Learning Strategies for Success

Page 211

Journal of Business Continuity & Emergency Planning Volume 13 Number 3

Journal of Business Continuity & Emergency Planning Vol. 13, No. 3, pp. 211–219 © Henry Stewart Publications, 1749–9216

Avalution Consulting LLC, 323 Lakeside Avenue, Suite #410, Cleveland, OH 31405, USA *Tel: +1 330 321 8650; E-mail: brian.zawada@ avalution.com **Tel: +1 254 226 0451; E-mail: morgan.perry@ avalution.com

Framing business continuity to achieve lasting focus Received (in revised form): 12th August, 2019

Brian Zawada* Co-founder and Chief Visionary Officer, Avalution Consulting

Morgan Perry** Managing Consultant, Avalution Consulting

Brian Zawada is the co-founder, Managing Director and Chief Visionary Officer for Avalution Consulting, the creator of the Business Continuity Operating System and Catalyst business continuity software. Brian has more than 20 years of experience man- aging and building world-class business continuity programmes. He is a Fellow of the Business Continuity Institute and was awarded the Business Continuity Institute’s Global Personality of the Year in 2016.

Morgan Perry is a managing consultant at Avalution Consulting. Morgan contributed to the development of Avalution’s Business Continuity Operating System and has built and managed world-class business continuity programmes for organisations in a variety of industries and all sizes. Prior to Avalution, Morgan served in the US Army, specialising in operational leadership and contingency planning. He is an Associate Member of the Business Continuity Institute and was awarded the Business Continuity Institute’s Global Continuity and Resilience Newcomer of the Year in 2018.

AbstrAct Business continuity programmes frequently suffer from two core problems. First, many programmes fail to focus on what is criti- cally important to the organisation and its stakeholders. Secondly, many programmes fail

to engage programme participants to achieve preparedness goals. Both problems impact the programme’s strategic direction, scope and performance. The frame process described here provides a detailed method for busi- ness continuity practitioners to engage with top management and other key stakeholders to determine and then address what is most important to the organisation. This process was developed to address the lack of programme focus regardless of industry or organisation size and has been used to build high-performing programmes and improve focus for mature pro- grammes. Beginning with answering the four questions described in this paper, programme management is equipped to effectively establish programme objectives and priorities, inform stakeholders of key business continuity con- cepts, and allow for issues resolution prior to the implementation of key programme activi- ties. Lasting programme focus requires clearly defined and articulated priorities and direction. This paper provides a detailed summary of the process that can be used by programme management to ensure that business continuity programmes are implemented and maintained in alignment with the strategic direction of the organisation.

Keywords: business continuity man- agement, strategy connected business continuity, resilience, programme engagement, programme focus

Brian Zawada

Morgan Perry

Framing business continuity to achieve lasting focus

Page 212

INTRODUCTION Organisations are increasingly investing in efforts to improve their ability to protect and recover their ability to deliver their most critical products and services within timeframes deemed acceptable by key stakeholders. While the increased emphasis on business continuity has resulted in a variety of methodologies and approaches to implementing business continuity pro- grammes, many organisations struggle to frame their programme properly during its initial development to ensure a lasting focus on what the organisation considers most important.

Framing an organisation’s business con- tinuity programme effectively allows top management — defined as ‘the person or group of people who directs and con- trols an organisation at the highest levels’1 — to determine the requirements, pri- orities, areas of focus and participation necessary to evaluate the programme’s per- formance effectively and drive continual improvement. Often, organisations initiate business continuity planning efforts with a single purpose — to document plans to recover critical functions. While this is an important outcome of an effective busi- ness continuity programme, it lacks several of the key factors needed to establish a programme with lasting focus that pro- vides ongoing value to the organisation. By framing the business continuity pro- gramme around the answers to the four key questions that will be discussed below, organisations can design the programme appropriately and determine iterative activities to achieve the right level of resil- ience. Understanding that organisations have finite resources to allocate to business continuity reinforces the need to establish an appropriate programme design prior to performing common business continuity programme activities (business impact analysis, risk assessments, plan develop- ment and exercising).

