The ROI of Business Continuity Management: Allocating Costs Correctly

BCM: Profits but not a Priority

A common complaint is, "We don't have time and money for BCM because there are already so many other actions in progress." Words like "reliability," "solidity," and "continuity" often appear in mission statements. These are typical words related to BCM but don't always lead to prioritizing it. Yet the benefits are significant. Demonstrable BCM efforts create a reliable reputation in the market and build goodwill with existing and potential customers. Coordinating BCM plans with suppliers makes the supply chain more robust and flexible at the same time. Furthermore, more insurers are willing to lower premiums if an organization proves that it is actively working on its continuity and is deemed capable of responding effectively in crisis situations. However, what BCM brings to an organization remains somewhat unclear.

The theme of BCAW personally resonates with me. Let's precisely determine the benefits of BCM. A good business case and ROI calculation ensure transparency in decision-making. My personal view is that BCM includes areas that don't belong there. This makes the scope of BCM too broad, resulting in disproportionate investments. So, I'd like to raise two issues.

IT Continuity Isn't Business Continuity

BCM is business continuity. The question "How fast will our applications work again?" is fundamentally different from "How quickly can we be there for our customers again?" Nevertheless, in 2016, continuity is inseparable from IT continuity. Human intervention is sometimes entirely absent. I personally consider technical continuity measures as basic requirements in the IT domain. Redundancy, backup, recovery, a second data center – does anyone find these things exotic anymore? They are prerequisites for the continuity of business processes. However, they do not provide the organization with the necessary resilience in the broadest sense. Is it worth investing in them? Certainly. But I prefer not to call it BCM.

Management is a Prerequisite for BCM, Not Vice Versa

During a (potential) crisis, insufficient insight into the relationships between processes, applications, and infrastructures can lead to uncertainty. The impact analysis conducted by a crisis team becomes less effective, resulting in reduced agility. Gaining this insight is often entrusted to BCM implementations. This is not accurate. This knowledge is also needed in incident management and when making major changes. This makes it the responsibility of the management organization. Is it worth investing in it? Certainly, after a good risk assessment. Organizations need to decide how far they want to go in documenting and keeping dependencies up to date, and then allocate this responsibility to the department where it belongs. However, it is a prerequisite for BCM, not a result.

The Actual BCM Investments

BCM helps organizations implement emergency measures during a crisis and quickly return to normal business conditions. This requires policies, strategies, up-to-date continuity plans, and regular exercises and tests. This whole, embedded in a long-term management cycle, is the real investment in BCM. This investment directly contributes to the aforementioned benefits and demonstrably increases the organization's resilience.

BCM is worth investing in, and it shows professionalism to determine the relationship between costs and benefits as precisely as possible. It is essential to allocate costs to the right source from the beginning. This is critical for defining a clear ROI for BCM and the appreciation of the field as such.