Business continuity programs are successful, in large part, because they are accepted and adopted by their organizations....
Conversely, business continuity programs fail because the organization -- at all levels -- does not adopt and incorporate business continuity as part of its ongoing business processes and methods.
Thus, it becomes essential that your business continuity management system (BCMS) be accepted by your organization and its policies and procedures embedded into the firm's daily operations.
The Business Continuity Institute's Good Practice Guidelines (2013 edition) define embedding business continuity into the business as "the professional practice that continually seeks to integrate business continuity into day-to-day business activities and organizational culture."
Activities that integrate business continuity into an organization
Before attempting to integrate a business continuity management system into your organization, take a careful reading of your current corporate culture, getting a sense of how it operates. Compare the current level of business continuity awareness in your organization with what would be an ideal situation, and identify the gaps, if any. If possible, assess the level of senior management's awareness of business continuity, as it will take commitment and support at that level to help your BCMS assimilate into the organization.
Next, assuming the gap between the current level of awareness and your BCMS goals is not too wide, you can develop a program or campaign to create or increase awareness of business continuity across the organization; develop the knowledge, skills and commitment needed for a successful BCMS; and then establish an ongoing process to measure the effectiveness of your campaign in achieving your goals for integrating the system into the organization's culture.
Specific activities that help integrate business continuity into an organization include the following:
- Regular communications to all employees about the business continuity management system
- An internal website describing the BCMS and its activities and benefits to the firm
- Group meetings that describe specific BCMS activities
- Briefings to senior management on BCMS activities
- Training on business continuity activities for new employees
- Remedial training of business continuity activities for existing employees
- Outreach activities to departments demonstrating how business continuity can add value to their activities
Fundamentally, a BCMS is more likely to be accepted by the company as a whole if senior management -- a senior-level champion and sponsor is ideal -- approves, endorses and encourages its deployment. That single achievement usually means the program has a chance at succeeding. And, of course, that endorsement alone is not enough: The program must sustain itself, grow and continually improve.
Establishing a business continuity policy is another important way to encourage acceptance, for example, by stating that the policy is to be followed by all employees. When the policy is disseminated, be sure that it has been approved and that senior management has visibly signed off on it.
Here are more suggestions for encouraging employee acceptance of a BCMS:
- Build training programs that ensure that individuals and teams have the required skills for specific business continuity management program activities, including incident response teams, performing a business impact analysis, conducting damage assessments and leading an emergency team.
- In coordination with the public affairs department, organize and facilitate media training for designated company spokespersons.
- Reinforce business continuity knowledge through internally developed forums, issuing of diplomas for program completion, online learning or conferences.
- Establish activities that reinforce the importance of business continuity maintenance to the organization's business processes. The goal is to have these activities performed as a normal part of the business.
- Invite the company to participate in a Business Continuity Awareness Week, and hold it at the same time every year. During the week, make available a multitude of educational, informative and fun activities. It's a good way to increase awareness of business continuity within your organization.
Changing attitudes toward business continuity is essential for acceptance. In an ideal world, employees understand and willingly find ways to integrate business continuity and related activities into their daily activities. One effective way to do is to optimize the "message" to the audiences, which can usually be organized by job level:
- Senior management: Focus on the business and the firm's strategic and financial objectives, and how business continuity can help achieve the firm's goals.
- Middle management: Focus on how a business continuity program can impact an individual's performance evaluation (e.g., by participating in response and recovery planning efforts), and show that their peace of mind can be increased because disruptions can be effectively managed.
- Sales and marketing: Describe how a business continuity activity can increase market opportunities by demonstrating the value of resilience and recoverability to customers.
- Operations: Explain how a business continuity program can increase confidence that disruptions can be addressed proactively, thus minimizing potential downtime.
- All staff: Present the business continuity management system as a way to protect their safety and well-being, as well as their jobs.
Measuring program effectiveness
What are the signs that your BCMS is part of your company culture? Certainly, continued senior management support and endorsement is a good start. Another sign is the company's acceptance of and participation in various business continuity activities, such as risk assessments, business impact analyses and exercises. The inclusion of business continuity and disaster recovery issues in systems planning and design, operations management, and other critical business activities is a significant indicator of acceptance. Results of management reviews, audits and other assessments can help identify how well the BCMS has been assimilated into the company.
About the author:
Paul Kirvan, CISA, FBCI, works as an independent business continuity consultant and auditor, and is secretary of the U.S. chapter of the Business Continuity Institute and member of the BCI Global Membership Council. He can be reached at [email protected].