The saying goes that if you can’t measure it then you can’t manage it. From a business continuity planner’s point of view, one might also argue that if you can’t measure it then you probably can’t get a budget for it.
BS25999 and other standards (including the often-loathed American National Standard for Organisational Resilience) require ‘metrics’ or measurements are used to show how business continuity is contributing to an organisation. Unhelpfully, none of those standards suggest how business continuity, or preparedness, can be measured.
It makes sense to keep records of business continuity planning efforts. For example, a simple list of plans showing the date each one last had it’s Business Impact Analysis (BIA) update, plan update and was rehearsed in an exercise is an extremely useful document – see example below.
|Name of Plan||Plan Holder||BIA Last Updated||Plan Last Updated||Plan Last Rehearsed|
|Finance Department Business Continuity Plan||Bob Smith||03/01/13||05/02/13||09/02/13|
|Payroll Business Continuity Plan||Angela Jones||01/01/13||02/02/13||10/04/13|
But we’d have to argue with those who think that this ‘measures’ business continuity. It might indicate effort and work undertaken to ensure preparedness, but it doesn’t help us to understand how prepared the effort makes the organisation. It doesn’t help us work out things like:
- Does the BIA correctly interpret the organisation’s priorities?
- Are the strategies employed the most suitable/viable to achieve the aims?
- Are the plans any good – will they actually protect the company in times of trouble?
- Was the rehearsal useful – did it test the right things and was learning identified and acted upon?
- How much the business continuity program is worth to the business?
Thankfully, Rand is on the case. For those not familiar with Rand, it’s an organisation that exists to provide research and analysis to aid decision making. It’s research is second to none, and its reports are written in a style that make them very easy for anyone to use. It’s a not-for-profit organisation that works globally for governments, foundations and private sector firms, but many of their reports are provided free of charge at www.rand.org – at last count more than 10,000 were available online. And they’ve come up trumps for us to, by making a start to help us with metrics for emergency preparedness.
Rand suggest that we look at using what they call ‘reliability measures’. In other words, evaluate how likely it is that each element of the plan will achieve it’s aim, in order to work out how reliable the planning might be overall. They use a practical example to explain the theory; they illustrate a plan to evacuate the general public from a city. However, it’s easy to see how the process could be useful for any plan.
It’s not the whole answer, of course, and it’s not the perfect solution for everyone, but if you’re looking for a way to explain to management how likely it is that a plan will work, you could do worse than check out this report.
- Download Rand report: “The Problem of Measuring Emergency Preparedness: The Need for Assessing “Response Reliability as Part of Homeland Security Planning”
Do you have any ideas on metrics for business continuity and emergency preparedness? Do share them using the comments section below, or consider submitting an article.
Subscribe - weekly news and a free course!