NOTE: The content of this perspective was initially presented September 13, 2011 at DRJ Fall World in a presentation titled, “Connecting with Management and Staying Relevant.” During the presentation, attendees were asked to complete a Self-Assessment Survey answering various questions regarding management involvement within their organizations’ business continuity programs. Avalution used the information gathered during that session in order to frame this perspective and offer feedback based on the recommendations presented at DRJ.
Management involvement and support is vital to the growth and ongoing success of an organization’s business continuity program. Management buy-in ensures alignment with the organization’s overall strategic direction and business objectives, and allows the program to obtain appropriate resources and visibility. Without adequate management involvement and support, a business continuity program risks losing effectiveness and alignment with business strategy, misspent or unfit resources, imbalance between capability and requirements, or in the worst case, management cutting business continuity all together because they do not see the value in the investment.
IN THE MIND OF AN EXECUTIVE
As you think about optimizing your interaction with management, Avalution recommends taking a step back and understanding the key characteristics found in nearly all executives and, more importantly, the attributes that make individual executives different.
Most executives share a number of traits, namely:
- Time Constrained – It is critical that the time you occupy is not deemed wasteful.
- Business Oriented – Since executives think nearly exclusively in a business objective-oriented, customer-focused manner, it is pivotal that you present business continuity requirements and results in those terms to ensure preparedness objectives align with overall business strategy.
- Demand Simplification – Strive for measurable results that translate into demonstrated capability rather than documentation of an effort or a simple analysis.
See Figure 1 below for more detail.
While executives tend to have common traits, they also tend to differ in at least three key areas, as described below:
Once you have an understanding of the executive personalities at play in your organization, you can tailor the following methods to efficiently and successfully engage with your executives:
Respect Their Time
Regardless of management’s individual style, it is important to ensure time spent with management is focused and action driven. To do so, utilize an agenda with predetermined topics and an established timeframe to drive meetings. When possible, offer meeting attendees materials in advance (preferably with an executive summary). Expecting an executive to read a fifty page deliverable is unreasonable and impractical. Provide the detail within short handouts, if needed, and prepare specific questions or actions for management. Lastly, when presenting information, be clear and concise – paying close attention to the executives, and realizing when they have heard enough (through their non-verbal cues).
Present from 30,000 Feet
When presenting a topic, begin with a strategic, big picture approach that frames the discussion based on business strategy and its objectives. In order for this tactic to be effective, it is important to present subject matter with high level language that is easily understood by executives, typically relating all conclusions and recommendations to products, services and customers. As you progress through the information, work your way from the top down into recommendations and/or findings. To conclude, confirm with executives that your recommendations align with long-term business strategies. This will not only ensure your work, but also that the importance of business continuity resonates with management.
Balance Details and Big Picture
Depending on the personality type of the executive you are engaging with, try to balance the big picture with the details of the topic in correct proportion. For instance, when providing material in advance of a meeting (as recommended above), keep in mind if the individual (or group as a whole) is “Detail-Oriented” or “High Level.” The “Detail-Oriented” executive will require a business-oriented big picture along with depth of detail prior to and during meetings. However, the “High Level” executive will typically only look for the big picture and enough detail to support the overall findings/recommendations. In the end, the ultimate goal is to present your results to management in a manner best suited to the individual, so the executive can be certain the efforts within the business continuity program align with and support overall business objectives.
TOOLS AND TECHNIQUES FOR ENGAGEMENT WITH EXECUTIVES
This section uses specific data points gathered from respondent’s survey answers.
The first step toward truly connecting with management is actively involving them within the business continuity program by establishing a group of “top management” that oversees the objectives and overall direction of the program. Most organizations experience optimal success with their program’s “top management” when program ownership shifts from an individual to a group of people (referred to as a “steering committee” throughout this perspective) that will work to align the business continuity objectives to the organization’s strategic objectives.
