Relevant Contents
Need Tailored Business Continuity Insights?
Contact Us Now for Personalized Guidance!
Too many business continuity management programs are reactive rather than proactive. Good BCM programs exist in a permanent posture of executing on a roadmap, their custom-crafted plan for the future that is focused on reducing risk and increasing compliance with standards.
Related on BCMMETRICS: How Your BCM Program Is Like a Cross-Country Bus Journey
Missing: A Coherent Set of BCM Program Goals
From my perspective as a consultant who works with BCM offices at organizations all across the country, in a wide range of industries, I can tell you one thing that almost every BCM office has: thick three-ring binders full of business continuity plans.
I can also tell you one thing that few BCM offices have, but which in my opinion they definitely should have: goals. A plan for the future of their program. Someplace worthwhile they’re trying to get to.
Most BCM programs are missing a coherent set of BCM program goals.
Most programs react to things that come at them from outside, rather than charting a course and controlling their own destiny.
In a related problem, the lack of commonly recognized goals in a BCM office, with the result that everybody is doing their own thing without regard to what anyone else is doing or the true needs of the program, is one of the biggest money wasters I see.
For many BCM offices the long-term strategy can be summed up as, doing what senior management tells them to.
Others get lost in the weeds, like at the company where the BC folks did nothing but complete BIAs for three years.
The weeds are a great place to be if you are a grasshopper, but not if you are a BC professional responsible for protecting a valuable organization that many people depend on.
Introducing the BCM Program Roadmap
Solid BCM programs have goals.
In fact, they have a specific type of goal, one we call a roadmap.
The roadmap is a plan that sketches out what the program is going to try to accomplish over the calendar year, or the next two years, or the next five years.
Everything that is included on the roadmap should have one of two aims: reducing risk at the organization or increasing its compliance with its chosen BCM standard.
We’ve written a lot on these two topics previously.
For a good intro to the subject of reducing risk, see MHA Senior Advisory Consultant Richard Long’s post, “The Risk Management Process: Manage Uncertainty, Then Repeat.”
For a primer on the five main BCM standards, see my post, “Standard Time: The Best Time to Choose a Business Continuity Standard Is Right Now.”
While we’re on the subject of resources, another good read relating to this topic is Chapter 7, “Build a Roadmap to Success,” from MHA Consulting’s ebook, 10 Keys to a Peak-Performing BCM Program. That’s available for free download here.
And for a post with an example of a roadmap you can crib from, have a look at “How Your BCM Program Is Like a Cross-Country Bus Journey.”
Roadmaps Cover the Main BC Areas
The action items on a BCM program roadmap should have the two goals stated above. They should be divided among the following four main BCM areas:
- Program Administration
- Business Recovery
- IT/Disaster Recovery
- Supply Chain
How about some examples? A good example of a goal in IT/DR might be to manage, within one year, to successfully recover your critical systems and applications within your stated RTOs.
A goal on the business side might be, within two years, to recover your five most mission-critical business units within your stated RTOs, or to successfully execute a complex mock disaster exercise.
Your roadmap should also include metrics so you can measure your progress toward achieving your goals. And they should not be meaningless metrics, such as those that only measure the volume of work done. They should be ones that truly speak to your ability to recover the business. (For more on that topic, see, “BCM by the Numbers: The Metrics That Matter Most.”)
What the Roadmap Accomplishes
What does the roadmap do for you? It ensures that you’re allocating your time and money toward deliverables that will bring the highest return on investment.
It’s also worth mentioning that if you have a roadmap and ignore it, you might as well not have it. It always puzzles me when companies hire us to do a Current State Assessment for them.
The engagement ends with us giving them a practical, actionable roadmap, drawn up in close collaboration with them in a way that reflects their company’s unique mission, industry, culture, and priorities. And then they throw it in a drawer. So close but yet so far . . .
The roadmap can accomplish a lot for you—provided you actually use it.
This Race Goes to the Tortoise
This is truly one of those areas where the tortoise beats the hare. Hiring a consulting firm to produce a CSA that you then throw in a drawer is the action of a flighty rabbit: you swoop in, make a big effort for a short time, then get distracted and give up, letting the whole effort fall apart.
Contrast that approach with that of a woman in a one-person BCM office at a utility that I know of. She plugs away year after like a patient and determined tortoise, crafting her roadmaps, executing on them, ranging back and forth over all the main BC areas so that, over time, everything gets its share of attention and improvement.
She is a master at roadmaps and as a result her BCM program is very solid. Thanks in part to her sustained and intelligent efforts, her organization enjoys a high degree of resiliency.
Get Out the Map
If you want to have a good BCM program, my advice is: get out the map. Make yourself a roadmap. Create a timeline for achieving certain tasks. Make sure all of your action items will have the effect of either reducing your risk or boosting your compliance with your BCM standard. Make sure the tasks cover the four main BCM areas of program administration, business recovery, IT/DR, and supply chain. And find meaningful metrics with which to chart your progress.
Further Reading
For more information on setting a BCM program roadmap and other hot topics in BCM and IT/disaster recovery, check out these recent posts from BCMMETRICS and MHA Consulting:
- How Your BCM Program Is Like a Cross-Country Bus Journey
- BCM by the Numbers: The Metrics That Matter Most
- 10 Keys to a Peak-Performing BCM Program (free ebook)
- Standard Time: The Best Time to Choose a Business Continuity Standard Is Right Now
- The Risk Management Process: Manage Uncertainty, Then Repeat
- Eight Is Enough: The 8 Skills That Will Enable You to Thrive as a BCM Professional
Michael Herrera
Michael Herrera is the Chief Executive Officer (CEO) of MHA. In his role, Michael provides global leadership to the entire set of industry practices and horizontal capabilities within MHA. Under his leadership, MHA has become a leading provider of Business Continuity and Disaster Recovery services to organizations on a global level. He is also the founder of BCMMETRICS, a leading cloud based tool designed to assess business continuity compliance and residual risk. Michael is a well-known and sought after speaker on Business Continuity issues at local and national contingency planner chapter meetings and conferences. Prior to founding MHA, he was a Regional VP for Bank of America, where he was responsible for Business Continuity across the southwest region.
