A common mistake business continuity practitioners make is to obsess over such BC program artifacts as BIAs, documentation, and exercise results. The wise practitioner learns to focus instead on the higher-level challenge of implementing a BC operating model designed to enhance functional recoverability.
Related: Creating a Continuity Culture: How Your Organization Can Make Business Continuity a Habit
Summary
- BC programs can create a false sense of progress when they focus only on BIAs, plans, and exercise reports.
- The real goal is functional recoverability, not checking off program artifacts.
- A sound BC operating model connects assessments, roadmaps, action items, maintenance, exercises, and training into a repeatable system.
The Artifact Trap
The attitude I want to discuss in this blog is counterproductive, widespread, and understandable.
Many BC professionals have a tendency to fixate on business continuity program artifacts such as business impact analyses (BIAs), recovery plan documents, and exercise results. They come to believe that if they can get these tasks done and check them off a list, it means they are doing the job and that their organizations (and positions) are safe.
In many respects, this mindset is perfectly natural. BIAs, recovery documents, and the rest are important, vitally so. Leading standards such as FFIEC and NFPA 1600 devote significant attention to them, and blogs like this one regularly describe BIAs as the cornerstone of a solid BC program.
It’s also understandable that in a somewhat abstruse field like BC, in which clarity and certainty can be hard to come by, people tend to cling to things that seem to offer the security of concreteness. Sometimes the BIA becomes not only an analysis of the organization’s business processes but also a life preserver for the practitioner.
However, this attitude amounts to zeroing in on the trees and missing the forest: the larger system that determines whether the organization can actually recover from a disruption.
The Difference Between Activity and Accomplishment
A task-focused attitude is one that dedicated practitioners should make every effort to move beyond.
The drawback with this approach to BC is that it leads the BC team to aim at the wrong target. The point of BC is not to get the BIA done, or whatever it might be. It’s to ensure that the organization is functionally recoverable in the event of an outage. Everything about the BC program, including the practitioner’s mindset, should be focused on this larger goal.
My MHA colleague David King and I have a saying we often share with our clients: “Completing tasks does not necessarily correlate with accomplishment.”
The truth of this is something I was reminded of recently while renovating a rental house my family owns. I’ve accomplished many tasks in getting the house ready, but I’d be kidding myself if I were to begin patting myself on the back for a job well done.
At the moment, the toilets aren’t hooked up. The house is still unrentable. I’ve gotten a lot done, but the key goal is still unmet. Checking off tasks is not the same as substantive accomplishment.
The best approach is not to get obsessed with artifacts or focus on tasks, as important as these are. It’s to create and implement, persistently over time, a process or operating model for your program that is rigorously focused on improving the organization’s functional recoverability.
Rather than fixating on artifacts such as the BIA or recovery documentation, focus on building and consistently implementing a system that will truly improve your recoverability.
The Components of an Effective BC Operating Model
Different names can be used to refer to the recommended approach. BC operating model, governance structure, program administration, and related terms all point to the same basic idea: creating a repeatable framework that continuously improves the organization’s preparedness and recoverability.
The goal is to move beyond simply completing BC tasks and toward managing a program that consistently drives resilience. Rather than asking, “Did we finish the BIA?” the better question is, “Do we have a system in place that helps us become more recoverable over time?”
The exact structure will vary from organization to organization, but effective BC operating models typically include the following elements:
Current State Assessments (CSAs)
A BC program cannot improve if it does not understand its current level of maturity and capability. A CSA answers the question, where do we stand and what should we work on next? Doing informal “mini CSAs” several times per year is especially useful. Look at where you stand in terms of BC plans, crisis management, and IT disaster recovery. These reviews provide the baseline information needed to prioritize improvements and measure progress over time. They also help ensure the program remains focused on areas that have the greatest impact on recoverability rather than simply maintaining existing activities.
A Prioritized Roadmap
The roadmap translates assessment findings into action. It identifies the initiatives that will most improve preparedness and resilience, prioritizes them according to business need, and establishes a realistic sequence for accomplishing them. Without a roadmap, BC activities can easily become reactive and disconnected. With one, the program has a clear understanding of where it is going and why.
