There are many different components to your BCM program, including your business impact analysis (BIA), recovery plans, exercises, training, and metrics. Some components are from critical business units that require recovery right away while others can be deferred for an extended period. In light of the great depth and breadth of the BCM landscape, the question arises: Where should your BCM office focus its time and resources to ensure the highest potential for recoverability in the event of a disruption?
More specifically, should the focus be on the front end (BIA, risk assessment), the middle (strategies and plans), or the back end (exercises and maintenance)? Are there areas in the company where you can safely spend little to no time and effort? By arriving at informed answers to these questions, you can greatly increase the return on investment of your organization’s BCM program.
I discuss two approaches (below) which you can take in prioritizing your efforts. The first is more general self-improvement advice about identifying and focusing on areas that offer the most potential return for your efforts. The second is more specifically oriented toward business recovery and is made up of two parts. The first part looks at tackling your company’s business units based on how critical their swift restoration is to its survival. The second part is a recommendation which allows you to focus on recovery strategies and exercises.
How Business Recovery Planning Is Like Golf
I love golf, and I have been fortunate to have been a top amateur golfer since I was a teenager. One of my lifelong goals is to play as an amateur in the U.S. Open. Nowadays I’ve set my sights on qualifying for the U.S. Senior Open. Unfortunately, as a non-professional, my practice time is limited, and over the years I have come to recognize that if I hope to substantially improve I need to use my practice time wisely.
Specifically, I realized I needed to focus like a laser on the aspects of my game which were most critical to my success as a tournament player. I began analyzing each round of golf I played to identify the areas of my game which offered the best chance of helping me reduce my scores. I identified two areas where I needed to focus my practice time: putting the ball and driving it off the tee. I then adjusted my practice schedule to spend a much greater percentage of my time on putting and driving (and less on such things as chipping and bunker shots which offered less room for improvement). I haven’t yet realized my goal of playing in the Open, but over the years this approach has helped me improve materially, heightening my potential for ultimate success.
This approach works in golf, and it also works in business recovery planning. To strengthen your organization’s BCM program, you can benefit from identifying the areas which offer the greatest room for improvement as you begin to focus your efforts.
First, Focus On Criticality
The BIA identifies what is most critical to the survival of your company. It pinpoints what must be tackled first and what can be deferred for an extended period. However, many BCM offices scatter their resources across the full spectrum of criticality. This lack of focus leads to disjointed efforts. In your program, strive to be laser-focused. Consider allocating your team’s time and resources using a phased approach as set forth below:
- Phase I – Focus on business units with RTOs of 24 hours or less
- Phase II – Focus on business units with RTOs of 48 hours or less
- Phase III – Work on business units with RTOs of 5 days or less
- Phase IV – Work on business units with RTOs of greater than 5 days
What it comes down to is creating a focus for the “trench warfare” that will keep your company running in the event of a disruption. Do not move on to areas with a longer RTO until you have bullet-proofed each criticality segment in the earlier phases.
In the long run, do you really need to do much, if anything, for those business units with RTOs of greater than five days? If you can recover what you need in the first five days, you will have succeeded at your mission and be put in your company’s Hall of Fame.
Second, Focus On Strategies And Exercises
Based on many years of experience, I have found in most companies’ BCM plans, the same two areas tend to be the weakest links. Inadequacy in these areas typically poses the most significant risk to recoverability in the organization. These areas are:
- recovery strategies
- recovery exercises
With regard to recovery strategies, I commonly find in organizations of all sizes strategies that have not been implemented, aren’t fully vetted, haven’t been funded, and/or will not provide full recovery capability to the business unit or computer system. Arguably worse than all of these is the case of the company where the recovery “plan” is to decide on and implement a recovery strategy at the time of a disruption.
In the area of recovery exercises, I frequently find most BCM and IT functions are being exercised at the lowest end of the spectrum. If you want to become a faster runner, it helps to race with runners who are faster than you. You may come in last every time, but in striving to keep pace with the elite you will gradually build improvements in your speed and times. The same applies to recovery exercises. You must exercise your recovery plans to the highest level based on their degree of criticality. The more critical the business unit and/or computer system is, the higher the level of exercises which should be applied to it.
Spend the bulk of your time and resources on the areas which offer the most room for improvement. Focus on the stuff to help you get the ball in the hole in the fewest number of strokes. Your goal is to implement sound recovery strategies which are validated through the highest possible level of recovery exercises. In working toward this goal, be disciplined about where you focus your efforts. Analyze your program like a golfer trying to improve his or her game, then concentrate your efforts on the areas where you stand to reap the greatest benefits.
- First, concentrate on the areas which are most critical to the survival of your company.
- Second, look at recovery strategies and recovery exercises.
- Keep in mind that an awareness of the areas of your program which offer the greatest room for improvement can be used to focus your efforts.