MUST ... DEMONSTRATE ... RETURN ... ON ...

INVESTMENT. Until we can develop some realistic, replicable, and recognizable quantification of our value (The “3 R’s” of value), we will always be seen as a cost center. That should be the main industry focus for the next three years. Let’s use terrorism as an example. According to the FBI, last year eight U.S. citizens outside of Iraq & Afghanistan died from terrorism anywhere in the world. Yes, eight. You are nearly 10 times more likely to be killed by lightning and even six times more likely to die from falling off a ladder. So stop spending so much energy on terrorism, please.

 

I could say the exact same thing about SARS, H1N1, climate change, and any one of the dozens of “crises-du-jour” over the past 20 years. Can I tell an entire industry to stop screaming?

 

We are a “Chicken Little” profession. We are not science- or data-based. People think we are stupid when we make decisions based on the worst-case scenario. They smile politely, but don’t change any behavior because they know we are wrong.

 

But it doesn’t have to be this way – we can change business continuity into a profession that uses real science to measure risk. But I doubt that we will, because that will involve using math and as my 11-year-old says, “Math is hard ....” So the screaming continues.

 

A down economy puts more and more strain on the supply chain. Critical vendors and suppliers also feel the cascading affects to their suppliers, and so on. We can focus on our resilience and recovery capabilities, but the weakest links may be those suppliers where we have little visibility. We must broaden our perspective on risk and assist the business with understanding the vulnerabilities related to the supply chain. Adding value to the sourcing decision-making process brings credibility to the BC organization. There is a geo-political aspect to this economic downturn and potential recovery. Our country or industry may be seeing signs of improvement, but we may rely on suppliers that are in countries and industries that may not be seeing improvement. We need to add this dimension of assessment into our BIA/BCP and risk management processes. Yes, I realize we are being asked to do more with less and it may be difficult to take on more analysis. However, the alternative of a meltdown to your supply chain overshadows the resource constraints and may bolster the argument for more resources.  

 

Global business continuity programs should have a set path they follow regardless of the economy. This is true in an ideal world, so we must be prepared with a list of “gotta haves” and “nice to haves” for our teams, the process, and the organization. As long as we know what our “gotta haves” are and consistently stay focused on them, there is greater likelihood of attaining them. They vary by company, but likely include tools (software), training (for attaining/maintaining certification), adding FTEs, etc. I believe having face time with decision makers (and CI team members) is very important and much of that can be done more frequently when the economy improves. All other groups in the organization are competing for company dollars and whoever is most ready and creative will succeed. Similar to managing through incidents, at some point it is all about execution.

 

The business world is a different place and in my opinion, we will not return to pre-financial-crisis “business as usual.” The financial burdens of the past two years have forced business to think and act differently. Getting approval for spending is more difficult as organizations scrutinize all requests to the fullest. Discretionary spending may well be a thing of the past and mandatory spending will be examined under a microscope.

 

What does this mean to us as we jockey for position post recovery? We have to be smarter about the technologies that we want to implement; we have to work together and truly partner with our brothers and sisters in the business units (IT, risk management etc.); and we have to make sure that we are much better stewards of the monies that we are given to spend on our programs.

 

Business continuity managers will need to become better at financial management. We will have to adapt to new spending rules and make our dollars stretch without sacrificing our program’s effectiveness. We will have to become better consumers and our business partners must accept that there is a new paradigm. They will need to adjust their models to our new requirements and truly partner with us if they want to stick around.

 

I have witnessed this new model in the past six months. Partners understand that flexibility and willingness to be creative mean the difference between winning or keeping the business, or missing out on it. Some vendors seem to be more willing to listen and modify their sales strategy in order to better serve their customers.

 

The bottom line question is: How should business continuity programs position themselves? Well, the term “value add” comes straight to mind. We can no longer allow our programs to be looked upon as an “overhead function.” We need to become adept at selling the benefits of the program to the rest of the organization. Work on your elevator speech and be prepared to talk about the value your program brings to the organization, its customers, stakeholders, associates, etc.

 

First, a good, solid multi-year program cannot afford to ride the firm’s or overall economy’s economic cycles. If so, we will always be one step away from that final investment or that valuable return. Like any other program, it is imperative that a BC program outline key priorities independent of the economic landscape. There should be a clear delineation in priorities between the “have-to-haves” and the “nice-to-haves” with one group at the mercy of the economy and the other in a kind of “fiat” state, independent of short term revenues or medium term market cap.

 

Regarding the debate for dollars, the BCP community will always lose this competition if based exclusively on economic returns. The issue needs to be elevated to a higher level involving regulatory, contractual and firmwide policy elements. This is where the teeth are and these are the components that may dictate economic survival.

 

Apply this to your own home environment. How many readers made financial adjustments over the past 24+ months based on the economic landscape? What did you do? I’ll bet many of you delayed a car purchase (I know I did), ate out a little less often, or chose to eat at less-pricey establishments. Maybe you changed a commuting habit or carried a lunch.

