Business Continuity Planning: Do Your Homework

I have been following several threads on various professional discussion boards and am quickly realizing a fundamental mistake that I think a lot of business continuity and disaster recovery planners are making.

Lots of these practitioners are listing, for me and others, all the questions we should be asking of a company’s management and leadership teams to help define recovery objectives, critical processes and the such.  Whereas, I think the business continuity and disaster recovery planner absolutely need to have this information to do their job right, I do not think we should be wasting senior management’s time in asking them to provide this information for us.  I think this adds to our planning problem; we get in meetings with very busy senior management personnel and ask them to provide us with information that we should know or, at the very least, have other avenues for ascertaining.

Me personally, I do not want to sit in front of Sr. Management and ASK them:

  • Where do your revenues come from?
  • What are your most critical processes?
  • What would happen if these business centers were shut down?
  • Lots more … just check out the discussion boards.

No.  When I finally get an audience with Sr. Management, I want to TELL them:

  • As you know, we get 80% of our revenue from …
  • Our most critical processes are…
  • If the business center in _________ were shut down for 1 day, we would loose …
  • Etc.

This information is out there.  It is in Annual Reports.  It is in SEC Filings.  It can be gathered from others throughout the organization.

When I get in front of Sr. Management, I want a succinct statement of facts, problems and potential solutions.  I do not want a list of questions for them.

There are many threads on these discussion boards asking how do I get management’s attention or participation or approval …  I think, really, if we look in the mirror, we are our own worst enemy in this regard.  We try to get buy in to a process, a theory or an ambiguously stated concern.

Do your homework.  Don’t go to Sr. Management asking to approve a process or methodology for finding risks and analyzing requirements.  Do not ask management what they are concerned about.  Go to them with real issues, supported by hard facts.  Tell them what they should be concerned about and why, in terms that they understand and issues that would concern them as business men and women not you as a business continuity planner.  Have potential solutions ready to discuss.

It is an age old business adage: “Don’t come to me with problems, come to me with solutions.”  Business continuity planners, we are worse – we come to them with questions.

Bad tactic in my book.  But then, maybe that’s just me.

Thank you for your input.