As the CEO - what assurance you need from business continuity program?

If you are the CEO, seek responses for the following questions.

1. “What customers pay us for?”

Business continuity program should ensure cash registers rolling. It should not restore to a point less than this. If your business continuity continuity program fails to ensure this, there is a serious lapse between your continuity strategy and business objectives. This single minded focus will alone drive the outcome of the business continuity strategy.

2. ‘How many hours of business downtime is acceptable to our customer”? (Did your customer just say “None”?)

Restoration of business in specific time is key to successful Business continuity management system (BCMS).  This is done through a formal Business impact analysis (BIA). Get a BIA done. It will give you a quick answer to the question.

3. “How much are we willing to pay to protect our revenue?”

Business continuity program is not cheap, but then the value of restoration is also not cheap. No other alternative (such as insurance) restores continuity. Smart design (read less expensive) strategies including increasing resilience in processes, working from home, alternate vendors/suppliers, moving core technology infrastructure into cloud – all could be part of the ‘saving cost’ strategy. So speak to your teams and seek whether they are adequately funded.

4. “How prepared are we?”

Documented plans are required based on events and outages.  So you need a plan for each known event such as ‘fire’ (evacuation) as much as outage (such as building not available). The former is called ‘threat-event’, and the latter ‘threat-impact’. The question that you should ask is ‘which part of the restoration is not documented’?

5. “How many tests have we performed?”

No tests = no BCP. Your business continuity plan is as good as, or as weak as the number of tests performed. You may have the best of documentation but without tests, no BCP exists. In fact a smarter strategy of building BCMS actually starts with a BCP test for top management because that is where the ‘impact will be felt more’. Bring them in a conference room give them a disaster scenario unfolding, see how many different directions you get. Did you participate in any one of them, do you have a visibility of the restoration process?

6. “Does our business continuity manager know what changed in the business today?”

You will be surprised – many continuity manager are sitting in one corner of the office with no knowledge of what changed in the business today. They will restore business of yesterday or may more be few months back when they knew what changed. So bring him in the fold of any major strategy decision where you consider that he/she should incorporate the new changes.

Hope this helped!