After the Sept. 11, 2001 terror attacks and the late 2000s financial crisis, the popularity of business continuity management systems (BCMS) surged. But despite the positive momentum, the bubble quickly burst. So much so that by COVID-19, business continuity plan adoption rates were around 65 percent. Clearly, an awareness of business continuity management experience of disruption wasn’t enough to produce well-resourced business continuity programs. What will: building a business case for business continuity management that demonstrates value, obtains approval, decides whether to outsource, prioritizes projects, and secures funding. Not sure how to build one? Here are the four steps that matter:
Step 1 – Lay out the numbers
They don’t lie. Your executive summary should include data points. A big one: how the failure to properly prepare for crises increases the risk of post-crisis business closure.
Not only that, give your reader a sense of the threats effecting your industry. In 2019, the top business continuity threats were health and safety incidents, IT and telecom outages, cyber-attacks and data breaches, and lack of talent/key skills. Forecasted for 2020 were more cyber-attacks and data breaches, IT and telecom outages, critical infrastructure failure, and lack of talent/key skills.
Also, your business case for business continuity management should include generic costs for disruption. Some disruptions, like unplanned downtime, are easy to quantify. Other disruptions have more intangible costs, like lost productivity, morale, engagement. If you’ve had an incident at your firm, include how much it cost to respond to that disruption in the executive summary.
Step 2 – Define the aims of the business continuity program
Too many business continuity programs flounder because they don’t have succinct aims. It’s not enough to say that the risk picture has darkened, and the costs of disruption are increasing. You still need to prove that the ROI of value-creating business continuity resources, i.e. risk mitigation. Remember, decision makers always ask: how will allocating the requested resources minimize brand damage and the risk of critical business interruptions?
Focus on the concrete ROI in the strategic logic for your business case. That logic is likely to include:
- Reduces likelihood of losses by identifying ways to prevent or mitigate threats.
- Ensures compliance by dedicating resources to minimize the risk of compliance violations.
- Helps retain existing and secure new business by showing customers that their assets will be protected.
Also, steer clear of some of the landmines when building a business case for business continuity. For one, business continuity often gets dismissed as a mere auditory function, rather than a value- and revenue-creating function that aligns with the business’s larger objectives. You will need to make the case that business continuity will make a proactive intervention in the lifecycle of critical products and services.
Step 3 – Include relevant assets that reflect the context of your organization
Concepts are one thing. Creating relevant assets that garner C-suite buy-in is key to building a business case for business continuity, though. The first asset consists of the business impact analysis (BIA), which is a diagnostic of a business’s internal dependencies and vulnerabilities, which provides the analytical baseline for developing (later) BCP materials. The BIA should offer senior management a bird’s eye view of the critical business activities that generate the most money or benefits to the organization, how badly those activities would be impacted by a disruption, as well as insight into the pathways by which impact would possibly take place. To be practical, the BIA process must surface recovery requirements that will later be used to develop discrete strategies, solutions, and plans for overcoming operational vulnerabilities, i.e. the BCP.
Step 4 – Ask for the resources needed to maintain acceptable risk levels
Producing assets that are relevant to the context of your organization is key to building a business case for business continuity management.
What would those resources look like? Well, business continuity technology should be part of the project scope. And there’s research to back that up. In crisis, every minute matters. But only one third of organizations can activate emergency communications plans in five minutes, according to BCI. Ten percent take more than an hour.
Manual processes, practices, and systems just won’t cut it. Indeed, failure of manual processes gets cited as the reason for the failure to achieve accepted response levels over 25 percent of the time. Further, gathering, validating, and sharing accurate information, communicating with staff, customers, and other stakeholders, as well as getting staff to follow planned procedures remain key business continuity challenges, all of which are either caused or exacerbated by manual processes.
The investment in technology and increased dedication to training and exercising also has a positive ROI. Seventy-three percent of organizations who’ve made that investment achieve their expected response levels.
Of course, not all business continuity management software is created equal. You’ll need to determine what kind of software will best reinforce your organization’s unique business case.