Twintig jaar BCM Consultant

18 juni 2018 – BCM Specialist Alex Hoogteijling viert deze maand zijn twintig jarig jubileum als BCM Consultant. In deze twee decennia heeft Alex zeer veel ervaring opgedaan met het implementeren van business continuity management bij tal van organisaties in vrijwel alle branches. Zo ook met het omzetten van BCM awareness in commitment (geen woorden maar daden).

In het artikel hieronder, dat gepubliceerd is op de website van the Business Continuity Institute (BCI), ’s werelds toonaangevende beroeps- en certificeringsorganisatie voor business continuity & resilience professionals, geeft Alex Hoogteijling tips voor organisaties die met dit probleem worstelen.

Bent u zich bewust van dat uw organisatie iets met BCM moet, maar krijgt u het maar niet van de grond?

Transforming BCM awareness into commitment

By Alex Hoogteijling MSc RE CISA MBCI, CEO of BCM Specialist

In the past 20 years as a BCM consultant, I have seen awareness for business continuity grow. However, there still is a lot of gospel work to do, especially in the Netherlands and Belgium. Many organisations still haven’t worked towards anything regarding business continuity, or have only basic material which hasn’t been tested in a real world setting. Even organisations of which you least expect it are very unaware and immature in their approach to BCM and aren’t well prepared for disruptions: not only small organisations, but also some multinationals with tens of thousands of employees. For making BCM a success, top management first has to really commit itself. Awareness is not enough.

Common excuses heard for doing nothing or postponing a serious BCM program are for instance: “we don’t have the capacity”, “we have other priorities at this moment” or “we don’t want any more paperwork”. It is often also a lack of resources with the right knowledge and expertise to properly address this subject.

How can this commitment be achieved?

What would certainly help to get business continuity on the boardroom agenda is legislation, just like the General Data Protection Regulation did for privacy. Unfortunately, in the Netherlands legislation on business continuity is still lacking or is sector-specific (for example aimed at institutions belonging to the financial core infrastructure). We have seen some calls from Dutch Ministries aimed at vital infrastructure institutions, to prepare for pandemics and loss of ICT and electricity. This however has had only a limited effect, although many organisations concerned will claim differently.

What does help, are critical questions by important clients for reasons of supply chain continuity. The fear of losing an important client due to lack of BCM immediately has the attention of managers and can lead to a solid BCM improvement program. It also creates a snowball effect. Organisations who receive such BCM related questions in turn contact their business partners / suppliers for the same questions.

Create excitement instead of using fear

However, the aforementioned motivators are difficult to influence and aimed at fear. This will push top management into a situation of “we need to” or “we have to” which not necessarily means that they also “want to” and are really committed. A better approach is to inspire top management in such a way that they become so thrilled, they just can’t wait to get started.

How? First of all. It’s not what you say, it’s how you present it. Speak in a passionate way about how you can increase the continuity level in a very pragmatic way. Don’t come with standard sales pitches or push through on theoretical methodologies. Too-heavy programs / theoretical approaches will deter them. Remove any fear for a long lasting, expensive and theoretical BCM program that they might have in mind. For this you have to understand their concerns; that is something more than just listening to what top management has to say.

Start with a BCM quick scan

Sometimes even managers themselves don’t know what they want regarding BCM, or what’s needed. If this is the case, suggest starting with a BCM quick scan, instead of immediately requesting a big budget for a complete BCM program that has lot of uncertainties. This could lead to a better insight in the current business continuity capabilities, areas for improvement, its necessity and urgency and a better understanding of BCM related concerns that stakeholders might have.

Give something to choose from

Results of the BCM quick scan can be translated into recommendations and suitable approaches that fit the complexity, size, type and culture of the company, taking into account synergy opportunities with other (oncoming) projects. i.e. combining interviews or re-using analysis outcomes for other purposes. It’s also good to give managers options to choose from (i.e. a car that drives versus a Rolls Royce), instead of just presenting one option for which they have to decide yes or no.

Be pragmatic and keep it simple

Don’t make things unnecessarily difficult, but keep it simple (the analysis phase especially can be drowned in details). It’s better to have something that actually works, is understandable to everyone and is kept up to date, than something very complex that is pushed aside when needed or gets out of date because maintenance is to complex or takes too much effort, time and thus money.

A business impact analysis for instance can be very wide and complex, but a one paged version is also possible and gives practically the same end result. Besides that, you want to be prepared for disruptions. You don’t need a sublime BIA report. Analysis results are not end deliverables. Most often, pragmatic solutions are the key to convince others.

Also, having an exercised crisis management plan, is for some organisations already a big improvement and perhaps enough for the moment. At a later moment, this can be elaborated further with practical runbooks for some plausible scenarios, containing checklists with actions + action holders instead of long paragraphs with text.

Use what’s already there

Prevent employees from getting inventory fatigue. Don’t come with questions on which the answer has already been given or documented in the past. Re-use existing inventories, documented procedures, investigation reports, etc. in preparing for business continuity.

The same goes for the BCM methodology itself. Throughout the years several guidelines, standards, frameworks and best practices have been developed to support the business continuity practice. Although most of these documents are tough to read and won’t give managers a sudden feeling of excitement and pleasure to work on BCM, they can be used as basis though. Try to cherry pick elements from these standards that may help you further in delivering business continuity in a pragmatical way.

Also try to plugin business continuity into existing management systems and working methods that might already be in place. This will make it easier for keeping it up-to-date and making business continuity part of day-to-day operations.

Never waste a good crisis

If you still won’t get the commitment of top management for making necessary business continuity improvements, I hope your organization will never be confronted with a disruption. But if so, use the momentum while the incident is still top of mind. Don’t wait too long or the moment will pass. And when finally moving, keep on moving. Don’t let it fade away. Remember: BCM is not a project with a beginning and an ending, it is an ongoing process.

Alex Hoogteijling MSc RE CISA MBCI
CEO of BCM Specialist