A Matter of Time: When SMEs Are Prevented from Helping With BCM
When it comes to business continuity management, many otherwise rational organizations behave in an irrational way. They make a commitment to improve their BCM program then sharply limit the amount of time the BCM team can talk to the departmental subject matter experts, effectively dooming the effort to failure.
Receiving Serious Pushback
Something that’s been an issue with my clients for many years—but which seems to be getting worse lately—is a problem that could be described as “a matter of time.”
When MHA is brought in to conduct an engagement, we often get pushback from the executive team when we indicate how much time we will need from various employees at the company in order for us to perform the task they’ve hired us to do.
It’s not just outside consultants who face this problem; it also hampers the work of in-house BCM teams.
Almost every BCM-related project requires significant collaboration and input from employees outside the BCM team. This includes subject matter experts (SMEs) at various departments or company executives. But getting the company to make those people available for a sufficient period of time can be like pulling teeth.
Asking a BCM consultant or team to make an organization more resilient, while denying them meaningful access to the relevant SMEs and executives, is like asking a mechanic to fix a car they are never allowed to see. Yet this happens all the time at organizations of all types and sizes.
Why Companies Resist the Time Needed from SMEs
By this time, I am familiar with the reasons organizations are reluctant to direct their SMEs and executives to make time for the BCM team. They see it as unnecessary. They’re against taking people away from their jobs. They often see doing BCM as a matter of checking a box rather than achieving a result. Sometimes they hide behind a supposedly positive statement. For example, “Our people are so good they can do it in half the usual amount of time.” At other times they will frankly state, “We need our employees to make money, not spend time on business continuity.”
I think such organizations are being pennywise and pound foolish. However, this case can be a hard one to make to self-confident business executives who have minimal knowledge of business continuity. Many have the default position that they know best.
Are you an executive with decision power over how much time the senior managers and SMEs at your organization spend talking to the BCM team? If so, I hope you’ll keep reading to learn why it’s in the best interests of your company to give the BCM staff sufficient access to your leadership and SMEs.
The Need for Solid Information
A BCM program is a bespoke garment. It has to be tailor-made to the company or it is worthless. You can’t make a tailored suit for someone if they do not allow you to take their measurements. You can’t make an effective BCM plan for an organization if they do not allow you to obtain the critical information by interviewing knowledgeable staff members.
A BCM recovery plan that is full of generic instructions is of no use. It will not help you recover anything.
Some things have to be custom made to work. A hotel cannot order a generic evacuation map off of Amazon and post it inside the door of each hotel room. The map has to be an accurate representation of the hotel to be of use to people who need to get out quickly during a fire. The same is true of a company’s BCM program.
The BCM staff needs input from the executives and departmental SMEs in order to know what the critical processes at the company are and how they can be recovered. They cannot obtain this information through telepathy. Instead, they need to talk to the people who know: the SMEs and the leadership. They need to talk with and work with them for a sufficient amount of time to gain solid answers to several key questions.
Without this input, the program and plan will be junk. They aren’t worth spending money on and won’t protect the organization. Anyone who thinks a plan that is full of generic content will protect their organization is kidding themselves.
The same goes for plans that are never validated through exercises. This often happens because the senior leadership won’t make themselves available to participate, or they give you such limited time it’s a waste of everybody’s time. You play like you practice. If you never practice, odds are that you play poorly at best.
The Critical Role Played BY SME’s
Let’s get specific. When I or members of my team seek time with departmental SMEs or senior managers, it is not because we want to have a meet and greet. It is not because we want to pad our timesheets. It is because, we take things as far as we can on our own. We reached the point where we need information that only company staff can provide.
In a typical engagement, there are four different phases where we will seek input from the SME. Here they are, along with the amount of time the SME typically needs to spend to help us complete each one. We’ve also included an explanation of why their input is important (inexperienced BCM practitioners would likely need more time).
1. Business Impact Analysis (BIA) Prework Phase. Time needed from SME: 45 minutes. The SME is asked to click on a link and fill out forms providing information about the critical business processes their department performs, the systems they need, the parties they depend on, and their regulatory requirements. Why it’s important: It helps us begin to understand which business processes at the company are the most critical and in need of protection. It also saves time in the next phase.
2. Departmental and SME Impact Analysis Interview. Time needed from SMEs: 1.5-2 hours. We conduct a structured, efficient interview to validate the information provided in the pre-work. We also discuss, for each business process performed by the department, what the impact on the company would be if it couldn’t be performed. This phase is important because it helps us further refine our emerging ranking of which processes are the most critical companywide.
3. Data Validation Phase. Time needed from SMEs: 20 minutes. We send the SMEs the results of the interview and ask them to double-check it. Why it’s important: Helps guard against mistakes and omissions. Ensures that the BC plan, when it is developed, will actually protect all of the most important business processes.
4. Recovery Plan Development Phase. Time needed from SMEs: 4-6 hours over a period of 45-60 days. For business processes judged critical, the SMEs have to explain how they could be recovered if they went down. Why this phase is important: These plans are the heart of the BCM program. The content for them can only be provided by the departmental SMEs. The consultant can help shape their information into the optimal, checklist form. But the SMEs are the only people in the world who can provide the content that forms the substance of the plan.
BCM exercises are a separate matter, but the underlying concept is the same. At MHA, we strive to be as efficient as possible and minimize the demands on employees’ time. But for the exercises to work, company staff and leadership have to participate. When and if there’s an outage, MHA staff will not be the ones who are on the scene striving to recover the company. The company’s staff and executives will have that responsibility. The only way to ensure they can meet it is for them to practice ahead of time.
Making Time to Succeed
Successful BCM initiatives are often a matter of time: the BCM professionals doing the work need sufficient time with the departmental SMEs and company leaders to obtain solid, detailed, accurate information. BCM plans devised without significant participation from SMEs are usually padded with generic information. This makes them effectively worthless.
Are you a company leader with authority over how much your employees and colleagues cooperate with the BCM team or consultants? Do everyone involved a favor: Task your SMEs and execs with participating fully with the BCM professionals. This is the only way for the BCM pros to get quality information. Information they need to arrive at a valid understanding of which business processes at the company are the most critical. Information that helps them devise thorough, functional, actionable plans for their recovery.
Further Reading
For more information on time needed from SMEs, BCM plan development, and other hot topics in BCM and IT/disaster recovery, check out these recent posts from BCMMETRICS and MHA Consulting:
- The Secret to a Successful BIA Interview: Get Their Information Ahead of Time
- Streamlining the BIA: 5 Tips for Making the Most of the BIA Interview
- The Human Side of Conducting BIAs
- A Sample Threat and Risk Assessment: The Case of Acme Widget Corp.
- Stack Attack: A Brief Guide to the IT Stack for BC Professionals
- How to Manage Management: 8 Tips to Help You Bring Your Bosses on Board
Michael Herrera
Michael Herrera is the Chief Executive Officer (CEO) of MHA. In his role, Michael provides global leadership to the entire set of industry practices and horizontal capabilities within MHA. Under his leadership, MHA has become a leading provider of Business Continuity and Disaster Recovery services to organizations on a global level. He is also the founder of BCMMETRICS, a leading cloud based tool designed to assess business continuity compliance and residual risk. Michael is a well-known and sought after speaker on Business Continuity issues at local and national contingency planner chapter meetings and conferences. Prior to founding MHA, he was a Regional VP for Bank of America, where he was responsible for Business Continuity across the southwest region.