While there are different approaches to measure the effectiveness of a busi- ness continuity programme, the present paper focuses on how well programmes are designed to:

‘protect an organisation’s key prod- ucts and services and the processes and resources that support the delivery of those products and services. Key products and services are those that leadership has deemed to be critical to both the organisation’s short-term goals and long-term success’.2

While organisational strategies and key products and services may change over time, the most effective means of meas- uring the value that the programme provides to the organisation and ensure the ongoing involvement and support of top management is via the perspective and priorities of organisational leadership, informed and structured by business con- tinuity subject matter expertise.

This paper explores the common prob- lems that the frame process seeks to solve, and details steps to achieve focus and engagement — thus delivering value in an optimised manner. The paper also pre- sents a method to plan for, conduct and follow through on a frame meeting with key business continuity programme stake- holders to address the following four key questions:

• Why are we investing in business continuity?

• What are we trying to protect? • How much business continuity do we

need? • Who should participate in the pro-

gramme and in what capacity?

Lastly, the paper lists how the outcomes of the frame process and the frame meeting support ongoing programme management

Zawada and Perry

Page 213

with the objective of driving increased performance.

The concepts discussed within this paper apply not only to organisations seeking to implement a business con- tinuity management programme, but also to those organisations looking to reinvigorate a planning effort that is expe- riencing diminished energy and relevance. Programme managers responsible for mature business continuity programmes can implement these concepts to increase engagement with key stakeholders, vali- date the programme scope, and develop or enhance performance indicators and metrics to assess the programme’s ongoing value to the organisation while main- taining or realigning the programme with the organisation’s priorities as they change.

WHAT PROBLEMS DOES THE FRAME PROCESS SOLVE? The frame process solves a wide variety of issues that can plague business continuity programmes. The four common problems detailed below can manifest in various ways but tend result from programmes that lack two key characteristics: focus and engagement. For the purpose of this paper, programme focus is defined as the align- ment of the organisation’s leadership team and business continuity programme man- agement regarding programme purpose, priorities and scope. Effective focus is demonstrated when the programme’s management team and key senior leaders have discussed, documented, validated and remain aligned on these programme attributes. Engagement is defined as the strategy to ensure the right individuals and groups participate in the right programme activities, at the right frequency, and that these participants are focused on solving the appropriate issues and determining effective actions based on their roles. The

business continuity engagement plan — described below — is a key outcome, developed following the conclusion of the frame process, that summarises and ensures effective participation from, and support to, the larger organisation.

Problem 1: Lack of clarity on business continuity definition and objectives A common approach to beginning the business continuity planning process is initiating a business impact analysis and risk assessment. However, performing a business impact analysis without first determining and gaining alignment on the purpose of the programme can lead to confusion regarding what business con- tinuity is (and is not) and misalignment regarding the specific objectives of the programme. Even when defined as part of programme governance documentation (such as a programme policy and standard operating procedures), these objectives and definitions are often created in a vacuum without meaningful involvement from organisational leadership, which leads to unintended assumptions or confusion on key aspects of the programme’s design. In many cases, various members of a steering committee or governing body will have vastly different views for both the definition of business continuity and the programme’s objective, which have significant impacts on the programme’s ability to protect what leadership deems most important to the business.

Problem 2: Undefined drivers and expectations of business continuity For an effort to have buy-in, a proper scope and, ultimately, deliver value, the organis ation must first understand and agree on the key drivers. Drivers for busi- ness continuity vary between organisations and often change over time. External drivers can include contractual require- ments regarding the timely delivery of

Framing business continuity to achieve lasting focus

Page 214

products and services or meeting regula- tory requirements specifically related to business continuity. Internal drivers can include a directive from management, an identified threat to the organisation that remains an exposure, or an opportu- nity for market differentiation. Business continuity planning is often driven by a combination of internal and external factors that may vary in importance. Determining the three to five drivers for business continuity planning, as well as the priority of each, allows management to endorse a clear list of expectations for the programme.