57% of respondents indicated that their business continuity programs had a steering committee; however, only 36% of respondents have C-Level involvement in their business continuity steering committee.
When a business continuity program employs a steering committee comprised of top management that can influence the organization’s actions as a whole, the business continuity team will be in a position to prioritize continuous improvement actions and count on management to support the implementation effort.
In order to ensure the business continuity program’s focus is aligned to the overall strategic direction of the organization, establish business continuity objectives that allow program initiatives to align with organization-wide strategic goals. In addition, business continuity objectives should serve as the framework for the business continuity policy. The policy should be approved by top management, and should include (or reference) the program’s objectives.
61% of respondent’s organizations obtain management input when defining program objectives.
25% of respondent’s organizations either do not have a business continuity policy, or have a business continuity policy without program objectives.
Creating a management-approved business continuity policy that outlines clear program objectives is a critical success factor in molding the business continuity effort. Simply put, it establishes and reinforces management expectations. Formally setting and documenting objectives for the business continuity program that align with organization-wide strategic objectives ensures the execution of preparedness activities in a prioritized manner based on management’s direction.
To ensure the appropriate areas of the business are covered within the business continuity effort, work with management to define a scope statement that outlines the breadth of the program and aligns to objectives. Further, when defining a scope statement, remember how management views the organization – in terms of what the organization delivers to its customers (not necessarily the organizational chart, locations or applications). This scoping approach will ensure that the program and its outcomes align to management’s business orientation.
60% of respondents indicated management contribution when defining program scope. The most common factor present in defining scope is “Business Units” with 54% of respondents listing it as one of or the only factor driving scope.
Management contribution to the identification of the organization’s key business continuity priorities ensure time and resources are focused on critical business activities that are relevant to the organization-wide objectives and its most important products and services.
Business Impact Analysis (BIA), Risk Assessment and Strategy Identification
For areas included in scope of the business continuity effort, perform a BIA and risk assessment to identify critical activities and key risks within the organization. From this information, identify where recovery capabilities and risk mitigation controls differ from business requirements, and develop risk treatment options and gap closure recommendations. When developing strategies, perform a cost-benefit analysis to determine initial and long-term costs associated with closing capability gaps. Ensure that management is involved in the review and approval of analytic results and strategy option recommendations to ensure consistent alignment with business objectives.
20% of respondents indicated their steering committee reviews and approves BIA results, while 27% of respondents obtain review and approval of risk assessment results and remediation from a business continuity steering committee.
This pivotal point in the business continuity lifecycle dictates the continuity strategies that align to business need. Executing a BIA, risk assessment, and strategy identification and assessment process ensures valuable resources are invested in the strategies deemed by management to be most appropriate and most cost-effective for the organization.
Management Review / “CAPA”
In order for an organization’s business continuity program to align to management’s organization-wide goals and objectives, “top management” must continuously monitor, analyze, and contribute to maintaining and improving the business continuity program through an iterative review and approval process. The outcome of the management review process is prioritizing corrective actions and preventative actions (CAPA) that close the gap between capability and expectations (known as non-conformities).
82% of respondents perform post-incident reviews with 32% seeking steering committee approval of results and action items.
66% of respondents indicated their organizations implement a formal tracking system for improvement opportunities.
Management review of the business continuity program ensures its continuing suitability, adequacy and effectiveness over the long term. Without a formal continuous input process that engages top management, the program risks straying from business objectives and losing strategic alignment.
For business continuity professionals to become and remain engaged with management, it is important to understand management personalities, including the key commonalities and differences. Once you attain that understanding, use it to your advantage! Tailor your approach for meetings and content delivery appropriately in order to maximize interaction effectiveness. Finally, utilize the proven tools and techniques displayed above to win management’s support and recurring involvement, thus creating a program that aligns with the organization’s most strategic and important objectives.
Robert Giffin, Director of Technology & Brian Zawada, Director of Consulting
Avalution Consulting: Business Continuity Consulting