It can take a lot of time and effort to establish something to a point where one is happy with the results but does that mean that no more time and effort is required? That’s a question organizations must ask themselves when it comes to validating their business continuity management (BCM) program. An organization can work for years at establishing a fantastic program but if it isn’t validated along the way, the information developed just ends up looking fantastic only on paper.
When we take a road trip, do we not validate where we are, the level of gas left in the tank and the time it takes us to get to our destination? Yes, we do or else we may never know where we are. So too must an organization’s BCM program. Organizations must continually work towards their destination but validate their progress along the way. When components are validated they become living – real, workable, usable and helps identify benchmarks from exercise to exercise. What’s been developed – and enhanced through exercise – can then be used to respond to situations that will hamper an organizations ability to continue operations or at the very least, provide guidance on actions to take. If processes and procedures aren’t validated and those responsible to execute activities don’t get the opportunity to practice them, the plans just end up as dust collectors, useless words on pages or devices used to hold up rickety tables. The plans offer no benefit or value to anyone and are quickly forgotten.
We have two options; test or exercise?
Test is not a positive word. The word test comes with negative connotations; remember when your teacher said you were going to have a test? I personally didn’t know anyone who was happy to hear those words. With a test, you’re given only two possible outcomes pass or fail. With options such as these, it’s not surprising many people don’t like them. The difference between tests and exercises is that one will produce value and significant results and help motivate employees while the other will de-motivate employees, cause finger pointing and result in lower confidence levels in the overall program – and themselves.
John Sensenich, in his essay, The Recovery Vendor’s Perspective, states that “…the purpose of exercising a plan is to determine its weaknesses and well as its strengths, and to look for ways to ensure a successful recovery in the face of disaster. Exercising focuses attention on the positive not the punitive.” What an organization must do is change its mind-set; change from the testing mentality to one of exercising.
Exercising helps an organization work towards something; a goal to make itself and its employees better at what they do. Exercising helps people actively build upon their skill sets and knowledge base, challenges assumptions – either to confirm or dispel them – and helps maintain a level of service that can be managed under any circumstance. Like the obligatory New Year’s resolution, one trip to the gym won’t make a person fit and strong; it must be continuous with a positive outlook before the resolution sees any benefits. Exercising is a mind-set and if structured effectively with the appropriate attitude and support, can continually return value. How?
Exercise has a much more positive connotation rather than the negative connotation associated with test. Many BCM practitioners have had to deal with those who want their continuity strategies tested repeatedly until the initiative is proven successful and finally receives a passing grade. The problem is the constant testing and re-testing utilizing the same scope and objectives – the one’s executives want to see as “pass” – prevents the program from moving forward. It only provides confirmation that after numerous failures a passing grade is obtained, while the business process or technology components supporting that process has changed or evolved to meet new needs. The test strategy and methodology no longer mirrors the current position of the organization.
There’s no benefit or value here because many will not want to be part of further initiatives that set them up for failure; a test can do that. Anything that has a connotation associated with it that can mean a person is a failure; the less likely they’re going to want to participate. If during the test people find even just one issue, senior management might be ‘howling in the boardroom,’ stating the strategies aren’t working and assume participants have it all wrong or are doing it wrong. This won’t move a program forward; it might actually move the program backwards because the test is still focusing on the scope and objectives originally agreed too from the first attempt, meaning they continually test the same strategy over and over again until they get it right; a strategy that may relate to the company as it was months earlier. What happens when participants are told they failed and that they have to do it again and again until they get it right?
What often occurs is that results will be fudged or issues hidden so that they can get on with other activities – their day-to-day jobs. This helps remove themselves from the cross-hairs of management who repeatedly send them back to the testing table once more.
An exercising mindset supported by management, will actually get participants to want to find issues. Those involved actively find the gaps and see this as a step forward for the program, making it more and more valuable because management – and others – would rather be able to find the deficiencies during controlled circumstances rather than discovering them during a real situation. An organization can’t find fault in this strategy; its helping them move forward with BCM planning, awareness, training and process development. This attitude actually shows value because management and employees – let alone those involved with the exercise – are seeing the program develop and they are becoming part of the plan. The false sense of security that results from fudged findings doesn’t exist when it comes to exercising. It’s a positive approach to find gaps, gaffs, mistakes and inconsistencies. This is a win-win situation because it’s finding mistakes, oversights and omissions before they occur. Contribution and collaboration make exercises successful, no matter how many issues are uncovered.
When an organization gets to this stage, team members are showing commitment not just to the organization and its clients, suppliers, vendors and customers but they are showing commitment to themselves. This is much more positive than telling people they’ve failed in a role. Exercising is positive. Exercising is collaborative. Exercising BCM programs can be fun, enlightening and revealing; not in a spiritual sense but in a sense of discovering ways on how to do things better. There is no fear of failure with an exercise; in fact the very idea of challenging people to find gaps in processes and procedures is seen as empowering and encouraging. It helps find components that are not fully developed or helps dispel assumptions that are used to build plans, processes and procedures. No one is condemned for identifying gaps and no one is seen as a failure for helping find an issue that if not identified under controlled circumstances, could damage an organizations reputation and ability to respond to a disaster.
Exercising keeps people involved and contributing to overall program development, not because anyone is forced to be participants but because they feel part of the experience; a part of the overall initiative. As they participate and progress through exercises, so too do the processes and procedures; becoming stronger and more effective. As the exercises progress, so will the participants. They begin to challenge themselves to do better. From a business continuity perspective that means people themselves will build the program in a proactive manner. This is business continuity leadership, not business continuity management; the ability to give people the tools and abilities to grow and develop.
Strength comes from practice, positive reinforcement and constant exercising. Change the test mentality and an organization will see that others will want to contribute to the program because they’ll see it as delivering value; to a department, to clients and customers, the organization and to the participants themselves. With exercises, an organization will discover its program moving forward, even when along the way it may be identifying things that it can be improve upon. That is the strength of exercising.
A.Alex Fullick, CBCP, MBCI, CBRA, has been working in business continuity/disaster recovery for 16 years and is the founder of StoneRoad, a training and consulting firm. He is also the author of two books, available at www.stone-road.com.
