Out of the Loop: When the BCM Office is the Last to Know

Here is an irony for you: at many organizations, the business continuity office is often the last to know when something happens that threatens to disrupt the business. The cause of this problem has to do with issues of turf and trust, but there are ways of improving the situation. 

Related on BCMMETRICS: No Respect: The Occasionally Frustrating Truth About Life as a BCM Professional

What’s Wrong With This Picture? 

Recently, a business continuity management (BCM) practitioner we work with told me a story that would have been funny if it wasn’t so unfortunate. She said that not long ago her company’s headquarters had to be evacuated, and the way she found out about it was by looking across the street and seeing all the people coming out of the headquarters building. 

This is a competent professional working for the office in charge of making sure the company can keep its essential operations going in the event of a disruption. And when there’s a significant disruption, nobody calls her, nobody asks for her help, nobody even gives her a heads-up.  

What’s wrong with this picture? 

And it’s not just one person or organization. I’ve been hearing this a lot lately: BC offices are not being notified when events such as IT outages, building evacuations, and medical emergencies occur. 

At these organizations, the BCM office is simply not considered a critical point of contact when there’s an incident. They are not looked at as a resource that will ensure the organization is prepared to respond in a coordinated manner. Instead, they’re thought of as the office you call as a last resort, if ever. 

Let’s take a look at why this happens, why it’s a problem, and how the situation can be improved. 

The Costs of Sidelining the BCM Office 

There are two main reasons why it is not ideal for the BCM office to be out of the loop when the organization experiences a disruption. 

First, it is or at least should be a negative for the BCM office staff. If you as a BCM professional do a good job and take pride in your work, you should want to make a contribution to the well-being of your organization. This means being known and respected by management and your peers for your knowledge and skills. If you are not being notified when there is an event, this is not happening and it probably doesn’t feel good. 

Second, assuming that the BCM office does indeed have something to offer (we’ll look at this assumption more closely in a minute), then the organization can suffer by depriving itself of the BCM staff’s knowledge and skill. Incidents are more likely to get out of hand, impacts are likely to be greater, and outages are likely to be longer. All of these impose costs on the organization and its stakeholders. 

An Issue of Turf and Trust 

The fact is, at many companies the department heads would rather chew off their leg off than call the BC office. Why is this so? There are two reasons. The first has to do with turf. Departments are often loath to give the BC office an opening to come in and start telling them what to do.  

The second reason has to do with trust. Many departmental managers do not have faith in the BCM office. They don’t think the BC staff have anything to offer them in an emergency. Many think of the BCM office as the people who do BIAs and write business continuity plans, activities they consider irrelevant to the high-pressure problem of managing an event. In short, they don’t respect them. 

What the BCM Office Can Do to Gain Acceptance  

The potential solutions to this problem reside at two levels, that of the BCM office and of the organization overall.  

First we’ll look at what the BCM office can do. If your office has experienced the problem we are discussing, the first question you should ask yourself is: Are the department heads right to mistrust us? Are they correct in thinking we don’t have anything to offer? If this is the case, the first thing you need to look at is raising your game as a BCM office. 

If you suspect the problem has less to do with trust than turf, then you should ask yourself, are the department heads right to worry that we might charge in and try to take over? If so, then you might need to consider adjusting your approach. If you think of yourself as a hero whose job entitles you to ride in and take charge when there’s an emergency, you might do well to think again.  

Chances are you can do more good and find more acceptance as a service-oriented helper and teammate. If you embrace this philosophy, and communicate it to the department heads, you might find they are more willing to bring you into the loop. As I’ve said before, being a diplomat is not the least important skill required to be a good BCM practitioner. 

(For more on the soft skills needed to succeed as a BCM pro, have a look at “Eight Is Enough: The 8 Skills That Will Enable You to Thrive as a BCM Professional” and “Run It Like a Business: 7 Tips to Help Your BCM Program Succeed.”) 

Making Changes at the Company Level 

Now on to the company-wide dimension. There are concrete changes an organization can implement to ensure that the BCM office gets looped in when there’s a disruption. Most of these would have to be sponsored by somebody fairly high up in the organization. 

1. Identify and create a Security Operations Center. This is a single point of contact that can be reached 24×7 and serves as the central point of communication for all events that require a coordinated response.  

2. Develop a common enterprise severity level matrix. The matrix should define the enterprise severity levels, the type of events by severity level, and the actions to take based on the severity level reached. It should address all key areas: IT, Facilities, Security, Business, and Cyber. A common severity level matrix must be agreed to by all areas of the organization.  

3. Ensure that the BCM office is integrated into the enterprise severity level matrix for escalation and notification when an event mandates communication about the event. 

4. Provide training on the use of the enterprise severity level matrix, including what the central point of contact is and how to reach it.  

5. Establish a single Emergency Notification System that provides one common point for communication across all media (cell, email, home, etc.).  The ENS should also define the messaging protocols to be used during an event. (Often, different groups across the organization use disparate ENS tools and messaging protocols, creating barriers to the sharing of information.)   

6. Exercise the centralized event notification and escalation process on a regularly scheduled basis.   

Moving from Irony to Excellence 

It is ironic that the office in charge of ensuring the organization can weather a disruption is often kept out of the loop when a disruption occurs. However, this is good neither for the BCM office nor the organization overall.  

The problem can be tackled by a combination of making changes in the approach and attitude of the BCM office and by implementing organization-wide measures that formalize the process of event notification and escalation. 

In this way the problem we’ve been talking about can be transformed from an interesting irony into a relic of the past. 

Further Reading 

For more information on the role of being a BCM professional and other hot topics in BCM and IT/disaster recovery, check out these recent posts from BCMMETRICS and MHA Consulting: 

• No Respect: The Occasionally Frustrating Truth About Life as a BCM Professional 
• How to Build a Good Relationship Between the BCM Program and the IT Department 
• Eight Is Enough: The 8 Skills That Will Enable You to Thrive as a BCM Professional 
• Run It Like a Business: 7 Tips to Help Your BCM Program Succeed.” 
• “This Is an Emergency”: Why You Should Consider an Emergency Notification System 
• Practice Makes Perfect: How to Be Ready to Handle an Emergency