We have helped to build, manage, and improve hundreds of business continuity programs across just about every industry and organization size. Effective engagement with key stakeholders throughout the organization tends to be one of the most important attributes of high-performing programs and is often the most difficult to sustain.
We often see that programs start out strong, whether the program is established as a result of a self-identified need for a more resilient organization or there is an identified driver from the board, a key customer, or an auditor. However, this initial focus and dedication to the program often starts to wane over time as the organization begins to feel more comfortable with its response and recovery capabilities. As a result, business continuity professionals are challenged with trying to figure out:
- What is the best way to sustain the planning effort?
- How do I identify ways to continue to improve the program?
- How do I guard against the organization becoming too complacent with its current response and recovery capabilities?
To help solve this issue, we have developed a framework for increasing energy and engagement both within the business continuity program and across the organization. This results in strategy-connected programs, characterized as focused and engaged, that maximize value and improve outcomes.
To address the potential challenges of complacency and fatigue, we have identified three solutions that, when implemented in conjunction with program refresh activities, allow program managers to truly leverage the right people, focus on the right issues, and take meaningful action that contributes to the realization of business continuity program objectives. These include the following:
- establishing the right engagement frequency;
- focusing on actionable program metrics; and
- evolving the program by taking the right actions to address the most important issues.
If you have struggled to find the right level of engagement and create high energy among your program participants, or you are implementing a new program and want to make sure the foundation for effective participation is established from the beginning, we believe you will benefit from the three solutions outlined below. We will provide an overview of each solution to include some of the actionable steps you can take to increase your program’s effectiveness through the right level of engagement.
Connection Cadence
It should be no surprise that the first and often most important requirement to increasing engagement and energy within a business continuity program is to make sure those responsible for business continuity engage the right people and use meetings to discuss topics that are essential in sustaining, maintaining, and improving the program. We call this the connection cadence. Business continuity programs often have well-documented methodology when it comes to “connecting” on business continuity planning activities: reviewing governance documentation, such as policy statements, updating business impact analysis reporting and plan documents, and validating plans through exercises. Most programs, however, miss critically important requirements that are needed to place these tactical activities in a strategic context to ensure everything is done to support the organization’s business continuity objectives and ensure the program continues to provide value to the organization and achieve an appropriate level of resiliency.
Effective engagement requires the identification of the right people to participate, the right meeting cadence to engage with program participants, and the right topics to ensure each meeting is strategically positioned to address what is most important (and real work gets done in these meetings).
The Right People
Ensuring the right people are engaged in an effort is not a problem unique to business continuity. No matter the objective or the nature of the effort, making sure the right people are involved at the right level is a universal ingredient to success, and often a difficult one to achieve. While participation will vary from organization to organization, we leverage a process that program managers can use to assess their participants “fit” and get the right people in the right program roles in an effort to create high-energy and appropriate engagement.
Once the person responsible for business continuity has defined program roles and responsibilities, that person can then either identify the right people for each role or evaluate the effectiveness of those currently assigned a program role. To ensure each participant is the right fit for that role, the person assigned (or that will be assigned) should be able to answer “yes” to each of the following “GWC” questions:
1. Do they get it (understand what needs to be done in this role)?
2. Do they want it (are they motivated to take on the responsibility, do they see the value of participation)?
3. Do they have the capacity to perform it (ability and time to perform the responsibilities)?
In many instances, the answer to one or more of these questions is “no.” Many organizations suffering from poor program performance typically lack proper engagement or experience a significant feeling of stagnation because they didn’t ensure key participants were the right fit for their role. It is common to see a business continuity program manager just start working with whoever was assigned with little thought on if it was the right person or if it was someone empowered to take action for the assigned responsibilities. Every other aspect of effective program evolution requires the right people are associated with the right role, based on GWC.
The Right Meeting Cadence
Many business continuity professionals can empathize with the feeling that meetings are the main thing standing between them and getting work done. At the same time, many program participants dread attending business continuity-related meetings. While poorly structured and poorly facilitated meetings are common in many professions, we have found that great meetings are a critically important aspect of creating great engagement as a means of achieving an appropriate level of resilience. Once the program manager identifies the right participants, it’s time to define what that participation looks like!
The right meeting cadence is one that ensures an appropriate level of engagement in a structured and purposeful way through the facilitation of different types of meetings. While they may differ in exactly who is involved and how frequently they occur, an effective meeting cadence frequently includes these:
- an annual planning meeting with organizational leadership and senior program stakeholders to review program performance over the past year and define the goals and priorities for the year to come
- quarterly meetings with the business continuity steering committee to address issues and measure progress against quarterly goals
- monthly meetings with those responsible for implementing program goals around the business to identify what is working (and what is not), solve issues, and build relationships
- recurring, bi-weekly meetings among the core business continuity team that focus on requirements and priorities for the upcoming two weeks
The Right Meeting Topics
The final attribute necessary to implement the connection cadence solution is ensuring each meeting is focused on discussing appropriate topics with the right people, with the goal of continual improvement and getting “real work done.” While meeting topics will vary over time, it is important to ensure the topics for each meeting align with program goals and objectives, result in actions that can be taken by meeting participants, and have a defined outcome required for meeting success. With a stated outcome for each meeting, program managers are equipped to ensure each meeting will cover appropriate topics for those involved, actively engage participants to contribute to issue processing and solutioning, and reduce time spent on unnecessary or unactionable topics. We will discuss the program issues list below as many great meeting topics come from the issues list.
While the right topics will vary from meeting to meeting, the most common attributes of great meeting topics are a defined input (such as program analytics and the issues list) and defined outcomes (what we want to get out of each meeting). Encouraging participants to rate each meeting is an extremely valuable input to establishing the right topics for each meeting and getting feedback to improve meetings (and engagement). Asking participants to evaluate each meeting against the desired outcome and whether the meeting included the right people will help you improve the topics addressed in each meeting over time!
