form to analyze situations and make recommendations. Students will also explore related topics that are a part of their job.
A degree program also provides a greater breadth and depth of understanding than is possible in an exam preparation course. Eighteen months of sustained study allow a week or more to be spent on topics that would be covered in an hour in a certification course. Different perspectives are examined, not just the one espoused by the certifying organization.
What to Look for in a Degree
There are a number of things to look for in a degree program. Not surprisingly, the first is quality. The explosive growth of adult education has attracted a number of new players into the market, many of whom lack a solid academic foundation. For-profit “diploma mills” have entered the market promising a degree based entirely on prior experience or with minimal work. Money spent on these programs is wasted not only because they provide no real education, but because the diplomas are not respected.
Look for an institution with some history, not necessarily the oldest one, but at least a track record to establish its legitimacy. Also make sure it is regionally accredited. Regional accreditation is the original, and most respected, form of accreditation. Any legitimate institution will have regional accreditation, the gold standard for accreditation.
Institutions that were not able to attain regional accreditation banded together to form their own accreditations with impressive sounding names, but these self-accreditations carry little weight.
For instance, regionally accredited institutions are not allowed to accept transfer credits from non-regionally accredited institutions. Courses earned at non-regionally accredited institutions will not be transportable if the student wants to change schools.
Next, look at the curriculum. As mentioned, a program might focus on public sector emergency management or homeland security rather than business continuity management. Also, a program might focus on business continuity management, or be a hybrid of different areas. A hybrid might best match your career goals, or leave you spending money on topics that are not relevant to your plans. It all comes down to fit within your goals.
A good degree program should use faculty with both teaching and professional experience. Teaching is its own skill but also requires the ability to connect with students. Adult students in particular will soon recognize when an instructor lacks the practical experience to understand how the topics relate to their students’ work environment.
It is also critical to investigate program graduation rates. Differences in quality and student support have resulted in a wide range of graduation rates, anywhere from 14 to 85 percent. Starting a program with a 20 percent graduation rate gives you only a one in five chance of graduating. Not the best odds. Dropping out after half of the program wastes all of your money. Paying more for a program with better outcomes and success rates can pay dividends down the line. After all, a college education is an investment in your most valuable asset: yourself.
Perhaps most importantly, make sure the program is designed for the working adult, not the traditional student. There is a difference. The working adult has responsibilities not faced by most high school graduates. For instance, most working adults cannot take two or more years off from work or away from family to complete their education. This is why online education has become the preferred avenue for adults to realize their educational goals.
Online education has transformed adult learning. Far from the isolating effects of the old correspondence courses, online courses provide constant, lively interaction between participants through discussion boards. Students are given often controversial questions that they must debate with their peers through discussion postings. Many times these questions ask participants to apply the course material to their own experience to create new understandings. For instance, a question might be: “We’ve studied the classic business impact analysis, but in reality, the information just doesn’t exist to do an authoritative examination of the options. It’s just guesswork. Do you agree or disagree? Why?” Imagine the discussion among practitioners over this statement.
A good higher education program will make use of its students’ collective experience to add to their educational outcomes. Students can learn nearly as much from each other as from the instructor through discussion with peers on the topics covered in class. The material is only a starting point. Real learning comes in the analysis and application of that material. Theoretical study should be combined with students’ and instructors’ practical experience to develop new ways to look at problems and find solutions.
Student support is also critical to success in a professional program. Returning to school is an adjustment for a busy adult, and a program needs to support a student through that adjustment period. This means having people and systems available to handle technical, financial, and learning issues.
Higher education’s recognition of business continuity as its own unique field is a watershed event within the profession. It legitimizes the years of work that have been put in by practitioners and professional associations in defining the field and will build on that work to take the profession to the next level.
John Orlando, Ph.D., is the program director for the Norwich University Master of Science in Business Continuity Management.
"Appeared in DRJ's Spring 2009 Issue"
