As the saying goes, “It doesn’t matter what road you take if you don’t know where you are going.” For many business continuity management (BCM) programs, not knowing the destination is the norm rather than the exception. The BCM staff at many organizations go about their day-to-day business with no roadmap of strategic and tactical steps they need to take to heighten the sophistication and capability of their BCM program over time.
The lack of a roadmap leaves teams and stakeholders with no direction, prioritization, targets, common understanding, or shared ownership of the plan for the program. The message sent by this approach is take whatever road you want; we may or may not get to our goal; it does not matter one way or the other.
Why a Roadmap Is Essential to Success?
There are many reasons why having a roadmap is critical to the success of a BCM program. Here are a few of them:
- It is just good planning for all the areas that contribute to a successful BCM program.
- Roadmaps incorporate an explicit element of time. By stating when various tasks should be completed, a roadmap creates a sense of urgency. This is a real boost in terms of getting things done.
- The roadmap prompts a team to be specific with respect to planned capabilities or performance in terms of value for stakeholders.
- A roadmap can reveal gaps in product and technology plans. Areas where plans are needed in order to achieve objectives become immediately apparent. Gaps can be filled before they become problems.
- Roadmaps prioritize investment based on drivers. At every stage of the roadmapping process, the focus is on the most important things: stakeholder needs, program drivers, and technology investments. The team is prompted to identify, implement, develop, or acquire the most important things first, spending time and resources in the best way. Also, with a set of roadmaps in a common format, decisionmakers are better equipped to make the tradeoffs and choices that best meet the organization’s objectives.
- Having a roadmap helps the team set more competitive and realistic targets. Such targets provide constructive pressure which allows the team to focus its efforts and accomplish its goals.
- Roadmaps provide a guide to the team, allowing it to recognize and act on events that require a change in direction.
- Sharing roadmaps allow strategic use of the BCM program across company functions. Cross-roadmap reviews look at the plans of several company functions to find common needs, capabilities that can be leveraged, or development costs that can be shared.
- Roadmaps clearly explain to management where the BCM program is going. A roadmap gives stakeholders information they can use in their own planning and can be used to solicit their reaction and guidance.
- Finally, roadmapping builds the BCM team. The roadmapping process builds a common understanding and shared ownership of the plan, incorporating ideas and insights from team members.
When Should I Build a Roadmap?
Roadmaps can be built at any time, but in a perfect world we would recommend that your BCM program roadmap be built in the last quarter of the year for the subsequent year. It should be approved for implementation well before the first quarter of the next year.
What Timeframe Should My Roadmap Cover?
Typically, we like a roadmap to represent the deliverables and actions over a 12-month period, broken into quarters. You can make it shorter or longer (e.g., 6 months or 24 months) depending on your needs, but a 12-month period is a good span to consider.
What Information Do I Need to Build a Roadmap?
The basic information and data that should be gathered to provide insight into a BCM program roadmap is as follows:
- Level of alignment with standards. Do we have major compliance gaps that need immediate attention, or is our alignment with standards good enough that we do not have to allocate resources to this area?
- Level of residual risk in our recovery plans. What mitigating controls in our plans are not being executed at the highest levels (e.g., recovery strategy or recovery exercises)? Which plans have the most risk that needs to be mitigated to bring a higher level of execution?
- Budget. Do we have a sufficient budget to execute everything we want, or do we need to choose what is most critical?
- Resources. Do we have enough team members to execute the roadmap, or do we need to hire more staff or bring in additional external resources?
- Management expectations. Does management want us to work at an accelerated pace or build the program in small pieces over time?
- Deliverables. What three to five key deliverables would heighten the sophistication and capability of our program while reducing the most risk in the next year?
- Additional concerns. Do we have audit, customer, or outside regulatory concerns that need to be addressed as a priority in the roadmap?
Building the Roadmap
The steps involved in building a BCM program roadmap are as follows:
- Gather your team and stakeholders as well as the documentation discussed in the previous chapters, namely any assessments you have prepared on the level of your alignment with your chosen standard and your level of residual risk. Also include any audit findings regarding what you need to implement over the next 18 to 24 months.
- Determine the period the roadmap will cover (e.g., three months, six months, 12 months).
- Break the roadmap into manageable pieces (e.g., months, quarters).
- Define the high-level deliverables and tasks that must be produced and accomplished based on the data you’ve gathered (regarding compliance; residual risk; audit, customer, or regulatory concerns; and so on).
- Overlay the high-level deliverables and tasks into the period in which you and your team can successfully execute them (e.g., the week, month, or quarter).
The goal of the roadmap is to show management and your team a high-level picture of what you will execute over time to raise the sophistication and capability of the program.
Maintaining the Roadmap
The roadmap is a living, breathing document. You, your team, and your senior management should review and update it on a regular basis. At a minimum, you should review the roadmap with your team monthly and your management quarterly to assess the following:
- Which parts of the roadmap have we completed?
- Where are we behind schedule?
- What roadblocks are we encountering?
- Do we need more resources?
- Does the roadmap need to be revised?
Takeaways
- Knowing where you want your program to go is critical to its success.
- Having a roadmap creates urgency, reveals gaps, guides your efforts, and builds your team.
- The best time to build a roadmap is in the last quarter of the year.
- In building a roadmap, first gather the necessary information.
- Follow the steps set forth in the chapter to build your roadmap.
- Update your roadmap on a regular basis.
Michael Herrera is the CEO of MHA Consulting, a leading business continuity planning and information technology consulting firm. Herrera is the founder of BCMMetrics, which specializes in business continuity software designed to aid organizations in developing and executing business continuity programs.
