Business continuity is a rapidly growing risk management discipline within most organizations, but in many cases top management does not fully support business continuity efforts, in terms of both resources and program scope. Without this support, a business continuity program cannot grow and thrive.
This perspective defines the key methods to increase management’s interest in formal business continuity processes, how to understand top management’s perspective, the role of culture on business continuity decision-making, and how to ultimately present continuity requirements to management for consideration.
Seeing It Through Management’s Eyes
From the perspective of a business continuity professional, a strong business continuity program is essential to the survival of the organization. But what is top management’s perception? The first step in building a strong case for business continuity is to understand how management will view and react to business continuity needs.
First, think “top-down” not “bottom-up.” Management views business processes from a wide lens and relates to issues from an enterprise-wide perspective. Thus, you must always present business continuity ideas from this same point of view for management to fully understand continuity needs. By speaking management’s language and framing requirements in a manner that is easily understood by business leaders, your recommended requirements are more likely to be accepted.
So how exactly do you accomplish this? For one, understand the key business drivers in the organization by asking the following questions:
- What is management’s focus?
- How is management’s performance measured?
- What is the company’s mission, and its key to survival?
Understanding the answers to these questions will help develop a management mindset. Then, look at how key vulnerabilities are likely to impact vital business processes. Note the word vital. It is wasteful to present the entire list of risks that the organization could possibly face. Top management does not necessarily worry about anything other than the risks to the functions that could, as noted above, endanger the survival of the business.
By analyzing the major threats and vulnerabilities that the organization faces (and how they affect key business functions), you will be thinking in the same mindset as top management.
Understanding the Effect of Culture
The effect of an organization’s culture on business continuity is often understated; however, it can have a tremendous effect on the genesis and growth of a program. For example, it is likely that your organization maintains that its employees or customers are the number one priority. To use this advantageously, business continuity can be framed as a function to assure employees or customers of their safety. In addition, a successful business continuity program reassures customers that the business will be able to respond effectively and continue its operations during an incident.
Additionally, an organization’s tolerance for risk, also known as its risk appetite, can greatly affect the development of a business continuity program. A highly risk-averse company will be more likely to desire a strong business continuity program, whereas a culture of employees and management that think “It could never happen to us” is less likely to focus resources on business continuity. These factors must be considered and addressed up front when attempting to build a business continuity program.
Presenting Business Continuity to Top Management
During analysis, decisions are made regarding the assessment of risks and resource needs, but how do you effectively present these results to top management? Below is a list of key characteristics that can provide assurance of an effective presentation to management:
- Make it easy to understand Use simple, but effective charts and displays. Minimize wordiness and use high-level, yet vivid descriptions. Make sure your suggested plans and recommendations are actionable.
- Explain the value Provide answers to questions such as: Why should business continuity be a focus of top management? What value does it provide for the organization?
- Include cost and resource details Be specific and up-front about the needs of the program, specifically: What resources will you need to sustain the program?
- Provide a timeframe for implementation Detail in a step-by-step manner what the realistic timeline is for each step of the program. This will help them understand the progression and future goals of the program.
- Present benchmarking support
Provide management with what other organizations of similar size and industry are doing to support business continuity. What are some best practices that your organization can utilize?
By addressing these items, you can present an effective and persuasive case to management. In the end, successfully “selling” business continuity depends on two things: providing a strong value proposition (What will this do for me immediately and in the future?) and keeping it simple.
Let’s consider an example. Company X is a health services organization, and its business continuity team is presenting the Business Impact Analysis results, resource recommendations, and implementation plan. What are the key activities the team should do?
- During the analysis, the team should focus on areas and risks that management sees as important. Being a health services organization, this would mean focusing on patient care delivery.
- The team should use charts that easily summarize the BIA data and present it in a clear manner, leaving the detail in the written report only.
- The presentation should focus on the most critical and highest risk areas, again leaving the lower level results in the written report.
- The presentation should clearly detail the strategies to mitigate these risks, and the high level costs and resources necessary to execute them.
- Remember that meetings are for making decisions. Each meeting should behave a set of decisions to be made. Clearly explain the decisions you would like made as a result of the meeting.
- Lastly, the value that the program could provide should be presented.
- Overall, the presentation should answer the question, “What does my organization need and how will this provide it?”
Building a successful business continuity program is dependent primarily upon understanding your own organization, both in terms of its management and culture. Undoubtedly, these both have an impact on all business decisions and efforts, and business continuity is no exception. As each organization is unique, these ideas are merely guidelines to help form an effective, actionable plan to help management understand the need and strategy for business continuity within your organization. You must work to understand how business continuity relates specifically to your organization, which will ultimately lead to long-term success.