Archive for Management Reporting

The Business Continuity Planner’s Job

Although this concept may prove frustrating for the business continuity planning professional, I suggest that our primary job is not to make sure the enterprise can recover critical processes in a timely manner following a business interruption crisis, but, rather, our primary job is to identify the risks and threats that could cause a business interruption event, the resulting impacts to the organization should those threats be realized and the options (and costs) of addressing these threats.  Now, there may be a subtle difference in the two sides of that statement and, you may need to re-read that sentence a couple of times to fully understand what I am suggesting, but I often see business continuity planners get frustrated because they cannot appreciate the difference.

I believe, that our first job as business continuity planning professionals is to provide senior management with the data and information that allows them to make an informed and intelligent decision on what to do based on this information.  If, senior management, armed with this information, decides to accept the risks and potential impacts – and, signs off on that strategy – so be it.  Every organization has its own risk acceptance, or risk adverse, personality and may make polar opposite decisions faced with the same risk and impact profile.

The worst thing that can happen to a business continuity planning professional, proving we did not do our job, is if a situation occurs and senior management is justified in saying, “No one ever told me …

… that a disaster in our data center would take us out of business for months”, or

… that a fire in our call center in Anytown would take down all our customer service capability”, or

… that our primary distribution center was located in a flood plain”, or

…  

If we are in a position to say, “No, we told you, but you elected not to invest the funds necessary to mitigate the risk or position us to recover from it”, then, although we may still be the scapegoat, we can feel satisfied we did our job.

Now, once we inform management of the risks, potential impacts and various options for addressing the situations, our job then becomes to implement, document, test and exercise the strategies and solutions they have approved.  Hopefully, we can influence management to take the course we, as professionals, believe they should follow.  If not, then, rather than just complain that management doesn’t understand, we either need to gather more information to influence a different choice or, do our best to implement and document the strategies management elects to employ.

It can be frustrating working for an organization that is willing to accept risks and bet against the chance that a business interruption event will occur, but our job is primarily to make sure they are making these decisions based on all the facts and understanding of what their decisions could mean should a disaster occur.

Adjusted Recovery Confidence Factor ©

A couple of the groups that I am a member of in LinkedIn, (in particular the Association of Contingency Planners Group and the Disaster Recovery Journal Group) have an active discussion topic on what is the one most important reporting metric to share with your executive management team?

This got me to thinking – and when I think, trouble starts.  To me this is a challenge, not to pick the one most important metric, but to create a metric that allows me to share the most information concerning the program.  So, time to get creative.

So, what I would do, because I can be a jerk sometimes, is to provide a metric that makes them ask me to explain it.  And, what I came up with is…

The Adjusted Recovery Confidence Factor or ARCF.

Imagine if you went in the board room and simply announced, “Concerning our Enterprise Emergency Management Program, we have an Adjusted Recovery Confidence Factor of 54%.  Any questions?”

Oh, so you want to know what the ARCF is?  Well, let me explain.

The ARCF is our Recovery Confidence Factor multiplied by a Confidence Adjuster and a Documentation Adjuster.

The Recovery Confidence Factor (RCF) is the # of Critical Business Units (CBUs) that have executed Successful Recovery Tests (SRT) in the past 12 months / the total # of (CBUs).

A  SRT is a test in which the business units have achieved the pre-defined Recovery Time Objectives (RTO) as established in our Business Impact Analysis.  CBUs that do not have pre-defined RTOs, by definition, cannot have conducted a SRT.

The Confidence Adjuster (CA) is a value, as a percentage, that depicts our confidence that we have identified the right CBUs.  If the CBUs have been established as a result of conducting a thorough and complete BIA, the CA is 100%.  Otherwise, it is a subjective number based on the process we went through to define our CBUs.

The Documentation Adjuster (DA) is a value, as a percentage, that depicts the degree in which our recovery program is supported by fully documented recovery procedures that eliminate our dependency on our most expert and experienced resources to execute the recovery solutions.

So, for example, you might report:

We have 20 CBUs.

Although we did not conduct as thorough a BIA as best practices suggest, I am 90% confident that we have identified the right CBUs.

Of the 20 CBUs, although all of them have participated in tests, only 15 of them successfully demonstrated the ability to meet their RTOs.  The other 5 have some issues that must be resolved prior to the next test.

The documentation that supports our entire recovery process is, in my estimation, 80% complete.  There are some plans that require maintenance and some recovery procedures that are not fully documented.

So, our Recovery Confidence factor is 15 CBUs with SRTs / 20 CBUs or 75%.

And, our Adjusted Recovery Confidence Factor is our RCF of .75 multiplied by our Confidence Adjuster of .90 and our Documentation Adjuster of .80 (.75 X .90 X .80) for a final ARCF of 54%.

So there.  By reporting one metric, I was able to share a lot of information about our program.

Will this work in a real world situation?  Probably not – but I kind of like the ARCF©.  I think I will keep it.