Actionable Analytics
It is difficult to envision a business continuity program that exhibits high levels of engagement and energy when participants do not have a great sense of performance when compared to targets. To provide greater clarity to all stakeholders, business continuity program managers should ensure they are employing quality metrics. As a rule, quality metrics should:
- provide a clear picture of performance against a set of goals
- be defined by inputs that can be reported on regularly and using a consistent method
- be detailed enough to describe the expected outcome or answer a key question
- attempt to remove subjectivity
- align with measurement and communication techniques that are in place in other areas of the business
- leverage the connection cadence to ensure delivery to the right audience at the right frequency
We believe program managers should focus their metrics tracking and reporting efforts on two sets of metrics. The first set of metrics are activity and compliance metrics (also known as key performance indicators or KPIs), which track the execution business continuity lifecycle activities and outcomes. These metrics help answer two very important questions:
1. Are we doing what we said we would do?
2. Are our actions aligned with the expectations of our customers, stakeholders, and regulators?
Examples of activity and compliance metrics are these:
- roles (defined, assigned, and current)
- competencies (percentage of roles with documented and approved competencies)
- policy (documented, current, and approved)
- issues (documented and approved)
- BIA documentation (percentage documented and approved)
- risk assessment documentation (percentage documented and approved)
- plans (percentage documented and approved)
- exercises/tests (percentage documented and approved)
- training/awareness (percentage participated)
- corrective actions (percentage not overdue for closure)
- management review (completed within the last X months)
The second set of metrics are product and service metrics (also known as key risk indicators or KRIs), which measure the organization’s current capability to meet business continuity requirements (recovery times and capacity at recovery). Product and service metrics allow the program manager and other stakeholders to identify where gaps exist in the organization’s ability to continue to deliver in-scope products, services, and/or processes within documented, approved downtime tolerances and capacities. Taken together, these two sets of metrics help provide program stakeholders with the clarity needed to evaluate program progress and provide guidance and direction on next steps.
It is important that these metrics are provided to stakeholders in an engaging and easy-to-understand manner. Convoluted or confusing dashboards are a sure-fire way to get stakeholders to “check out” or lose confidence in program progress – even if the data paints a positive picture! By presenting actionable performance metrics, stakeholders can quickly understand program successes and challenges and provide quick decision-making to help keep the program moving in the right direction. Another momentum killer is reviewing metrics but not working to solve for the root causes of performance issues, which is a great segue into the evolution engine.
Evolution Engine
Not surprisingly, business continuity programs that do not focus on addressing the right issues and taking the right continual improvement actions in a timely fashion will naturally lose steam. Additionally, program managers who do not assign accountability to the right program participants risk the loss of confidence in the program altogether. To ensure program stakeholders remain energized and engaged, program managers should first ensure they are appropriately prioritizing issues to address what matters most with the right people to solution, instead of attempting to solve all issues over the short-term without priority.
Issues generally fall into one of three categories:
1. a problem that needs a solution;
2. a topic that needs to be communicated; or
3. a recommendation or idea that needs brainstorming or approval.
By maintaining a prioritized list of program issues, participants can better target their efforts to deliver maximum impact and address potential obstacles in the program that need attention. This prioritized list should be well socialized among program participants and regularly reported to help maintain momentum. Some issues may need to be escalated from one meeting to another (for example, from a business continuity core team focus meeting to a quarterly steering committee meeting), which means that a program issues list is often a key input to the great meetings described above.
The issues that program participants prioritize should have clear next steps or actions assigned once an issue is solutioned. This is not to say every issue will be solved by a single action, but rather that the outcome of every solution is at least one action, assigned to an owner, with a determined due date. Examples of an action could be communicating the outcomes of the discussion to a specified audience, making a change to program documentation, or escalating the issue to another meeting for resolution.
Care should always be taken to assign accountability to the right person to take the required action. While many of the issues and actions may originate from the steering committee or leadership, it does not mean these same people are the appropriate action owners. Instead, program participants should take a critical eye to ensuring those assigned responsibility to take the action are the right people. The GWC exercise above is a great way to ensure those assigned responsibility understand the action, have the willingness to execute, and have the capacity to get it done.
Putting it All Together
While there is no one-time-fix to increase engagement within your program, we have seen the three solutions introduced above, when applied consistently over time, significantly increase the level of effective engagement within business continuity programs and across the organizations that they support. When program managers establish the right connection, focus on the right metrics, and take action on the right issues, all program participants feel increased enthusiasm and connection with business continuity program objectives. Our business continuity operating system is comprised of three main sets of activities: frame, build, and evolve. Each of the concepts discussed above have been proven to positively evolve business continuity programs and help program managers achieve lasting engagement and improved outcomes, all leading the appropriate level of resiliency.
♦
John Verdi is a managing consultant at Avalution Consulting, the creator of the Business Continuity Operating SystemTM and Catalyst Business Continuity Software. Verdi has extensive experience building and managing best-in-class business continuity programs across nearly all industries and sectors. Verdi’s areas of specialty include life sciences, IT Healthcare, and financial services. Additionally, Verdi enjoys various elements of Avalution’s internal practice management, including developing his team of high-performing consultants. Verdi can be reached via email at john.verdi@avalution.com.
Morgan Perry is a managing consultant at Avalution Consulting. Perry contributed to the development of Avalution’s Business Continuity Operating SystemTM and has built and managed world-class business continuity programs for organizations in a variety of industries and organization sizes. Prior to Avalution, Perry served in the U.S. Army, specializing in operational leadership and contingency planning. Perry can be reached at morgan.perry@avalution.com.