Action-Item Management
Every BC program accumulates gaps, recommendations, unresolved issues, and opportunities for improvement. These items should not disappear into meeting notes or assessment reports. A disciplined process for tracking, prioritizing, assigning, and resolving action items helps ensure that identified weaknesses are actually addressed and that the program continues moving forward.
A Maintenance Schedule
Many organizations have policies requiring annual updates to BIAs, plans, and related documentation. However, effective programs do more than conduct a year-end documentation exercise. They establish a cadence for maintaining plans, reviewing recovery strategies, validating assumptions, and engaging with business units throughout the year. Spreading these activities across a structured schedule often produces better results than attempting to complete everything at once.
An Exercise and Validation Schedule
Plans and strategies only have value if they work. Regular exercises, tests, and validations provide evidence that recovery capabilities remain functional and identify areas where additional improvement is needed. These activities help ensure the program remains focused on real-world recoverability rather than documentation alone.
Ongoing Training, Communication, and Coordination
One of the most common weaknesses in BC programs occurs when responsibility for maintaining plans is pushed to business units without providing adequate guidance and support. People forget procedures, misunderstand expectations, or simply lose familiarity with the process over time. Continuous training, communication, and coordination help ensure that participants understand their roles and can perform them effectively when disruptions occur.
Taken together, these elements create a management system that continually strengthens preparedness and recoverability. More important, they help the BC team focus on achieving resilience outcomes rather than simply producing BC artifacts.
Seeing the Forest
Seeing the BC program as a collection of tasks and artifacts can create a false sense of accomplishment. BIAs, plans, and exercise reports are important, but they are valuable only to the extent that they contribute to the larger objective of improving the organization's ability to recover from disruptions.
The most effective BC programs focus not on individual deliverables but on operating models. Through the disciplined use of current state assessments, roadmaps, action-item management, maintenance activities, exercises, and ongoing training, organizations can create systems that continuously strengthen preparedness and resilience over time.
Organizations seeking to build this type of operating model do not have to start from scratch. MHA Consulting has the expertise to help organizations assess their current capabilities, identify priorities, and track progress efficiently.
Our BCMMETRICS tool suite enables organizations to conduct the kind of rapid current state assessments that are essential to managing a mature BC operating model. Contact us to learn how we can help your organization move beyond task completion and build a program focused on true recoverability.
Further Reading
- Are You a Leader in BCM Governance, Risk and Compliance (GRC)?
- Get Out the Map: Why Your BCM Program Needs a Roadmap
- BCM Governance Cadence: A Minimum Operating Rhythm for Audit Readiness
- BCM Basics: The Strategic Side of Crisis Management
- Creating a Continuity Culture: How Your Organization Can Make Business Continuity a Habit
Frequently Asked Questions
What is the difference between a BC artifact and a BC operating model?
A BC artifact is an individual deliverable, such as a BIA, recovery plan, or exercise report. A BC operating model is the broader framework that governs how those deliverables are created, maintained, validated, and improved over time. Artifacts are outputs of the program; the operating model is the system that makes the program effective.
What happens when BC practitioners focus excessively on artifacts such as BIAs?
When practitioners become overly focused on artifacts such as BIAs, recovery plans, and exercise reports, they risk confusing activity with accomplishment. While these deliverables are important, they are only valuable to the extent that they improve the organization’s ability to recover from an outage. Excessive focus on artifacts can create a false sense of progress, causing teams to lose sight of the larger objective of building and maintaining functional recovery capabilities.
Why do business continuity programs need an operating model?
A business continuity program needs an operating model because completing individual BC tasks does not automatically improve an organization’s ability to recover from a disruption. An operating model provides a repeatable framework for assessing current capabilities, prioritizing improvements, managing action items, maintaining plans, conducting exercises, and coordinating stakeholders. By focusing on the system as a whole rather than isolated deliverables, organizations can continuously strengthen preparedness, resilience, and functional recoverability.
What are the components of a sound BC operating model?
While the exact structure varies from organization to organization, sound BC operating models typically include several core elements: current state assessments to understand program maturity and identify gaps, a prioritized roadmap for guiding improvements, a process for managing action items, a maintenance schedule for keeping plans and strategies current, an exercise and validation schedule to test recovery capabilities, and ongoing training, communication, and coordination. Together, these components create a management system that continually strengthens preparedness and recoverability.
