Until a crisis event occurs, it can be difficult to truly engage the wider business in business continuity planning, but the input of other functions is invaluable. An iterative improvement process involving impact analysis will push organisational resilience to the next level.
The role of the second line is to “dispassionately evaluate the preparedness of the continuity planning process,” said one of our members at a recent member meeting as part of our organisational resilience series.
This requires other functions to take ownership of the issues at hand, however, which can be easier said than done. The difficulty typically lies in not allowing continuity planning to be siloed within the disaster recovery programme.
Building long-term business resilience is one of the top risk priorities of many of the risk leaders in our network.
Effective business impact analysis (BIA) sets the right foundations for effective business continuity plans (BCPs) which ultimately empower management to access the support and information they require, both to deliver on their business continuity objectives and to train others on its importance. It’s these blueprints that set the business up to be resilient in the face of a crisis.
Here are five tips we’ve gathered from the conversations members are having around tried-and-tested methods for improving wider business engagement in continuity planning:
1. Keep it simple
Devising a widely applicable plan is both easier and more useful to the business in the long-term - address the impact of losing a major asset, for example, rather than focusing on the cause of the event.
A more generic response plan might ask users some simple questions, for example, to get them to identify key decision-makers, as well as the people responsible for escalating any issues and performing the BIA.
2. Find a “gateway” topic
Some of our members have found that specific issues spark employee interest in continuity planning better than others. Cyber security is a common example - it is in the news a lot, and a cyber-attack could have far-reaching implications for most businesses. By using such a topic to introduce the idea of continuity planning and BIA first, risk managers can then create a template to address other areas in the future. (Read our latest blog on three steps for better cyber risk management across an organisation.)
3. Set up meetings
While some organisations address continuity planning and BIA via surveys or questionnaires, getting all the relevant people in one room - or virtual meeting - can be a more effective way to gain attention, explain the issues and get valuable input from key stakeholders.
Some organisations even go as far as holding multiple meetings for specific functions or even one-on-one interviews with the main stakeholders in the continuity planning process – a proven method for better grabbing and holding their attention.
4. Speak early - and often
Talk to the key business stakeholders at the beginning of the planning process and continue to check in with them throughout. These regular conversations should focus minds on continuity and include a summary of the relevant BIA.
5. Think about reporting tools
If the aim of this process is to show the business the benefits of continuity planning, developing impactful reporting tools can help hammer home the message.
For example, one of our members has been working on a dashboard for BCP assessments. The idea is to show business leaders the enterprise-wide impact of losing a specific site or team in a clear and simple way. This should hopefully encourage them to make business continuity decisions based on the analysis provided by the tool.
Members can access our better practice guidance on how to improve organisational resilience on our Intelligence platform, along with lots of other valuable content on business continuity planning and impact analysis from a risk management perspective.
Through collaborative discussions and benchmarking forums available to them, members have been sharing the successful ways they’ve garnered greater engagement from the business on crisis and emerging risk preparedness, plus how they’ve pushed their business impact analysis to the next level.
Keen to find out more? Click here for more on Risk Leadership Network membership.
