As Published in the September/October Issue of Continuity Insights Magazine
I received an e-mail right before the editorial deadline for this issue that made me scrap my original column idea and go in a different direction. That e-mail went something like this:
“Our organization has spent considerable time and effort on business continuity planning in general (an all-hazards approach), and we’ve also done a lot specific to pandemic preparedness. Here’s the problem-we have a number of executives ‘running around’ building plans independent of what’s been done. Do you have any suggestions? Why is this occurring?”
This seems to be a very common occurrence, and I would argue that there are two root causes. Many business continuity (BC) professionals are successful when it comes to planning, as they understand planning methodologies and best practices. However, they fail to recognize two key aspects that negatively influence preparedness, overall readiness, and the perception associated with their program: creating awareness and executing response and recovery activities.
Focusing on planning, while neglecting awareness activities and failing to be vigilant when it comes to utilizing BC solutions during disruptive events, may lead to ad hoc response and recovery efforts, and longer-term issues with program perception (specifically, criticism regarding the value that the business continuity professional offers). The remainder of this column defines the BC professional’s “other two” responsibilities and how to address related deficiencies.
Most business executives share a common characteristic-strong initiative. And when they discover an issue, real or imagined, they often charge ahead with a solution, sometimes without making the necessary inquiries regarding current-state capabilities to address the issue. This is often the case when it comes to continuity. Many executives, particularly those disengaged from the planning effort, fail to understand current-state response and recovery strategies. They also fail to appreciate the value of proactive preparedness, thinking an ad hoc response effort will suffice.
Recommended Solution: Develop and implement a recurring awareness program that introduces BC processes and strategies to all levels of management – even the most difficult detractors. Offer program summaries throughout the organization that address program scope, strategies and capabilities, and afford key managers the opportunity to practice by participating in exercises. Ensure that all key stakeholders are aware of your organization’s pandemic strategies and the roles they play. Create and deliver a strong value proposition to your most important stakeholders, especially those who haven’t been deeply involved in the planning effort. Motivate them to stay engaged and participate.
Executing Response and Recovery Activities
During exercises, business continuity professionals push hard to get participants to use their plans, review and validate procedures, and offer feedback. They discuss how to activate plans and initiate response and recovery strategies. But many BC professionals fail to connect the dots during a potential crisis situation and take a leadership role in:
- Assessing how events or activities impact their organization’s interests
- Offering a recommendation regarding convening the team for more in depth dialogue
- Updating the crisis management team with a situation assessment
In these situations, someone else often takes the lead, resulting in a delayed or potentially ineffective response if they aren’t trained or weren’t involved in planning efforts.
Recommended Solution: Develop processes and methods for capturing information that will enable timely reaction to potential crisis situations (an “early warning” network). Define quantitative and qualitative triggers that lead to formally activating response and recovery strategies, which include convening crisis/incident management teams to assess the situation and make preliminary response and recovery decisions. Exercise the activation process to ensure all participants understand expectations, as well as roles and responsibilities. Ultimately, be prepared to take action: it’s your job.
We need to recognize that analysis and planning activities are important tasks, but they represent only a fraction of what we do. We must evangelize the work done and the resulting capabilities that the organization now maintains. Most importantly, we need to know “when to pull the trigger,” meaning when to bring crisis and incident management teams together to identify the response and recovery strategies to implement. Failure to activate BC teams and strategies could result in a serious loss of confidence and may be a serious source of embarrassment if executives attempt to fill a perceived void. Create awareness regarding current-state BC processes, and carefully evaluate business issues that could lead to a disruption by using your organization’s “early warning network”-this network will offer the information necessary to make timely BC process activation and implementation decisions.
Avalution Consulting: Business Continuity Consulting