The lack of defined programme drivers makes it incredibly difficult for manage- ment to contextualise expectations for the programme — what the tangible outcomes of business continuity plan- ning are and the degree to which the programme delivers on those expecta- tions. Connected with the programme’s objectives described above, alignment on expectations is a key factor in determining what the programme should prioritise, how the programme should be struc- tured, and the means of measuring and communicating programme performance. Clarity regarding programme drivers also allows business continuity to integrate effectively with the organisation’s other efforts to increase resilience and mitigate risk.

Problem 3: Unspecified risk tolerance Risk and downtime tolerance (also known as risk appetite) are often overlooked when designing business continuity programmes and selecting appropriate business conti- nuity strategies. Risk tolerance can broadly be defined by three main components:

• Agreed downtime tolerances for in- scope products and services;

• The nature, likelihood and history of specific threats and how they have or

can be expected to impact on the delivery of in-scope products and ser- vices; and

• Major vulnerabilities within the organ- isation that can lead to significant impacts to the business or result in extended downtime due to the time and resources require to recover (one example of a business continuity-related vulnerability is single points of failure that are difficult to recover).

Some organisations are risk-averse — it is their culture that influences how they are willing to architect their organisation for resilience; they often have a low tolerance for unmitigated risks, or they strive to close recovery capability gaps. Risk-averse organisations often have a lower threshold for downtime specific to the activities that contribute to in-scope products and services. Conversely, organisations with a higher tolerance for downtime may have a very different programme design and focus for their programme. Risk tolerances, like programme drivers, exist on a spectrum and may vary over time, but a lack of clarity regarding risk tolerance and how it influences business continuity planning is a significant hindrance to effective man- agement and the prioritisation of business continuity risk.

Problem 4: Uncertainty regarding programme participation Many organisations struggle with deter- mining who to involve in the programme and in what capacity. This is most preva- lent when the organisation takes an ad hoc approach to identifying or assigning pro- gramme participation, which often results in ineffective engagement or engagement with the wrong stakeholders. A common symptom of such an approach is the ina- bility to connect tactical work supporting the business continuity programme with longer-term strategic goals.

Zawada and Perry

Page 215

THE FRAME PROCESS The specific problems the frame process seeks to address are directly connected to the four questions listed in the introduc- tion of this paper. This section will discuss the frame process and key outcomes that support programme design and achieving long-term focus and engagement.

Overview and preparation The intent of the frame process is to gather the organisation’s leadership together and seek alignment on the four key questions critical to business continuity programme design and implementation success:

• Why are we investing in business continuity?

• What are we trying to protect? • How much business continuity do we

need? • Who should participate in the pro-

gramme and in what capacity?

Alignment at the highest level of the organisation ensures that the programme is driven using a top-down prioritisa- tion method and incorporates proactive resilience requirements determined or informed by senior leadership. In addition to providing leadership with a clear under- standing of what the programme can and will provide to meet their expectations, the outcomes of the frame meeting ensure that the business continuity programme addresses what the organisation deems most important and value-adding.

The frame meeting requires involve- ment from leaders representing each in-scope product or service, often on the executive leadership team, many of whom may assume a role on the business continuity steering committee. To prepare for the meeting, the business continuity programme manager should review a list of the organisation’s products and ser- vices and consider the justification for

including each in the programme (essen- tially developing a tentative scope based on assumptions made regarding drivers and expectations).

This paper has highlighted issues that lead to poor focus or engagement. To overcome these issues, it is important to emphasise that the frame meeting is a single meeting with all participants present. While approximately 60–90 minutes of executive leadership’s time may be a sig- nificant request within some organisations, it is necessary to properly define and remove confusion around programme characteristics that directly impact the pro- gramme’s ability to deliver tangible value. It is important to coordinate with the programme sponsor prior to the frame meeting to gather the information neces- sary to facilitate the discussion efficiently and effectively. Topics to address with the programme sponsor that can help focus the discussion include:

• Known business continuity programme drivers;

• The organisation’s recent history with disruptive incidents;

• Current-state response and recovery capabilities;

• Preliminary answers to the four frame questions; and

• Optimal frame meeting participants.

