- 18 Hot IT Certifications for 2014
- CIOs Opting for IT Contractors Over Hiring Full-Time Staff
- 12 Best Free iOS 7 Holiday Shopping Apps
- For CMOs Big Data Can Lead to Big Profits
Page 4 of 5
In his view, that is one glaring distinction between BC and its sister discipline, risk management, which mitigates risk based on the cost of the solution in light of the probable damage. Risk management weighs those choices, while business continuity says, "We know it's remote, but we need to plan for the worst-case scenario."
"ROI is a trap," says Goulet. "Everyone struggles to find something to say to the finance people, but that's a trap. Business continuity is part of the cost of doing business. We won't throw millions at this if we don't have to, but if we have to, we will."
But BC is not about unlimited spending on an unlikely outcome. It is about spending whatever is necessary--and only what is necessary--to allow the company to survive after an adverse event. "If you want a cheap solution, don't do anything," Goulet says.
Ignoring ROI can be a hard pill to swallow for management, especially if they're rooted in the risk management world, where everything is probability- and return-based. If you are stuck with this mind-set, Avery advises that you use modeling to quantify the value of the function. "Companies get stuck because they go through a process, and they have all these solutions at all these price points and they can't justify the investment," she says.
"If you take the value-based approach and embed some analytics, you can model the exposure versus the return on risk investment. Then you can justify the expense to your CEO." First, though, do your best to convince management that BC is a cost of doing business.
Lesson 7: Build in some flexibility.
While it makes sense to standardize BC plans as much as possible, it's just as important to allow for some flexibility for local distinctions, according to John South, CSO for Heartland Payment Systems.
"We look at business continuity as a distributed function, with responsibilities shared by regional operations managers," he says. Heartland issues a standard format for business continuity that it expects all its assorted business units to adopt when developing their business continuity plans, but it knows that those units also need the flexibility to define their plans within the parameters of their local operation, South explains.
To give one example, when a local operation owns its own facilities, it might be facing a different set of BC concerns than a unit that leases its building, even though they're part of the same company.
Lesson 8: Show clients your plans.
CSOs must realize that business continuity is expanding beyond the four walls of the enterprise. Increasingly, clients and supply chain partners want to know about your business continuity plans.
This makes sense, as a company is only as strong as the weakest link in its supply chain. Exchanging BC plans is becoming part of doing business and can make a competitive difference.
Becker and Poliakoff, a law firm, has over a dozen offices in Florida and several more in other states, plus one in Europe. Ari Solomon, director of IT, finds that clients can help with BC planning by delineating their priorities. "They want to know how they will get in touch with the attorneys if there is an outage," he says. In a disaster, "they really don't care so much about getting documents out, as long as they can communicate with their attorney."