DRJ Fall 2019

Conference & Exhibit

Attend The #1 BC/DR Event!

Fall Journal

Volume 32, Issue 3

Full Contents Now Available!

change1During much of the past 25 years, planners and consultants have proven their worth by producing documents – three-ring binders, Word files, Excel spreadsheets – to obtain a glorified checkmark from auditors to satisfy basic regulatory requirements and provide management a comfort level that “we’re covered.” In today’s fast-paced, hyper-competitive, global business environment, executives now ask a few questions:

  • Does BCM make us money?
  • Does BCM save us money?
  • Does BCM benefit our customers?
  • Is BCM only an elaborate satisfier of regulatory compliance?

During tough economic times – when tax payers are the virtual owners of General Motors, AIG, Fannie Mae, and companies like Lehman Brothers, Bears Stearns, and Stelco no longer exist – executives are choosing not to fund BCM simply to meet regulatory requirements. They’re not interested in spending precious corporate funds to produce three-ring binders and documents in a SharePoint environment of dubious value. They refuse to spend a dollar more than necessary to meet the minimum requirements. If that’s the only value they perceive from BCM, who can blame them?

During the last few years, distinct and disturbing trends have been monitored including the following:

  • a notable increase in BCM colleagues who have become “consultants” (not by choice)
  • the downsizing of BCM programs (and too often their outright elimination)
  • a rising number of organizations replacing full-time staff with short-term contract “consultants”
  • decreasing attendance (30 or more percent) at key industry trade shows and BCM association meetings.

If organizations find value in BCM, why are these trends continuing?

BCM as an Operational, Competitive Edge

Business continuity management can become an operational competitive edge if – and only if – our industry moves away from its legacy as a document production factory and into day-to-day operations.

To implement day-to-day incident management, we must have critical information at our fingertips and convert the reams of disparate data spread throughout our companies into real-time decision support intelligence.

As our organizations continue to use technology and automation to maintain a competitive edge, vast data sources grow throughout the enterprise (HRIS, CAFM, CRM, ERP, and CMBDs for example). Turning all that data into useful information requires modeling tools, to merge the people, processes, technology, infrastructure, and vendor data streams into a single relational database. This enterprise modeling concept can provide a dynamic, holistic view of the organizational assets from business process to a single blade on a data center server. If that single blade fails, you could instantly show your executives its upstream and downstream dependencies.

change2Enterprise modeling enables the performance of gap analyses (where are the risks?) and operational analytics (“what if?” analyses), creating true, dynamic business intelligence. With a modeled organization, BCM leaders can provide a real-time holistic view of the organization, crossing all the silos – functional, departmental, line-of-business, regional, and international.

The information derived from enterprise modeling provides a decision-making support tool for executives, enhances operational risk management, and supports day-to-day operational incident management – not just “disaster” or “crisisresponse. These capabilities can push BCM from a static, plan-centric document management exercise into a critical, strategic, and valuable operations function. Imagine being able to show executives the ripple effect of a disruption to the organization’s assets in real-time!

Many respected members of our industry have claimed repeatedly that a successful BCM program can only occur when:

  1. The planning process is pushed out, “socialized,” to all of the organization’s appropriate Subject Matter Experts (SME) and end users.
  2. A continuity program is ingrained and used day-to-day and operationally for various functions. Resiliency only occurs when people actually participate in the program on an active basis.
  3. The program becomes sustainable when the program exhibits a true return on investment (ROI) by making or saving money, along with its customer satisfaction and regulatory compliance purposes.
  4. The program supplies invaluable information that can’t be found elsewhere and provides on-demand decision support, business intelligence, and war-room capabilities.

True resiliency occurs when planners become facilitators and push the planning process out to hundreds, if not thousands, of users/SMEs. The value of the BCM planner increases exponentially when the number of active participants expands across the organization. With access to modeling output, the BCM planner gains greater access to executives by generating and providing key real-time strategic information.

Justification: Benefits for Planners and Their Organizations

Most BCM planners are isolated islands within their organizations, desperately trying to sell their personal and program value to their executives. With an enterprise modeling-based BCM program in the operational incident management space, the planner:

  • raises his/her value by providing real-time operational information to executives
  • supplements the static planning process with an executive-level real-time decision support capability
  • runs a successful, viable, and sustainable program with 100s and/or 1,000s of SME/end users reporting dotted line into the planner, reinforcing his or her employment value.

The organization’s benefits include:

  • a return on investment (ROI) on full-time employees (FTE), training, and operational savings
  • additional operational functions (asset, facilities, change management, regulatory, etc.)
  • a strategic decision support capability with real-time view of business assets
  • “What if?” analysis, interdependency mapping, gap analyses, and other operational capabilities
  • cost savings in terms of process improvements and administrative efficiencies


These are perilous times for the business continuity industry. On one hand the economy eats into budgets and headcounts. On the other, regulations, customers, boards of directors, and others clamor for greater protection. If BCM is to survive, it must migrate into the “operational risk/incident management” space. Whether as part of enterprise risk management (ERM), business continuity management (BCM), disaster recovery (DR), emergency measures (EM), the BCM profession must migrate into day-to-day operations.

In my days as a mining engineer, I had plenty of experience with day-to-day incidents. Once, a 50,000-ton-per-day mill producing molybdenum (steel hardener) was disrupted when one of the key flotation lines was damaged. The mine manager said, “I don’t care what you spend … that downed line is costing us $20,000 per hour in lost production.” With absolutely no hesitation, more than $300,000 was spent to solve that disruption. This illustrates how money and resources are poured into operation incidents.

In the BCM world, we are constantly selling the value of our programs and begging for scarce money and resources to survive. Executives continue to question the value of BCM programs, if they care at all. Coming from operations with standard operating procedures (SOP), I always questioned why the BCM department existed outside mainstream operations as a separate entity. What value could this department possibly offer me, with its hypothetical plans and time-consuming documentation?

Recent disturbing downward trends in BCM mean one thing: it’s time to change or perish, it’s time to do more than just talk about increasing the value of BCM. It’s time to do something about it!

BCM must travel down a different path than its historical three-ring binder road. Traditional BCM planning serves only a single function – preparedness for some disaster that may never occur. The future of BCM lies with serving multiple functions – by supplying real-time critical information that isn’t available elsewhere. Otherwise, BCM’s future will eventually go the way of shorthand dictation and word processing departments: into the dustbin of business history.

If our industry – or at least its professional practice – is to survive, grow, and flourish, BCM must move into day-to-day operations and be accepted as an integral part of operational risk management.

BCM professionals have already started this process and found that by moving their programs into operations via enterprise modeling, they have gained visibility with executives and increased access to resources. BCM professionals are transforming their programs into an operational competitive edge!

Ken Mah, M.A.Sc., P.Eng., is the senior manager for business development for eBRP Solutions Inc. At GE Capital IT Solutions, Mah was a senior business continuity consultant. He is a past director of the Disaster Recovery Information Exchange (DRIE) and a member of numerous trade associations. Trained and educated at the University of Toronto as a metallurgical and process control engineer, he has worked in operations for information technology, manufacturing, and mining/oil companies.