Are We Okay?

Brian Zawada, FBCI Brian Zawada, FBCI | Jul 11, 2011

As Published in the May/June 2011 Issue of Continuity Insights Magazine

When executives called you the day after the earthquake in Japan, could you answer that question?

On Friday, March 11, 2011, at 7:30a.m. EST, the Chief Operations Officer (COO) of a Fortune 500 company called the director of business continuity and asked a simple question: “Are we okay?” After waking up and watching the news, he saw the devastation in Japan resulting from a powerful earthquake, as well as the tsunami warnings throughout the Pacific including the U.S. mainland.

Admittedly, the business continuity director–despite the organization’s operations on the West Coast and numerous suppliers in Japan–hadn’t thought about preparing a response to such a question because the company is headquartered in the Atlanta area. He was out of harm’s way–but the organization wasn’t.

I’m afraid that this true story was all-too-familiar that Friday morning.

Were You Okay?
How did you fare on Friday morning? Were you prepared for questions from your executives when the news came in regarding the Japanese earthquake and subsequent tsunami?

  • Did you think to reach out to suppliers and employees in the region to begin the situation assessment and aid process?
  • Did you think about engaging procurement and human resources as partners to determine the impact of the disaster and potential exposure?
  • Did you prepare to field questions from customers, business partners, and concerned family members?

Based on my experience watching organizations react to crises and other disruptive events, it’s common to see business continuity professionals:

  1. Get caught up as witnesses, watching the drama play out in the news just like everyone else, without always connecting the dots as to how the event may impact their organization’s interests (which is interesting because in some situations, the business continuity professional may be one of the few that could!)
  2. Focus (almost exclusively) on the day-to-day planning process, rather than taking an active role in participating in the response, including the situation assessment process.
  3. Fail to reference business impact analysis and risk assessment-related information in a potential crisis in order to judge possible exposure (what may be affected).

As was the case with the COO calling the director of business continuity on March 11, executive management is looking to leverage the analytic work stemming from the business continuity program–as well as business continuity professionals–to enable a thorough, timely response in order to protect people and the organization’s ability to deliver products and services.

So, would you say you’re viewed as an advisor in your organization? If not, what are the keys to transitioning from being viewed as the administrator of the planning process to a crisis advisor that your organization’s leadership team relies on?

 

Be All That You Can Be
Regardless of your current situation, the following five recommendations are keys to “operationalizing” your program (moving beyond planning to plan) and establishing (or maintaining) your role as a strategic advisor to executive management:

  • Adjust Your Mindset
    Always be prepared to use your plan (don’t exclusively perform the role of plan administrator). Understand the situations where you are expected to form an opinion regarding a disruptive event and deliver a strategic assessment.
  • Fully Utilize Your BIA
    Perform your analyses (business impact analyses and risk assessments) knowing that they can do more than establish recovery objectives. If done correctly, BIAs and risk assessments can serve as excellent reference information in a crisis.
  • Establish an “Early Warning System”
    Identify appropriate sources of information and subscribe as necessary to ensure timely, advanced notice of possible threats. Be prepared to digest raw data and form an opinion regarding the organization’s exposure (impact on people, processes, facilities, technology, data and suppliers). In other words, get plugged in and stay prepared to take action.
  • Practice
    Identify internal subject matter experts that can offer valuable insight at time of crisis and practice performing situation assessments with these groups. At a high-level, ensure that relationships exist between the business continuity program and facilities, human resources, procurement, security and technology (at a minimum).
  • Clear a Path
    Its one thing to perform a situation assessment, but it’s something totally different to successfully deliver the findings and recommendations. Ensure you have a method to quickly reach your organization’s decision-makers (preferably before they reach out to you) to provide succinct information that addresses the following:
    –  What happened
    –  Impact thus far
    –  How and where we are/are not at risk (discuss people first, then ability to deliver products and services)
    –  Potential for the situation to escalate
    –  Recommendations to mitigate the effects or impact

Conclusions
Nothing kills confidence in the planning process–or questions the investment in preparedness–as much as failing to “pull the trigger” and use the solutions developed. I would also argue that failing to anticipate executive/program sponsor questions can lead to being cut out of the response process, which is a lose-lose situation.

Business continuity professionals must emerge as strategic resources. Yes, we need to be good at planning and developing risk mitigation, response and recovery solutions, but we also need to strategically assess threats and understand the potential impact on the organization. We need to be prepared to succinctly answer questions such as “are we OK?”

I’m not advocating “the sky’s falling” approach, but I am advocating using the outcomes of your planning process and plugging yourself into the situation assessment and decision-making effort. In other words, be proactive versus reactive–whenever possible, develop situation assessment conclusions before being asked and be prepared to deliver a strategic recommendation. If you take this approach once, you will be on the CEO’s short-list of calls when a possible disruption threatens the organization’s well-being.

—————————

Brian Zawada
Avalution Consulting: Business Continuity Consulting