As we take a look at our organizations during Business Continuity Awareness Week, perhaps one of the most consistent challenges has been the business case. The definition of value is the cornerstone for clear communication with senior management, and continues to be a quandary.
The struggle for definitions; value, resilience, ROI in BC, must have us ask: “What is the value of business continuity?”
The search for the value of business continuity is not of models, but of philosophy; not of others, but our own. The history of BC grew from DR, preparing systems and processes for recovery, and evolved toward resilience with the addition of emergency management and response. But the ability to handle brand management has been awkward, and garners less credibility, due to the ill-balance of upside and downside risk management.
Senior management primarily focuses on creation of opportunity; wealth, innovation, resources, and acquisitions. BCM has an opportunity to be directly involved in the creation of efficiencies in these areas, and is strategically placed within Operations Management, which is the costliest area of an organization. The ability of BCM to streamline new and current revenue streams, is unique. By mitigation of risk, and determination of upside risk capacity, it is one of the few areas where substantive change can be made, due to constraints.
There are those who argue business processes are not under the purview of business continuity, but suppliers, technology, SLAs, are part of processes. We are already involved, and the resultant optimization of systems, risk mitigation of upside risk for better decision-making in the innovation life cycle, and reduction of response time during breaches increases value.
A balanced scorecard: strategic value creation
The Poneman Institute states business continuity shortens response times to breaches by 100 days, and losses by 66%. One of the ways to know if we have generated influence, is if there is insight between departments. In a different Poneman report, cyber resilience was placed in the CIO’s hands in most organizations, but several in the information space are main influencers. BCM is at the bottom of the pile.
On the flipside, business continuity planning is seen as critical, with 70% stating it is one the most important aspects of resilience. Many have stated a:
- Lack of metrics
- Lack of leadership connection of resilience to revenue
- Lack of knowledge of their own resources
This is also troublesome, as metrics, specifically a balanced scorecard, would join the strategic goals and objectives in an iterative fashion. This creates accountability, which is elusive, in resilience. This is where Operations Management can offer its experience in making the intangible, tangible. When an organization establishes an audit process, senior management believes it has value.
- This is the opportunity to become the SME of the organization
- Information security states, reputation and revenue were of little importance to them
- Business continuity is the balance, as internal and external stakeholders cannot be left out of the decision-making process
The question lately has been: “Why isn’t anyone listening?” Perhaps the query should be: “Are we listening?” Business drivers are innovation and new technology, which increases upside and downside risk, and revenue. In that case, we must be there to vet new technology, because it increases competitive advantage. Understand the drivers of new business, and you can reach senior management, establish value, and create the need for business continuity.
For BCM, it is crucial to create an identity which is part of the business culture of an organization. It is not enough to build a plan from the mission statement. This means disaster recovery must a universally independent entity. Business continuity must understand resilience is not based in the processes alone, but future investments, the supply chain, sustainability, innovation, and people.
Value is more than a number, which is only a symbol, an expression. Return on investment is dependent upon the value business continuity and the business place upon one another. Similarly to a marriage, the effort to learn value can be a simple, 'why?'
So, where are we now, and where do we go from here? As a great professor once stated: “It is neither good, nor bad, just a different idea of what people believe is worth the effort.” Perhaps, value is better measured in the long-term, where events regress to the mean, and reached after we have agreed upon definitions for 'returns', and 'success'.
Radhika Murali is an MS student at Boston University, in Business Continuity, Security, and Risk Management. She has her ABCP, ten certifications with FEMA, and twelve years of experience in supply chain, as well as independent research in organizational resilience.