How do you get BCP going & keep it going?

I have been in this industry since 1991 when it was known as Disaster Recovery Planning, and since then it has evolved to Business Continuity Planning (BCP), or even better Business Continuity Management (BCM).  Just lately I have heard the rumblings of Business Resiliency and Continuity of Operations.

What surprises me… well maybe not, is the issues and challenges we face today haven’t changed.  So why is it, 18 years later, we are still struggling with successfully developing and implementing enterprise-wide Business Continuity Plans.  I have worked in many different capacities over the last 18 years doing Business Continuity within private to public sector, and even dappled with being part of large consulting firm to now having my own consulting services.  So I have seen both sides of the fence with this struggle to sell BCP.

This concerns me and as a result I find myself wondering why … here’s begins my quest for the answers.  Maybe if I read the overwhelming number of publications (many of them free by the way) on the topic, that come across my desk or more so through emails, I may find the ‘magic solution, which will solve all my problems’.  But I read and read, and I listen and listen, and I still discover the same remarks.  “That most efforts to build BCPs are unsuccessful because of the following statements:

• We don’t have senior management buy-in and commitment to process.
• We don’t have anyone dedicated to manage business continuity planning.
• We don’t have enough resources, time and money to commit to developing BCPs
• We don’t have time to do a risk assessment and a business impact analysis first, because it takes too long
• Why are all business continuity plans so long, difficult to follow and cumbersome to use.”

Just to name a few…

Why is this?  I know we have had enough disasters lately to promote the reasons why we should do this.  We see legislation and even a Canadian Standard for Emergency Management and Business Continuity Programs (i.e. CSA Z1600).  Plus I know that we need to create a culture that thinks about managing risks on a daily basis, and be prepared to deal with business interruptions by having plans in place, but I just don’t see it happening very often.  Too much lip service not enough action I suppose.

I am repeatedly asked “I have to build a business continuity plan so can you provide me with a simple template, which I can just fill in the blanks and be done with it”.  Unfortunately I don’t have The Magic Template for them, and I am not about to give them anything without them understanding the whole process so they do right the first time.

Then I see situations where organizations have developed BCPs, yet they have not updated them for so long that they are now out of date.

So I go to conferences, and I join user groups and associations, with hopes of talking to other BCM professionals about my issues… and I hear the same thing.  We are all in the same boat.  Isn’t that refreshing I say to myself (tongue and cheek).

So what does it take to get this done?  I think

1.    You need determination.

2.    The attitude that you will never give up.

3.    Just keep the notation to “Sell, sell, sell”

4.    Find a champion in higher places, and

5.    Do any little praying for a little disruption…but never pray out loud.

Seriously folks, I think you need to start small, and not expect that you will be able to build a full comprehensive Business Continuity Plan first time out of the gate.  You need to gain the confidence and the acceptance of your management to build the foundation, which the plans are, part of it.  It’s making it part of your company’s culture which means getting your staff level of preparedness to a ready state.  As I said earlier find someone at the senior management level who believes in the value of doing BCP and use him/her to sell it.

In closing I have used the following tips over the years to move BCM forward in organizations I worked for as well as when I am assisting companies with building plans. I hope these ideas help you get started.

Gain Executive Buy-in

• Hold a kick off session with your Executive where you ask them, what they think are their organization’s most critical functions and why are they?
• Give them examples of recent major business interruptions.  A great example was the downtown Vancouver power outage outlined in the recent January 2009 EPICCogram.  It could happen again!!
• Use articles from magazines, which you think they may relate to.
• Ask your Executive “What keeps them up at night?” when it comes to possible vulnerabilities and exposures within their organization.

Need a Great Sponsor who:

•       Has a stake in the outcome and believes in the project.

•       Sells the project to Executive.

•       Has time for you and supports your efforts.

•       Helps define roles and responsibilities.

•       Set clear mutual expectations.

Make it ‘business focus’ not ‘IT’

•       Treat the project as a corporate initiative.

•       Make sure IT is involved but not leading.

•       There is more to keeping your business going than having your computers up and running, think about the people who work there need to be there.

Build the Case

•       Why embark on BCP and why now.

•       Understand the threats and assess impact to your organization’s continuity.

•       Find the value and sell the benefits of doing BCP.

Choose a Winning Team

•       Confidence of sponsor, executive and senior management.

•       Right skill set and believes in the project.

•       Works as a team.

•       You support their efforts and they support yours.

•       Define clear role and responsibilities.

•       Set clear mutual expectations.

Set Expectations and Manage them

•       Tell them what you know when you know it.  No surprises.

•       Be clear on assumptions, constraints, and risks.  Ask questions.

•       Give a head’s up on changes, issues and concerns.

•       Communicate progress, timely status reports and present options.

Build Relationships

•       Engage stakeholders as partners from the beginning and throughout the process.

•       Network internally and externally.

•       Manage upwards.

•       Create and nurture connections.

•       Be visible.

•       Raise awareness and educate your audience.

Do your homework

•       Build your knowledge base.

•       Do the research.

•       Network with other BCM professionals.

•       Seek expert advice.

•       Learn and stretch your knowledge.

•       Build your own toolkit.

Communicate

•       Establish clear feedback channels.

•       Head’s up.  No surprises – keep everyone in the loop.

•       Use the informal and formal communication protocols when appropriate.

Know your staff

•       Plan your work and work your plan.

•       Think about if you were in their shoes.

•       Learn from past mistakes.

•       Expect the unexpected – trust your radar (or your gut feeling).

•       Stay a few steps ahead and deliver on time.

Have passion for your work

•       Work hard and have fun.

•       Believe in yourself and in the abilities of the team.

•       Don’t be afraid of success.

Remember you have to learn to walk before you can run.  Better yet, you maybe crawling for a while, but at least you are moving forward.