It is a question that Business Continuity and Disaster Recovery Planners have had to deal with ever since this field came into being: “What can I do to get management fully engaged in the planning process?”
There is a current discussion going on in a Linked-In Business Continuity Group on this topic. There are your typical, age-old answers, of highlighting the awareness of the need for this kind of planning; identifying the managers’ greatest recovery concerns; being better skilled at selling the benefits of planning. There are even some more creative answers with highlighting the risks involved of not planning and the such.
These are all very good answers – might work, might not – and the struggle continues.
I do not profess to have THE answer to this question. And, I know that what I propose is not easy to achieve – but, it seems to me the best way to motivate people to pay attention is to hit them in the wallet. By this I mean, try to get their ability to plan incorporated in their performance appraisals that help determine their bonus, next raise or promotion. At the end of the day, individuals are going to concentrate their time and attention on those tasks that will influence their performance appraisal and bonus or pay increases. In most organizations, the only employees being graded on how well business continuity planning is completed are the business continuity planners. Sounds responsible – but, doesn’t help promote the need to plan. Our leadership teams can give all the lip service they want to the need to plan and participate on tests, but unless they back it up with penalizing those who don’t participate, you are still going to have problems getting participation. Currently, there are few penalties for not planning other than having the BCP folks whine at and pester you.
Every department management team should be held responsible for the development of their plans. The BCP planner is really an internal consultant available to help them achieve this, but the responsibility should lie with the management team. Have their success in planning, documenting and testing their business continuity strategies included in their performance appraisal and I bet they start paying more attention to their plans.
One variation of this is in organizations that include Audit Results in the performance appraisal process. Get your Auditors to include review of business continuity plans in each department audit. If exceptions are noted, and these exceptions impact the performance appraisal or bonus program, they will be addressed.
Again, I am not saying it will be easy to change the corporate culture to get business continuity planning included in the performance appraisal or regular audit process, but, I feel pretty confident that if by not giving attention to the planning effort, these managers feel they are leaving some bonus money on the table, they will start paying attention. And, do we really care whether or not they buy into the “need” to plan as long as they plan? Maybe – but, hey, results are results.