How to Create a Budget for Your Business Continuity Program

Okay, everyone, raise your hand if you looked at the headline of this article and thought, “Wait a second, why is Herrera writing about my business continuity budget when everybody just finished doing them? Could his timing possibly be worse”?

Actually, my timing could hardly be better, and I’ll tell you why.

The worst way to devise your BCM program budget is to do it in a rush just before it’s due. The best way—the way that is mostly painless and delivers the most accurate, realistic, and defensible result—is to work on it bit by bit over the course of the year. I’ll explain what I mean in a minute. For now, just take it on faith that the time to start thinking about your next BCM budget is now.

In this post, I’ll try to help you do that. Along the way I’ll also do the following:

• Acknowledge the harsh realities of BCM budgeting.
• Bullet out some resources you can consult to make it easy for you build your budget.
• List some BCM line items you might wish to include in your budget.
• Share some tips that might help you in getting your budget approved by management.
• Share some advice on how to make the most out of your budget once you have it.

If, by the time we’re finished, at least some of you no longer think it’s nuts to talk about budgeting right after the budget season, I’ll feel that this post was worth writing.

The Harsh Realities

Let’s face it: In some regards, business continuity programs are the Rodney Dangerfield of corporate departments, at least when it comes to budgeting. They get no respect.

This isn’t always the case but oftentimes it is.

BC is often not treated in a straightforward manner in company budgeting. Some programs will get a budget one year and will be left out the following year, or money will be budgeted for BC and then raided with little warning so the money can be used for something else.

One time my firm, MHA Consulting, was halfway through an engagement with a client when we were informed that management had taken the budget away, requiring the project to be aborted. This was as much of a surprise to the BCM manager we were working with as it was to us. Needless to say, this is not the best way to run a railroad. In this particular case it meant that not only was the company’s initial outlay wasted but the protections we had been engaged to provide were never implemented.

This is the political backdrop against which most business continuity budgeting takes place. Yes, it’s challenging. But there are ways to respond to this situation productively, as we’ll discuss below.

Building Your Budget

So how do you build your BCM program budget? Easy. You start by figuring out your requirements.

However, we have found that for some reason many people never complete this fundamental step.

The fact is, figuring out your program’s requirements is not that hard. You don’t have to conjure the program’s needs out of midair. All you have to do is consult a number of resources that you probably already have at your fingertips. These include:

• Any external or internal audits that have been performed on your program or company.
• Any current state assessments you possess.
• Your Business Impact Analysis (BIA).
• Any threat or risk assessments that have been made of the organization.
• Lastly, if in the previous year the company experienced any incidents or disasters that impinged on business continuity, you can consult people’s memories and any documentation pertaining to them.

What do these records tell you? They show where your problems and holes lie, and therefore where you might need to expend resources to minimize your risks and raise your compliance with your company’s chosen standards.

By consulting these records, you will be well on your way to determining what problems you need to address and therefore how big your budget needs to be for the coming year.

Do you need help determining your budgetary needs? Why not start with an assessment of your BC program with our Compliance Confidence (C2) tool? Schedule a free demo today.

Here are a couple more tips to keep in mind as you build your budget:

• Don’t wait until the last minute to figure out what’s happening.
• Keep tabs on things that happen throughout the year that might have an impact on your budgetary needs. Has the company set up new business units? Has it implemented new technology?
• Think about any new trends you’ve noticed at the company from the business continuity point of view. Is the trend likely to have an impact on future business continuity obligations?

The savvy BCM budget builder considers all these things in estimating their program funding needs for the coming year.

Would you like to get more specific? Let’s do it. Here’s a list of 10 line items we commonly include in BCM program budgets:

• Business Recovery Sites. External and/or internal alternate business area work sites.
• IT Disaster Recovery Sites. External or internal alternate IT data center.
• Business Recovery Tools/Software. Includes automated planning tools such as BIA, recovery planning, metrics, etc.
• Emergency Communications. Emergency notification systems, 1-800 conference bridge lines, 1-800 employee status lines.
• Consultants. Business and/or IT disaster recovery focused.
• Data Backup and Recovery. Software, cloud recovery solutions, and/or offsite storage for data.
• Training and Education. Conferences, training, classes, etc.
• Professional Memberships and Certifications. Association of Continuity Professionals (ACP) membership, Certified Business Continuity Planner (CBCP) certification, etc.
• Testing. Supplies, food, travel, etc.
• Salaries. Employee salaries.

Does your budget include these items? Should it? Consider this list as food for thought as you develop your business continuity budget over the coming year.

Getting Management to Support Your Business Continuity Budget

It’s one thing to come up with a detailed, solid budget for your BCM program. It’s quite another to get management to agree to it.

Want to know the secret to winning management respect and dollars in the annual budget struggle? Don’t just throw out a number. Make a case.

Build a business case explaining your requirements. Show how you arrived at them. Tell management, for example, that you did a BIA and that based on it here is what you need. Or explain that IT needs a certain amount of money to fix a certain, specific problem with your systems.

Don’t go into your business continuity budget meeting empty-handed. Take your BIA, audit, or news stories about an event that affected the company. Have evidence and proof to bolster your request.

When management asks why you want to spend X dollars on a consultant or new planning tool, explain your reasons. Identify the problem you’re concerned about and show how the solution that you would like to fund will make things better.

To sum it up, build a case for your business continuity budget with substantive evidentiary information.

Here are a few more tips that might help you in winning management support for your budget:

• It never hurts to ask for more. The amount will probably get reduced.
• Don’t be afraid to ask for what you need.
• The more confident you are in your budget projection, the more confident you can be in lobbying for it to management. It all goes back to thoughtful and rigorous reflection in your initial budget development.

Once You Have Your Business Continuity Budget

Once you have your business continuity budget—whether it’s close to what you asked for, falls well short, or exceeds your wildest budgeting dreams—it’s time for you to face one of the great facts of BCM budgeting life: having a lot of money doesn’t mean you’re going to be successful, and having only a little doesn’t mean you’re going to fail.

It’s very easy to spend a lot of money on initiatives that don’t improve the recoverability of your organization.

And it’s very satisfying to spend a little bit of money intelligently, in ways that minimize risk and raise your program’s alignment with its chosen standard.

At the end of the day, or at least the end of the year, you want to be able to show that, whatever your budget, the expenditures you made resulted in an improvement in your program. Need help calculating your ROI? We can help you with that. 

The important thing is to deploy your available resources in a manner that reduces risk and raises alignment with the standards, bringing your organization a good return on its investment.

Tools For A Top-Notch Business Continuity Management Program

If you’re searching for the right tools to help you develop a strong business continuity program, BCMMetrics™ can help. Designed for self-assessment and easy accessibility online, our suite of business continuity tools was created to help you identify and assess critical processes, compliance, and risk in your business continuity management program.

• BIA On-Demand (BIA^OD) walks you through a full evaluation of your business processes and automatically calculates the level of criticality of each unit you’ve chosen to assess.
• Compliance Confidence (C²) makes it simple to determine your program’s level of compliance, providing a “FICO-like” score as well as notes on areas of success and opportunities for improvement.
• Residual Risk (R²) scores the level of risk in your program, taking into account the mitigating controls that are key to reducing risk.

All of our tools also make it simple to store and organize results and include a variety of management reporting features for sharing.

If you’re new to business continuity management, there’s no better—or easier—way to get started building a world-class continuity program. Interested in seeing the BCMMetrics™ business continuity tools in action? Schedule a free demo today.