The more information that can be gath- ered prior to the frame meeting, the better, as such preparation allows the meeting facilitator to address perceived areas of sig- nificant misalignment or identify aspects of the programme’s design that have histori- cally hindered performance.

Facilitating the frame meeting The frame meeting should be led by the person responsible for business con- tinuity — guiding executive leadership through each of the four questions noted

Framing business continuity to achieve lasting focus

Page 216

above. The order of the four questions intentionally facilitates the discussion from the programme’s ‘why’, through the ‘what’ and ‘how’, before concluding with the ‘who’. This order allows the individual responsible for business continuity and the meeting participants to leverage the out- comes of each discussion as an input into the subsequent questions.

Effective frame meeting facilitators encourage healthy conflict where there is disagreement on the responses to the four questions. The facilitator should focus on the areas of contention and help guide the discussion towards a decision. The facilitator can utilise the additional sup- porting questions outlined below to gain specificity, capture examples for later use, and ensure all participants understand the implications of their decisions.

• Why are we investing in business continuity? • What is driving us to implement/

improve our business continuity programme?

• Are we a risk-taking or risk-averse organisation?

• What expectations must we align on regardless of circumstance (regula- tions, customer SLAs, etc)?

• What are we trying to protect? • What are our organisational strategy,

objectives and culture that influence scoping?

• What are our core values? • What are the key products/services

we provide to our customers? • How do we value these products/

services (eg revenue-based, brand image, health/safety)?

• How do you see the organisation in three to five years? What impact does that have on the programme currently, in terms of scope and objectives?

• What do we want the business conti- nuity programme to achieve?

• ‘How much’ business continuity do we need? • What are the downtime tolerances for

the products/services we identified? • What level of impact on the cus-

tomer and our employees are we willing to accept/tolerate following the onset of a disruption?

• What are some potential threats that could lead to disruption and is there a history of disruption?

• Do we have single points of failure or are there resources that would be dif- ficult to recover and, therefore, lead to prolonged downtime?

• Who should participate in the programme and in what capacity? • Confirm the programme sponsor: The

person engaging executive leadership and accountable for business conti- nuity programme performance (this individual is typically on the execu- tive leadership team).

• Confirm the programme manager: The person responsible for managing the programme on a day-to-day basis. This individual will report directly to the programme sponsor and function as the liaison between the business and steering committee

• Confirm the steering committee partici- pation: Represents the interests of the organisation, specifically in-scope products/services and supporting processes. This group will provide strategic oversight and support for the programme, review performance metrics and assist with prioritising corrective actions.

• Confirm process or department leads: The people providing data during the build phase and participating in the evolve phase. Individuals in this group will be tasked with partici- pating in the planning process and driving continual improvement.

• Are there any other key programme par- ticipants within the organisation?: What

Zawada and Perry

Page 217

other groups/teams should be noti- fied of programme progress and engaged through the evolve phase?

The facilitator should document the results of the discussion and review the answers to each of the four questions to seek endorse- ment by the frame meeting participants. It is critical that each attendee leaves the meeting with a clear understanding of why the organisation is investing its time and resources in business continuity, what the purpose and scope of the programme are, and who will be asked to participate in the programme moving forward. If con- sensus is not reached, a follow-up meeting should be scheduled to address areas of disagreement.

Following the frame meeting Once senior leadership is in agreement on the answers to each of the four ques- tions, the programme manager can move forward with developing or improving the programme design. The outcomes of the frame meeting set parameters and establish priorities for every aspect of the business continuity programme. Immediately following the frame meeting, the following documents should be developed or updated, and then shared with programme participants and other stakeholders:

• Business continuity policy: Captures management expectations of the pro- gramme and its participants, including the purpose, objectives and scope of the business continuity programme;

• Business continuity standard operating pro- cedures: Provides guidance and internal standards for how to implement and sustain the programme, as well as how to perform business continuity planning;

• Business continuity steering committee charter: Establishes the steering com- mittee and includes a description of

roles, responsibilities, and how the organisation will manage engagement over time; and

