The time has finally arrived for business continuity planning professionals and the industry to abandon several misconceptions about senior management's views and attitudes towards business continuity planning. Such misconceptions include, but are not limited to, the following:
1. Senior management believes that disaster only happens to the 'other guy!'
2. Senior management is not aware of current catastrophic events and their impact on businesses (even though they all have CNN and other national news sources).
3. Senior management is unaware of Murphy's Laws!
4. Senior management is only interested in meeting fiduciary and regulatory requirements!
5. Senior management will not allocate adequate budget for business continuity!
On the contrary, senior managers are well aware that disaster could strike anyone, anywhere,anytime, and its impact on businesses, properties, and, above all, individuals and families. While certainly interested in meeting the fiduciary and regulatory requirements, the senior managers will certainly provide funding for worthy projects. In defense of senior managers, our conjecture is that we, in the business continuity industry, may be approaching the issue of gaining senior management approval in an inappropriate, generic and superficial manner. There are two issues to be addressed in this regard.
First, it is not approval that we need to get first but, rather, an enhanced awareness and on-going commitment. Second, we, as professionals ought to provide our own insights into the common body of knowledge, established standards, and professional practices and guidelines developed by industry leaders over a long period of time. However, such insights must not be superficial and generic in nature, but be concise to suit senior managers' time availability and be specific to demonstrate relevance to their business environment.
In this article, we present our views on how to enhance senior managers' awareness and gain their commitment to business continuity in a manner that is non-threatening but appealing and consensus building. In this regard, we propose training and awareness programs which may not necessarily be universally applicable, but certainly be adapted to specific organizational contexts.
Awareness and Commitment - A Distinction
Awareness refers to how an event can result in consequences to an ill-prepared organization. The principle of 'examples, examples, examples, but relevant, relevant, relevant' applies here. Specifically, an awareness training program for senior managers should not merely restate news items and facts (such as Hurricane Andrew, World Trade Center bombing, Oklahoma City Bombing, etc.). Rather, the program should clearly demonstrate how events which are relevant to an organization's physical location and business environment can lead to unwarranted and costly consequences. Commitment, on the other hand, refers to a senior management pledge to on-going organizational, personnel, and monetary support for business continuity efforts after they have been made aware of consequences without this level of support. It is important, to recognize, however, that business continuity professionals ought to clearly demonstrate added values to the organization from an on-going business continuity program.
It is imperative that a training and education program for senior managers should 'aim for awareness and then for commitment, and not just approvals!'
Know Your Audience - The Homework
The first step in preparing for senior manager awareness training is to know the audience. This should start with a research on who the target audience is, what its composition will be, what the political orientations of the audience and its members are, and what their expectations are. One can begin preparing by discussing these issues with those individuals who have made similar presentations to your target audience. Without this type of advanced 'sleuthing&' an awareness training program may not be effective. The real danger with lack of information about target audience is that we may generalize our presentation to such an extent that we lose some or all of the audience too quickly! Another important aspect to learn is the organizational structure and processing functions performed by your audience's business units.
Enhancing Awareness -Examples, Examples, Examples but Relevant, Relevant, Relevant!
An awareness program requires that the business continuity professional be knowledgeable of the risks and threats that the organization faces, which means that an initial risk assessment has already been conducted. This is important because it can be used as a point of reference to articulate to senior managers 'examples, examples, and examples of relevant, relevant, and relevant impact of events on business functions!' We emphasize examples and relevance because relevant examples and case studies pertinent to the organization are much more likely to grab senior managers' attention, rather than prior incidents that had impact on other organizations located elsewhere, which may not have any relevance to the organization.
A suggested approach is to select a business process and run through scenarios based on relevant risks and threats likely in and around the location of the organization, to better illustrate the need for business continuity planning. Another approach is to select an event (flood, winter storm, or tornado in the local area) and interactively dissect the event's impact on all of the business processes. Interactive situation assessment in this context refers not only asking senior managers questions about the impact of events, but also for the business continuity professionals to be prepared to provide answers.
Gaining Commitment -
What's in it for me?
Commitment by senior managers not only means their undivided attention during training but also a pledge of support after meeting! This means that the message is not forgotten by those subsequent to the awareness training. To ensure on-going commitment, a key requirement is the demonstration of recognizable benefits from a business continuity program. Stated alternatively, the audience should leave the meeting or presentation with a clear understanding of the value added from the commitment that the senior managers make for resources, time, and funding for the business continuity planning program.
As a business continuity planner, one must also not only articulate but also demonstrate one's own commitment to the successful implementation and maintenance of the business continuity program. It is evident that obtaining commitment is a two-way street, which the planner gives before hoping to receive! Stated another way, the planner must 'seek to understand, and then be understood!' Another principle in this regard is to 'ask not what they will give you, but ask what you can give them!' to paraphrase President Kennedy's famous words. Above all, the planner should ask himself the question: 'Is it merely a job, or is it an adventure?' These principles should steer the planner's abilities toward a path that will lead to successful development, implementation, and maintenance of the organizational business continuity plan.
Conclusions: The Top 10 List
In this article we have argued that senior managers training to enhance awareness of and gain commitment to business continuity should be based on their comprehension of relevant impact of risks and threats to the business units within an organization. We pointed out several misconceptions, but made suggestions to overcome potential pitfalls in developing senior management training programs driven by such misconceptions. The paper clarified the meanings of the terms 'awareness' and 'commitment,' and provided elements essential in a training program aimed at enhancing awareness and gaining commitment. It can be readily seen that the business continuity professional can hope to gain empowerment not only to develop the plan, but also to implement and execute the plan with enterprise-wide support, if and only if he ensures awareness and commitment on the part of the senior managers. Our suggestions are summarized in the top ten list of criteria for use in developing an awareness training approach as presented in Table 1.
Dr. Raja K. lyer, Ph.D., CDRP is an Associate Professor of Information Systems and Management Sciences at the University of Texas at Arlington. Mr. Rodolfo Garcia Diez, CDRP is a Vice President of Strategic Planning and Manager with a leading brokerage firm for the past 17 years.Printed in Spring 1997