 

Unless absolutely forced to, how many of you cancelled insurance policies or adjusted deductibles? My guess is very few, and again, only if absolutely necessary. Tough economic times create the need for more protection, not less. The challenge is how to get that protection increased to the levels needed.

 

As things turn around, now is the time to identify the areas that were/are exposed and strengthen them for the next period of economic strain.

 

BC professionals should position their programs as a return on investment (ROI). In order for the program to succeed, there must be a dynamic shift in the way it is pitched to executives:

1. It must have an executive sponsor or champion at the senior level, who sees the program as something that is a return on investment to the business, to the shareholders, where if the investment is $x, there is a direct correlation to the bottom line.

2. The support to the program must be top down – this can only happen if number 1 above happens – automatically when this happens, there will be priorities to have a project management office, there will be a budget, and there will be management attention and program improvements.

3. When the program is attached to the ROI concept, compliance and regulatory tollgates are automatically attached in order to put more rigor into the program, which will ensure that program standards are not only meeting the shareholder expectations, but also most importantly bringing in a return on investment.

 

Bottom line: Don’t sell the program as a “must do” or a “risk management” or “risk mitigiation” program – sell it to the executives in the language that matters most to them. Money talks.

 

Should the priorities change at all?  I would argue no. It’s true that many programs experienced cutbacks – as did most areas of businesses affected by the recession. However, executing on the unique priorities established by the business continuity program’s sponsor/steering committee shouldn’t change. Therefore, I feel it is artificial to provide a blanket recommendation that, for instance, testing is more important than a BIA. Instead, engage your sponsor and discuss priorities, objectives, timeframes and how varying resource levels enable varying levels of delivery and timing. Overall, priority is established by our program sponsors, and it is our place as business continuity professionals to influence it. That leads to the second question, how do we compete? I think compete is the wrong word. Instead, I think we need to build a strong business case for action. The business case should be grounded in messaging that addresses: 1.) customer expectations, 2.) market differentiation/positioning, 3.) organizational risk tolerance and 4.) legal, regulatory and contractual demands. Engaging management with a strong business case should lead to a productive discussion that clarifies priorities and hopefully results in appropriate resourcing. In most organizations today, business continuity is part of a larger risk management and compliance framework, and we shouldn’t necessarily view other risk management disciplines as competitors.

 

This is certainly an opportune time to propose program improvements and better position your program for increased visibility at the executive level. With an anticipated economic recovery, more organizations and executives are rediscovering their commitment to the business continuity management program. Times are still tight, thus any suggestions for change or program improvement are heavily scrutinized. Business continuity professionals need to be armed with information to help their executives, along with themselves, in their decision making process.

 

There are a few things to keep in mind when positioning your program for executive commitment. First, gather all the pertinent information involving your program. For example, you will want to focus on customer requirements, regulations/audit compliance, your organization’s tolerance for risk, and previous events that have impacted your organization (downtime, impact to staff, impact to the business and estimated financial loss per event). Keep in mind when gathering this information that it isn’t about the BIG event that COULD happen. Focus on the most likely events and every day happenings that have and will disrupt critical business processes, e.g.: planned downtime. Secondly, clearly understand your program initiatives and the timelines associated with your deliverables. When assessing your program initiatives it is crucial to not only consider where your program is today, but also determine where your program will be in three to five years. Third, utilize market research to better understand how your program compares with other peer organizations or simply assess trends within business continuity planning. Customized research data, at a peer level, can be incredibly persuasive when considering the number of dedicated personnel, expenditures allocated to the program, where to position the program for maximum visibility, understanding how engaged other executives are with the program planning process, and understanding how events have impacted organizations. Lastly, it is important to not only gather all the pertinent information, but to also understand the culture of the organization and your audience. Out-of-box thinking is necessary as one program will unlikely function effectively for different organizations. Also, be sure to identify the executive who can champion the program initiatives and embrace program integration throughout the organization.

 

Time invested up front in gathering all necessary information, understanding your culture and audience, and being strategic will pay off immensely in the long run. Taking the time to review your program initiatives and executive commitment should also be a frequent exercise. Never wait until it is too late.

 

As the recession hit, businesses were forced to react in a wide variety of ways. Staff reductions, loss of credit, reduced demand, and regulatory uncertainty altered business priorities. Perhaps recovery resources were scaled back as production shrank. Perhaps some product lines were reduced or eliminated and others grew in importance. BCM programs should already have made some adjustments – BIAs should show the shift in impacts, recovery strategies change to match the impacts, recovery resources and in testing also accommodate these shifts. 

 

As economic conditions shift again, the BCM staff should be working with management to identify the next areas of change and anticipate similar adjustments. Recovery resource levels may need to increase as production levels grow. Product lines or operations locations that are growing in importance may require improved recovery strategies, more rigorous testing and plan updates.

 

BC Planners should not expect to simply replace the resources that were cut back during the recession, but rather to shift emphasis to new areas of critical importance to the business. Any competition for management attention, including spending, will be won by clearly supporting the changing business priorities. CI