New and emerging business continuity standards highlight that personnel should be “competent” in performing their business continuity responsibilities. This may seem like an obvious statement but it can be an area in which organizations often forget to focus. Business continuity practitioners and their sponsors that read BS 25999-2 (which summarizes this requirement in Sections 4.2.5 and 4.3.1) often ask two questions specific to the concept of competency:
- What exactly does “competent” mean?
- Who does this requirement apply to in our organization?
Personnel competency applies to a few groups of people and means something different for each. First, this recommendation refers to business continuity practitioners, or those who manage the development, implementation and maintenance of the business continuity program. For practitioners, “competency” refers to a deeper level of business continuity knowledge and experience that will enable them to lead the development and maturation of the business continuity program. Second, the requirement refers to executives, employees and business partners. For these groups, competency differs slightly between each, but it generally refers to an ability to effectively participate in the execution of the organization’s business continuity program during an event. Business continuity training and awareness is essential for all groups mentioned above, with the number one objective being to enable them to perform their primary roles within the business continuity program in an effective and repeatable manner that meets management expectations.
The following table offers examples of the type of information, skills and experiences each group should maintain in order to be effective in their role. The details below are only examples because specific competencies should be based on the unique requirements of the organization.
|Business Continuity Practitioners||Executives, Employees and Business Partners|
|This group requires skills and experiences to guide business continuity planning activities and enable the best and most effective use of program resources. This may include knowledge of business continuity methodologies / tools and industry trends / best practices, as well as organization-specific information and “softer skills” such as facilitation and communications techniques.||This group requires an adequate level of knowledge regarding the business continuity program as a whole, including its scope and objectives, how it will be implemented during the onset of an event, how to communicate and obtain updated management expectations, and their role in the response and recovery effort.|
Because both of these groups require different types (and levels) of knowledge, the training content and methods will likely differ. However, neither group necessarily requires expensive or time-intensive training. Numerous sources and methods of training are available to not only meet the competency requirement, but also to enable higher levels of business continuity program performance. Let’s briefly explore training and awareness approaches for each of these groups.
- Building Business Continuity Knowledge for Business Continuity Practitioners
Business continuity practitioners may have a strong foundation of business continuity knowledge from their previous experiences. However, many business continuity programs are initiated and/or managed by personnel who have worked in other areas in the organization before taking on business continuity for the first time. To build a solid set of skills for the new business continuity practitioner, or to fill in gaps that may exist due to limited previous experiences, consider class room training provided by third parties. However, these classes should focus on both big picture business continuity planning approaches and outcomes (including key success factors), as well as the details necessary to successfully create a business continuity capability within the organization. Be careful not to enroll in a certification preparatory class if you are new to the business continuity profession and looking to develop your knowledge, experience and capabilities. Certification preparatory classes do exactly that, they prepare an experienced professional to pass a certification examination. Certification preparatory classes do not necessarily enable the development of planning competencies. Instead, consider classes or webinars that focuses on specific business continuity topics with case study examples and hands-on activities. A few good resources for these types of classes are listed at the end of this perspective.If you are using consultants to provide assistance with the development of business continuity processes and deliverables, consider requiring your full time personnel to participate with the consulting staff in their activities. Also, have your consultants provide training on the processes or tools that they are providing to ensure that a transfer of knowledge occurs to the personnel occupying full time positions in your organization.
In addition to establishing a base level of knowledge, business continuity practitioners should be “plugged into” the industry by participating in professional associations and other industry activities. Being an active part of the profession can take many forms, including reading industry magazines and websites, posting responses to blogs, attending industry conferences, participating in local associations and organizations, or attending classes on new trends or methodologies. These knowledge sharing activities will enable business continuity practitioners to expand their knowledge base and apply these new-found experiences in their organizations.
- Increasing Program Awareness and Knowledge for Executives, Employees and Business Partners
Being able to participate in the business continuity program requires that personnel understand the purpose and objectives of the program, their role during a disaster event, and how to access and use resources. Training executives, the general employee population, or business partners will likely occur in different formats or methods. However there are a few methods than can reach all of these groups which can then be followed up with specific methods geared toward each group’s individual needs.To reach all of these parties at once, consider activities that embed business continuity into the organization’s processes. Provide regular newsletters offering a summary of business continuity activities (including testing results) and reminders on how to respond effectively. Incorporate business continuity activities into other processes such as vendor selection, employee orientation, and executive board meetings/reports. Regarding testing, include a number of diverse, employee-facing capabilities, such as sending and responding to emergency notifications and working from alternate locations.
Training executives on their specific roles and tasks can occur during the various forms of testing. Business continuity professionals may also consider providing executives with “wallet cards.” The wallet-sized cards provide high level procedures and contact information in a format that can be carried with executives at all times. The best method to keep executives up to date on program strategies is to include this information during executive or steering committee meetings so the same people that make decisions regarding risk management strategies are the ones that implement them during a disruptive event.
To train the general employee population, consider enabling plan owners to hold table top exercises. The exercise should be facilitated by the plan owner and may involve their primary recovery team or their entire department. You may also consider “lunch and learn” live or web-based seminars provided by the business continuity team on key topics. On-demand, web-based training modules are also a great way to provide training on a detailed process to a large group of people. Many organizations have a training department that can help with the development of these training modules or you can have a third party develop them for you.
To train business partners, provide them with a manual or procedures that summarize performance expectations during a disruptive event. Also ensure that these expectations are included in negotiations and contracts during the beginning of the relationship with the third party. Lastly, consider involving them during exercises to reinforce lines of communication.
The investment in “competency creation” within each of the program’s participant groups ensures that the program will develop and improve in alignment with the organization’s strategic requirements. More importantly, this investment will also deliver tangible results when the program is needed during a disruptive event. Without an effective training and awareness program, participants will remain ill-prepared to participate in planning and response / recovery activities. They will certainly lack the confidence to provide timely and value-added input during the event. For those organizations seeking BS 25999 certification, this is a key component since the standard requires that your program document targeted levels of competency and proof of training to demonstrate that the organization is working to ensure each participant has the right level of skill and experience to perform his/her role.