Agile Business Continuity

Imagine a dashboard that tracks your progress in business continuity management. What would it look like? If you look at some of the suggested approaches they tend to cluster around proving the existence of the BCM process. As discussed in previous posts, although these indicate the maturity of the process it does not attempt to measure the quality of outputs. Although I do not discount the need for a maturity model in respect to the BCM practice, a far more valuable approach would be to focus on the relative impact the process is having on the business. Without this it is rather like measuring the quality of your sales process based on the quality of your sales collateral without measuring the number of deals that have been closed.

Firstly let us step into the wonderful world of Key Performance Indicators. In brief, Key Performance Indicators (KPI) are a technique for boiling down a company’s operations to a small number of business metrics used to inform management about the state and progress of the business and the execution of its business plans. These types of metric have been criticised for not being accurate enough to make key decisions on. I don’t disagree with this point, but think the argument falls short of understanding the utility of these metrics. If you look at a key metric like return on investment this provides a useful target and tracking number for understanding the position of the organisation. But this number is purely an indicator of progress and is not a definitive measure. If the metric is trending in the wrong direction, it provides management with an indicator of an emerging issue that needs to be addressed and can then be looked into in detail. This top level summary view provides the executive with an excellent tool with which to identify and organise their own focus. Even something as simple and understandable as “return on investment” is only really an indicator that can be used to understand the position of an organisation. If you’ve ever spent time reading company accounts you will know that behind these simple figures are a substantial amount of supporting evidence and remarks.

Beyond the simple statements of whether BCM is in place or not, do metrics exist that can support the organisation’s view in terms of its own resilience. Indeed, is there an argument for resilience metrics to be part of the Operational Balance Scorecard perspective. If so then what would these look like?

There are a number of more complex metrics associated with business resilience that have been developed out of academic risk management research. Although potentially more accurate, there is a question over how easy it is to gather the information and maintain it going forward. Once the final measure is defined, how easy is it then to decompose and understand the fundamental reasons for any change. This is key to the utility of the measure.

So which ever metrics we choose to track an organisation’s resilience, I would suggest, they need to have the following properties:

1. They should be simple to understand
2. They should be straight forward to measure
3. They should reflect a change in the resilience of the business
4. They can be decomposed to multiple levels in order to understand the components of the business in more detail
5. They should demonstrate the efficacy of the governance process

As I described yesterday, the resilience of an organisation is really a measure of it’s elasticity and it’s ability to flex under pressure. Business Continuity Management is the method by which we create, maintain and manage the organisation’s capability to do this. So we are in search of measures of “resilience” which can be decomposed and associated with different parts of the organisation in order for us to understand the contribution which each makes, and how they are changing over time.

Tomorrow, I will discuss how risk contributes to the notion of resilience.
Actually, I decided to write about the notion of predictability and will return to risk contribution to resilience in a future post