However, ownership of business continuity plans often is relegated to someone with far less authority within an organization and typically resides in IT. This often results in plans that are limited in scope, focused on what can be achieved most easily and that do not strategically align with business or corporate goals. In fact, business continuity projects often fail both because the authority vested in a business continuity project manager is insufficient to drive effective organizational change, and because the manager does not receive adequate resources in terms of time, people or funding.
Such inadequate planning can be disastrous. Even before the 2005 hurricane season, 93 percent of companies that lost their data center for 10 days or more due to a disaster filed for bankruptcy within one year of the disaster, according to the National Archives and Records Administration, Washington, DC. Fifty percent of those businesses that found themselves without data management for this same time period filed for bankruptcy immediately.
For a business to survive a major disaster, business continuity and disaster recovery planning must be viewed as a core business function. The post of the chief continuity officer could be compared to a chief risk officer, which we see primarily in the manufacturing and financial services segment. Beyond these segments there is much to be said for a coordinated, enterprise-wide, business-functional approach in any industry. By centralizing authority and breaking down silos of business continuity planning within individual departments, the creation of an office of CCO can both reduce the duplication of effort and the under-utilization of continuity resources that often occurs in companies where business continuity programs are more distributed.
What Are The Benefits?
The appointment of a board-level business continuity officer offers other qualitative and quantitative benefits:
- Qualitatively, the message the appointment of a CCO sends to employees, customers, shareholders and suppliers is that the organization embraces the strategic importance of business continuity ownership. It no longer falls under IT, security or any other line of business but is treated as a key business imperative that is, strategic to the livelihood and future of the company.
- The existence of a CCO ensures that continuity issues are considered a central part of executive and management decisions from the outset and throughout any business continuity planning process. Improvements to operational efficiencies are considerable. A CCO is more likely to: apply a single approach enterprise-wide to risk assessment and mitigation; to provide a single point-of-contact for regulatory, compliance and audit issues; and to streamline both communication and escalation pathways. In addition, the role of CCO brings coordination, consistency and integration to all business and functional continuity, disaster recovery, emergency response and crisis management activities. The quantitative advantages of instituting a CCO are equally important. Chief among these is the ability to reduce both costs and headcount through centralized management and staff utilization for all continuity programs, enabling companies to do more with less. Costs are further reduced because similar activities and goals are only pursued once. In part, this is achieved because the coordination of all programs from the outset precludes spending money later in the process to coordinate or align programs. The appointment of a CCO also centralizes accountability for how dollars are spent; helping to ensure that spending is more effective and consistent. As a result, companies with a CCO are likely to gain from a reduced total cost of risk management and insurance.
The Search For The Best Candidate
When searching for a CCO, companies will naturally want an individual with strong business continuity experience. It is equally important that the individual demonstrate strong abilities for leadership, communication, program management, and facilitation.
A strong CCO should persistently demonstrate the value of the program as it matches up against the company’s goals and metrics, and serve as a facilitator in aligning the continuity program with business needs. The CCO at nearly every company meeting should be willing to inquire about whether a new initiative or change at the company affects the current business continuity plan, and if so, propose changes to bring business and business continuity goals into alignment.
To be effective, a strong CCO also needs to be able to communicate effectively both up and down a company’s hierarchical ladder. A CCO should be able to understand and speak with other CXOs about what drives them, and ensure that the business continuity program aligns with those drivers. In short, an effective CCO needs to be an evangelist for business continuity within the company.
As expectations of accountability and return on investment rise, we expect more companies will make board-level appointments for continuity. Raising the level of importance for business continuity to that of finance and operations, while enabling companies to maximize the return on continuity initiatives, will drive the role of CCO into increasing prominence.
"Appeared in DRJ's Winter 2008 Issue"