• The engagement plan: Ensures effective communication and coordination with all interested parties to achieve business continuity programme outcomes

Ensuring that the answers to the four questions listed above are used in designing the programme allows business continuity activities to align with the strategic goals and priorities of the organisation. As such, programme managers are then able to ini- tiate a much more focused business impact analysis and risk assessment after identi- fying and prioritising in-scope products and services, as well as associated down- time tolerances for each. Organisations that do not focus their business continuity programme at a strategic level before ini- tiating the business impact analysis will struggle to answer the more tactical ques- tions regarding what processes, activities and resource dependencies should be con- sidered in-scope, as well as inappropriate recovery time objectives.

Having addressed the four questions listed above initially with the organisation’s leadership also provides programme man- agers with a benchmark from which to define changes. These questions should be reviewed at a recurring internal meeting with key stakeholders to ensure that pro- gramme continues to prioritise current organisational strategies, concerns, risk tol- erances and direction over time, resulting in a response and recovery capability con- sistent with management expectations.

THE OUTCOMES OF THE FRAME PROCESS The frame process solves many of the root cause issues getting in the way of business continuity programme performance — a focus on what the organisation deems most

Framing business continuity to achieve lasting focus

Page 218

important and more energy and engagement across the organisation.

With a documented set of parameters to guide the business continuity plan- ning effort, programme management is better positioned to make decisions regarding business continuity priorities and implement change that better aligns the programme to organisational strategy. Increased focus can be quantified by the ability of executive leadership to maintain a unified, strategic intent for all business continuity efforts that allow programme participants to perform within a clear set of guidance. Increased clarity also allows programme management to better develop key performance indicators that are aligned with what leadership has deemed most important and how the organisation defines business continuity success.

In addition to providing valuable infor- mation to confirm or refine the scope of the programme based on the organi- sation’s most important products and services, those responsible for business continuity can also develop more mean- ingful analytics and programme scorecards to understand the degree to which the programme is effectively supporting the continued delivery or recovery of products and services. Through the business impact analysis and risk assessment that follows the frame process, programme manage- ment is able to document the relationships between resources and the products and services they ultimately support. With pri- orities in the form of products and services identified by senior leadership, programme management can document, report on and determine necessary actions based on the resilience or recoverability of individual products and services.

The programme’s plan to engage with key stakeholders, developed and approved based on the discussion of who should participate in the programme, allows programme management to engage

appropriately throughout the organisa- tion strategically — as opposed to the more common ad hoc approach. Aligning who and how the programme manager engages with the business reduces costly redundancies in the communication and coordination process and establishes a col- laborative framework within which to perform business continuity programme activities.

CONCLUSION Many organisations struggle to establish or maintain the programme’s focus on what matters most to organisational leader- ship in a way that translates to actionable business continuity strategies and desired, predetermined outcomes. The frame process is a structured approach for those responsible for business continuity to solicit, confirm and update critical inputs to business continuity programme design. The frame process ensures that programme managers have the right information nec- essary to continue to address and protect the organisation’s priorities, continue or recover its most important products and services, and maintain engagement with leaders and decision-makers throughout the organisation. The outcomes from the frame process also establish a foundational approach to business continuity planning that can change with the organisation over time, as participation, strategy and objec- tives change. Gaining alignment among executive leadership on the answers to the four key questions discussed herein, business continuity managers are well posi- tioned to develop, implement, engage and evaluate the performance of their business continuity programme.

references (1) International Organization for

Standardization (2012) ‘ISO 22301:2012 — Business Continuity Management

Zawada and Perry

Page 219

Systems — Requirements’, International Organization for Standardization, Geneva.

(2) Verdi, J. (2017) ‘Strategy connected business continuity: what is it, and

why is it important?’, available at: https://avalution.com/ strategy-connected-business-continuity- what-is-it-and-why-is-it-important/ (accessed 28th July, 2019).

Copyright of Journal of Business Continuity & Emergency Planning is the property of Henry Stewart Publications LLP and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.