We’ve always done it that way.” The periodic occurrence of these words within a business continuity management program (BCMP) should prompt program stakeholders to consider whether an opportunity for improvement is presenting itself. Business continuity, like all professions, requires constant process improvement. Organizations must not allow the longevity of the profession’s core activities and artifacts to suppress the need for continuous improvement.
In “The Essential Deming: Leadership Principles from the Father of Quality,” W. Edwards Deming, the respected architect of many modern quality concepts said, “Management’s responsibility is to strive toward optimization of the system and to keep it optimized over time. Failure to optimize, suboptimization, causes loss to everybody in the system.”
The general objectives of optimization should analyze process complexity and process resource requirements. Process complexity analysis evaluates whether the process can be simplified. Process resource analysis evaluates whether the amount of resources committed to the process align with the overall value proposition of the activity.
Specific initiatives for BC process optimization may vary. However, many groups should find improvement opportunities within the foundational areas of planning and exercising. The length of a business continuity plan (BCP) should align primarily with the number and complexity of the plan’s recovery strategies. The “relocate” recovery strategy lies on the high end of the complexity spectrum, relative to the number of people (or applications) who participate, the urgency of recovery, and the distance to the recovery site(s). “Relocate” strategies send employees to company- or vendor-managed recovery sites. A simple recovery strategy, such as “work from home,” could be documented in a page. A similar amount of documentation will also suffice for most “transfer work” recovery strategies, where the impacted organization relies on a non-impacted group to pick up its work requirements during the impacted group’s recovery process. In many cases, this strategy requires nothing of the affected team.
The BCP exercise program should focus the bulk of its effort on testing constrained and complex recovery strategies. A constrained strategy exists when the recovering group relies to a significant degree on technology, facility, and/or human resources which have competing recovery support requirements. Examples include: relocating to a work area recovery site which has multiple subscribers for the same seats; or relying on a technology support team which assists multiple recovering organizations, but cannot concurrently support all recovery requirements. Exercises of these strategies should focus on the aspects which are constrained, to evaluate whether all groups can meet their recovery time objectives (RTOs). These strategies are also more complex.
The “work from home” and “transfer work” recovery strategies are less constrained. Exercises could be consolidated or possibly integrated into normal work activities. Further, a test of the “work from home” strategy could be coordinated or scheduled to coincide with external party exercises, to place additional demands on internet service providers.
Exercises of entities with open-ended RTOs provide an additional optimization opportunity. If the recovery duration truly is unlimited, testing for these groups or applications may be discontinued. No organization should commit resources to verify recovery can occur within an unlimited timeframe.
Process improvement does not necessarily result in doing less at the overall BCMP level. Each recommended process change requires analysis on its own merits. The simplification effort should identify some processes for resource reduction. On the other hand, opportunities should arise to expand program activity levels in other areas. The organization’s risk management effort should identify high-impact, risk mitigating program elements that would benefit from additional resource commitment. Process optimization’s success in reducing time and resource investment in lesser value activities can help the organization refocus resources within existing staffing levels.
The consequences of not optimizing processes can range from minor to significant degrees of loss. The loss of credibility can occur if BCMP processes are perceived to be unnecessarily tedious or lacking in current technology functionality. Failure to optimize can cause misalignment of resource weighting on lower-value activities. Corporate leadership may impose unplanned staff reductions on the program in extreme circumstances.
As Dr. Deming said, “It is not enough for everyone to do his [or her] best. … Efforts, to be effective, must go in the right direction.”
Frank Lady (bcjfrank@gmail.com) is a senior vice president of business continuity at Bank of America and a member of the DRJ Editorial Advisory Board, where he chairs its Glossary of Terms Committee. The author appreciates and has incorporated suggested refinements from Britt Pursley.
Recent Comments