Congratulations! You’ve started your business continuity planning effort—sometimes, that’s the hardest part. Now, you’re working diligently on your organization’s business continuity program, but it’s not delivering the results you had hoped. You’re performing a business impact analysis (BIA) and risk assessment, documenting plans, and socializing the next steps for your program, but it’s not progressing like you would expect or maybe it doesn’t have the capability your organization needs. So, what can you do?
This perspective outlines the common challenges organizations face when implementing a business continuity program that meets response and recovery expectations, and offers solutions that business continuity managers can pursue to address these challenges.
The Challenge: Your business continuity program does not define or articulate why the organization is actively engaged in preparing for disruptive incidents. Your executives and the organization as a whole have no idea exactly why they are investing time and resources in business continuity planning.
The Solution: Why are you performing business continuity planning? This may seem like a simple question, but it often uncovers some challenging and enlightening answers. Is your organization making this investment to address an audit finding? Are you trying to meet a regulatory requirement (i.e., FFIEC and HIPAA)? Maybe one of your customers is demanding a business continuity capability. There are many varied reasons an organization performs business continuity planning (see our perspective on why businesses undertake business continuity planning) and the motives driving your planning effort should be clear to your organization. Translating program drivers into program objectives will help sell the organization on the need to participate in the planning effort.
The Challenge: Your business continuity program simply focuses on the “boxes on the org chart”, a list of applications, or your main facilities. Now, the business continuity program is characterized as cumbersome because of the number of plans, while at the same time, it’s unclear as to the impact associated with the loss of an organizational element or an application.
The Solution: How do you define precisely “what” your business continuity program will cover, making it clear to leadership and business continuity planning professionals what is most important and enabling a focused preparedness effort? This is a key question to ask at the start of your business continuity program – and in a recurring manner as the organization changes – because all later activities will stem from the answer. It’s tempting to just say, “Everything! We need everything to run the business completely, so why not recover everything?” The trouble is, that makes for a terribly complicated, possibly overly expensive planning effort. To enable the identification of an appropriate scope, Avalution recommends looking at your organization by evaluating its products and services (internal and external facing), identifying what’s most important based on criticality criteria, and establishing a downtime tolerance based on your organization’s priorities, strategies, and obligations. From there, the organization should map products/services to business activities and resources, addressing only those elements of the business that align to the scope management endorsed. Once the organization addresses its most critical, high impact products/services, activities, and resources, it can expand the scope of the planning effort to less critical or time-sensitive business activities.
The Challenge: You’ve taken a bottoms-up approach when it comes to involving the business in the planning effort, with the goal of limiting the impact on senior management because they are “too busy”. But now, you can’t get the budget or time necessary to operate an effective program or drive continual improvement.
The Solution: To create a successful, long-lasting program, you must have the active, recurring engagement and participation of senior leadership and key subject matter experts (SMEs) within your organization from the beginning. Senior leadership, determining the scope of the program, must be actively involved throughout the initial planning process to validate conclusions and recovery priorities. Once senior leadership takes an active role in the planning process, focus and prioritization will trickle down to SMEs when they see the emphasis leadership places on business continuity. As the program matures and advances, leadership’s continued involvement will ensure a commitment to continual improvement.
The Home Stretch
Focus and Management
The Challenge: You’ve performed a BIA, identified response and recovery strategies, documented plans and procedures, and now the business is disengaged because they think “the project is over”.
The Solution: Business continuity cannot be seen as a one-time effort or a project. From the beginning, set appropriate expectations by describing business continuity planning as an evolving, recurring process rather than a project. A great solution to both facilitate program activities and build resilience into the overall strategy of the organization is to implement a management system for business continuity. This approach allows your planning efforts to align to your organizations strategy building and organizational change management process. Business continuity should be a seamless part of your business, not a special project.
The challenges outlined in this perspective are by no means the only performance issues that could be influencing preparedness success, but addressing these issues will certainly set your organization on track to build and maintain a successful business continuity program and ensure an appropriate level of preparedness for disruptive incidents.
Business continuity and IT disaster recovery planning is all that we do. If you’re looking for help with building or improving your business continuity program, we can help. Please contact us today to get started.