CHAPTER 9: BCM CULTURE

As with any set of activities in an organisation, if BCM is seen as someone else’s responsibility and is not a part of every-day life, then it is not likely to be understood; nor will it work well when needed.

A key difference between BS25999 and ISO22301 is that the previous Standard required organisations: ‘to ensure that BCM becomes a part of its core values and effective management …’. In other words, everybody in the organisation must have some awareness of what BCM is, what it is for, how it works, and what it means for them.

This is really a sound philosophy, and whilst ISO22301 doesn’t expressly state the same requirement, by requiring awareness, it should result in the same overall levels of capability.

People in organisations often remain ignorant of activities that they are not directly involved in, and they certainly make assumptions about what would happen if there was an incident. More often than not, these assumptions are wide off the mark, and, should they ever be put to the test, the majority of people agree that it would have been much better had everyone been involved in developing the BCM arrangements.

Making business continuity effective

Again, in BS25999’s case, there was also a requirement to evaluate levels of awareness within the organisation; again a logical requirement, because it is obviously too late to start improving awareness when an incident has occurred. Now, in ISO22301’s case, it is left to the organisation to decide whether awareness levels should be included as a measurable within the performance evaluation arrangements (see Chapter 8).

The process must start at the top. Of course, in most organisations some support and approval at governing body or board level is required, in order to commit resources to a BCM programme; but senior executives leading every part of the organisation must be in a position to both support and disseminate the philosophy, policy and strategies surrounding BCM and, in particular, its value to the organisation.

At the same time, most people absorb information more effectively if they are interested in it, rather than being forced to pay attention. So the way that the BCM philosophy is disseminated should be based upon its value to the organisation; it should be seen as something good, something to be welcomed.

Raising awareness

Again, this will usually start at the top. In order to have approved the programme in the first place, the governing body must have a reasonable understanding of BCM and its benefits to the organisation. Directors and senior executives will be involved in propagating some of this understanding throughout the organisation, and some will have BCM response roles, requiring more detailed knowledge.

It is generally effective to create a fairly standard awareness programme that will provide a good understanding of BCM and its value to the organisation. This can then be augmented by more in-depth education and training for those involved in the development, implementation and use of the BCMS.

Awareness techniques

Most people working in organisations today probably perceive that they are suffering from ‘information overload’. They feel that they are constantly being bombarded with e-mails, and other forms of information, which they simply do not have the time to deal with.

Documents about business continuity certainly have their place, but the internal ‘Business Continuity Newsletter’ may not be the most popular read in the canteen, or on the train home.

A two-page (A4) corporate briefing about BCM is probably optimal in terms of people’s willingness to actually read and digest its content. This will, in any event, usually result in a significant level of improvement in most people’s understanding of the subject, and, in particular, of what it means for their organisation.

Seminars are a reasonably, popular technique and may well prove to be effective in some settings. A classic pitfall with this approach is that many people feel that, to justify having a seminar, it should last for at least half a day. This will not work, at least in the majority of cases. The bulk of relevant information about BCM can be delivered to groups of people in about an hour and a half, with the option of further sessions if the question and answer session at the end is particularly active.

Another quite effective technique is a simple slideshow using PowerPoint^®, or a similar application. The ‘story’ about BCM can be put across in a show of about a dozen slides, which will take most people something like five minutes to watch.

Some organisations use short video presentations to raise awareness. These often prove more engaging for many, and a lot of relevant information can be conveyed in a very, short space of time.

ISO22301 arrived at about the same time as the emergence of viable corporate e-learning systems. It is not unusual for new starters to be required to complete some compulsory training, and equally, e-learning systems being implemented for existing staff can include modules on a variety of core subjects, of which BCM will ideally be one.

Ownership

Even the most experienced business continuity practitioner is unlikely to know the very, best way for a particular activity to be recovered in the event of an interruption. If the owner of an activity makes a positive contribution to the plans for recovery, using their knowledge and experience, not only will the plan be a better one, but that owner is much more likely to both understand and support it.

Of course, people being people, some engage in the BCM programme willingly, and others have to be dragged in, kicking and screaming. It may, therefore, be a good idea to consider integrating BCM responsibilities into the organisation’s performance management system or processes. This may include references in job descriptions, with BCM tasks and activities being a regular item for review in whatever performance appraisal system is in place.

It should also be recognised that it takes time, in most organisations, for a new discipline to be understood and accepted. The standard does not require ownership as such, but the evidence that BCM has become embedded in the organisation’s culture is much more likely to be convincing if it can be achieved.

Competitive advantage

In many organisations, particularly commercial ones, competitive advantage is likely to be a driver – one of the reasons for embarking upon a BCM programme in the first place.

But competitive advantage can also become a tool in getting the BCM discipline embedded in the culture, simply because it can become part of the organisation’s selling proposition; something of which the organisation’s people can be proud.

A number of organisations have seen this work to good effect when implementing other management systems with visible benchmark standards, such as ISO9000, ISO27001 and ISO14001.

An important message in the internal awareness building and education programme is that achievement of certification under ISO22301 will be an important component in the organisation’s competitive edge.