Most organizations now consider crisis management and business continuity to be key components of an integrated risk management program. More and more companies are hiring experienced, credentialed business continuity professionals, and many plans are being documented. However, in spite of these positive trends, a relatively small segment of most organizations’ employees are aware of their business continuity program, let alone their role in executing it should a crisis situation occur.
A Review of the Factors Influencing Business Continuity Management Program was published jointly by KPMG and Continuity Insights in early 2006, and highlights this discrepancy. 62+% of the respondents stated that a business continuity program was currently in place or that they were in the process of enhancing an existing program. On the other hand, 64% answered “no” when asked if employees get sufficient crisis management, business continuity and disaster recovery training. These results are a cause for concern, and although most business continuity practitioners agree that our industry continues to mature, clearly it’s not yet where we need to be.
The strength of a program should be measured by whether management can rely on the business continuity program. Is it possible to rely on the plans if training for internal stakeholders is insufficient? Developing and rolling-out an organization-specific, employee-focused training and awareness program, regardless of the organization’s program maturity, is a key element of recoverability.
The Value of an Awareness Program
The objective of a business continuity awareness program is to educate all employees about the roles, responsibilities and expectations before, during and after a crisis. While the content, strategy and method of executing an awareness program differs by organization, an awareness program is consistently noted as a key success factor by business continuity directors who have experienced a successful recovery.
Can we make the case that the existence of an awareness program guarantees a return on investment in terms of business continuity capability? Perhaps, particularly if:
1. Employees in general become aware of where to go and how to obtain information in the event of a disaster.
2. Management understands how to take immediate actions to protect people and property, communicate with all stakeholders, and prepare the organization for recovery.
3. Internal stakeholders and external business partners understand their roles in enabling a successful response and recovery effort.
Key Considerations in Creating an Awareness Program
Business continuity managers consistently raise a three-part objection regarding the development and/or execution of training and awareness programs:
1. Commercial training programs that are readily available are inadequate because they are a) focused on the planner, not the employee, and b) theory-based with no connection to the organization’s unique program.
2. There are not enough resources to develop and deliver custom training and awareness content because a) business continuity personnel have competing responsibilities and requirements, and b) the expense of outsourcing the development and delivery of training is outside of budgetary constraints.
3. Getting people to participate in training is very difficult – the business community always argues they have “a business to run”.
Let’s consider some of the key elements that describe the most effective training and awareness programs, and how they relate to the “objections” noted above.
1. Custom training is a must. Regardless of the training and awareness objectives, there is no such thing as commercially-available training that educates your employees on all of the key knowledge elements necessary to successfully respond to a crisis and recover effectively in your organization. Some topics that should be addressed include:
- The Primary Objective and Value of the Business Continuity Program
- How to Safely Evacuate
- Employee Accountability During a Crisis
- Crisis Communication and How to Obtain Updated Status Information and Expectations
- Call Tree Execution (if Used in Your Organization)
- Response and Recovery Team Roles and Responsibilities
- Recovery Objectives/Timelines
- Participating in a Business Impact Analysis and Risk Assessment
- Developing Strategies and Plans
- Exercises: The Values and Roles and Responsibilities
- Maintaining Strategies and Plans: The Need, Tasks, and Timeframes
2. Set learning objectives up front and then identify the training method to most efficiently and effectively reach your desired audience. Just like any other project, document training and awareness requirements, audiences, resources and the tools necessary to deliver the message and of course, prepare yourself to measure the effectiveness of the awareness program. Approaching your awareness and training development in an organized and thought out manner should help to eliminate objections #1 and #2.
3. Leverage technology to deliver training and awareness content. Business continuity managers recognize that their team will rarely grow, and in reality, they have to fight to keep their current resources. Developing ways to multiply the team is key. The use of on-line tools to develop and deliver training content is maturing rapidly. Gone are the days of Computer Based Training that quickly puts an audience to sleep. Today’s tools deliver animation, sound and video, and they are easy-to-use and cost effective. Whether or not your organization already has an authoring tool and Learning Management System (LMS), developing training in an on-line tool, posting the training to an intranet site, and letting your organization’s employees take the training when convenient for them is a win-win, overcoming objections #2 and #3.
Note: Please don’t think that leveraging technology eliminates all face-to-face interaction with your organization. It’s quite the opposite. An awareness strategy that includes technology platforms can free your team to tackle more complex issues, and even enable them to do specialized face-to-face awareness activities. Technology is part of the solution, not the solution.
4. Avoid theory. Instead, tell a series of stories to explain key concepts and provide examples (both good and bad) that are either specific to your organization or your industry. When possible, use stories that include key elements of your business’s strategy, as well as the most important business objectives. The bottom-line is BE CREATIVE and avoid over complication by using our industry’s jargon. These strategies will quickly overcome objection #3, and help your audience understand that business continuity is an important part of the work they do.
5. Be responsive to the issues confusing your organization. Conduct short surveys with employees to periodically measure their current knowledge level and identifying knowledge deficiencies. With this information, focus newsletters, emails, presentations and on-line training content to the specific needs of your organization. Meeting the needs of your business community will keep them interested and ensure that your efforts have a high return, overcoming all three of the common objections.
If You Are Just Beginning…
What if your organization is just beginning to develop and implement a business continuity program? Should you wait until the program is ready? The answer is no. “Hook” the members of your organization and enlist them in the development of your business continuity program by educating them on potential business continuity solutions in which they can assist. Again, engage your audience by customizing the message, telling stories, and asking questions (“What would you do if…”?). Teach the key elements of the planning lifecycle and outline your expectations. Once the program is in place, it’s time to educate all stakeholders on the key processes and solutions that were implemented. Always keep in mind, planning never stops, and training shouldn’t either. Investing in methods to educate your organization can multiply your business continuity planning team.
The findings of surveys sponsored by organizations like Continuity Insights, BC Management, KPMG and HP indicate that most organizations are already performing some “early elements” of training and awareness activities. These normally take the form of exercises, and although the audience is often limited, they are a key component of any training program. So with exercises as an important first building block, what’s next?
A training and awareness program designed to educate all employees. Moving beyond just exercises, the business continuity planning team and executive managers enable a much more efficient and effective response and recovery process. The business continuity industry is maturing rapidly and progress is being made to enable recoverability. However, without a method to educate our organizations, the investment made in planning for business continuity will never be truly realized and recoverability will be diminished.