One of the biggest challenges that someone charged with overseeing a Business Continuity Program has is to prove that the program is worth its cost: “What is your program’s ROI?” I call that the “dreaded question.” I wanted to develop a webinar and white paper on this topic because I am going to propose another way to frame this question. What if continuity planners talked about value on investment versus return on investment?
The “Dreaded Question” of Return-On-Investment (ROI)
So here’s how the questions are often framed:
- “What’s the return on investment (ROI) of your continuity planning efforts?
- “How much will you save the company?”
- “How much will you make for the company?”
- “What does this do to the company’s bottom line?”
Answering these questions can get really tricky. You might reply with something along the lines of, “Based on our BIA (business impact analysis), we know that our plans will protect us from any significant downtime. That downtime is projected to cost us <<fill in the blank>> dollars per second that we are down.” The executives around the table raise their collective eyebrows and one of them goes in for the kill and asks, “When did that happen last and how much did it cost us?”
Gulp. More than likely, you lose that round.
The traditional definition of “ROI” means – very literally – “return on investment.” That means that you need to prove that the company received the same amount of money back – or more – as it invested in your program. You can always point to your BIA, point to your planning efforts, correlate the two – and pray for the best. If a serious outage occurred, it’s a pretty easy argument. However, if you’re like most BC/DR professionals, you likely have had no disasters or plan activations, or – worse yet – the situations you faced were easy.
You will never win this one with that kind of response.
But what if you stopped and thought about things differently? What if you changed the entire conversation? In other words, is there another, perhaps more meaningful, way to show value? The questions I’d like to ponder here are:
- What is the value-add of business continuity?
- Is that value-add only good in a disaster?
- Is there a way to show value to the organization on a daily basis?
Here’s Another Option: Value on Investment (VOI)
Is it possible to tie dollars invested to desired – and realistic – company outcomes such as:
- Increased resiliency?
- Competitive advantage?
- Effective staff training?
- More thoughtful business processes?
Overwhelmingly, the answer is ‘yes,’ and to do that, we now need to discuss value and Value on Investment (VOI).
Value on investment was first defined by the Gartner Group, which described it as the intangible assets that contribute heavily to an organization’s performance. The keyword there is intangible. These intangible assets include knowledge, processes, organizational structure and ability to collaborate – which is what BC/DR does! So VOI is the measure of the intangible benefits of a project or an activity. And just by the very nature of things, VOI will include some aspects of ROI – but that’s not where you want to end up. You will want to talk about value.
Shifting to a VOI approach instead of an ROI approach provides the necessary forward-thinking framework for scoping, prioritizing and initiating continuity projects. For example, in response to the executive’s question, what if you said this instead: “We use the concept of VOI because we are working to measure the idea of creating company resilience, of tying planning outcomes to increased employee skills and of creating value through collaborative planning and learning at every level of the organization.” Wow, that sounds great!
VOI helps measure the total value of “soft,” or intangible, benefits derived from continuity initiatives, in addition to those “hard” benefits measured by ROI. VOI is, of course, subjective and would be difficult to measure with the same precision as ROI. Yet a VOI approach is critical to allow funding for continuity planning efforts that provide the competitive differentiation necessary for the success of the efforts.
And, by the way, BC/DR professionals aren’t the only ones who struggle with this. When you research the topic of VOI versus ROI, you will find many groups working through the same questions, including organizations and programs such as higher education, not-for-profits, professional associations, think tanks and technology initiatives. You are not alone!
Start by Changing the Conversation
The first step begins with changing the conversation – move it away from ROI to VOI. There are many ways to do that; one of my favorite ways is to spend some deep and quality time discussing three basic questions:
- “What is the company <<fill in the blank>> (business continuity, disaster recovery, etc.) program doing now that provides value to the company?”
- “What should the <<fill in the blank>> (business continuity, disaster recovery, etc.) program begin doing that would provide additional value to the company?”
- “What [am I/are we] doing to provide value to the company?”
How do you, as an individual or group, begin to get your arms around these questions? One way to start is to have what we call a “whiteboard activity.” The whole purpose is to expand and deepen your thinking about what the program is doing now and/or could do, and identify what everyone is doing to contribute to the success of the program’s mission.
Here are some ways to set up a great brainstorming environment to capture ideas. These will help make that whiteboard activity really pop!
- Establish goals for the session.
- Set a timeline for the session.
- Give everyone on your team a homework assignment: Bring to the session at least ten ways that the program provides value. They can be silly ones, great ones, boring ones – bring any and all of them!
- Create the environment for success. Be prepared at the start of the meeting with sketchpads, sticky notes, colored markers or a large amount of whiteboard space for everyone involved.
- Write down and/or sketch out every idea. Every idea, good or bad, should be presented.
- Don’t judge. Embrace the ridiculous! At the end of the day, it might be the best idea in the room.
- Start with general topics and then move toward the specific.
- Look for synergy among the ideas. There is often potential for creating synergy among originally separate suggestions.
- Don’t fall in love with your ideas. Shop them around and see how they hold up.
Viola! You are making progress!
Eight Ideas on VOI
To jump start your thinking, here are eight different ways that your program might provide VOI. Don’t pull these out until your team has finished doing your own brainstorming first!
- Regulatory compliance.
- Competitive advantage.
- Brand and reputation protection.
- Risk identification.
- Operational improvement.
- Knowledge capture.
- Increased robustness.
- Deeper knowledge.
Idea #1: Regulatory or Contractual Compliance
An obvious value-add is one that is required by your profession, such as the FFIEC guidelines for the banking industry. That’s an easy one. However, you may not be in an industry or profession that is subject to requirements from external regulators. If that’s the case, you might think to yourself that this idea doesn’t apply.
Hold on, though – let’s think about this more deeply. Regulatory compliance might not be a requirement for your company but it could be a requirement for one of your big customers. For example, take the FFIEC Appendix J requirement, “Strengthening the Resilience of Outsourced Technology Services.” This requires that third-party vendors meet certain requirements for planning and testing. Are you one of those third-party vendors that need to meet certain requirements? Or there could be a contractual requirement from a customer in order for them to do business with you. Your excellent program meets their requirements, and therefore your company can do business with them.
Idea #2: Competitive Advantage
It might go without saying, but most organizations and companies prefer to do business with those businesses which have a higher ability to deliver products and services on time. “Delivering products and services on time” includes when a disaster has happened at your facility. Your customers may “feel for you,” but they still want their widget and/or service on time. “Aw, poor company, sorry about the flood; where’s my part?”
In addition, having a comprehensive and tested Business Continuity program (one that includes IT recovery, business continuity and supply-chain resiliency planning) assures customers of your ability to deliver on the mutually-agreed-upon SLAs and thereby demonstrates value to them.
And lastly, your competitors may not have a program, or as robust a program as yours, and you can highlight that in sales presentations and contract pitches.
Idea #3: Brand and Reputation Protection
Think about it: Having comprehensive Business Continuity and Crisis Management programs helps protect your organization from the negative publicity that could result from a disruption to your operations. It’s a great thing for your business to be known for reliability in spite of a serious outage.
And if – or more likely, when – the “Bad Thing” happens, your communications and executive teams will have a great story of resilience to tell, instead of an “Oops!” story.
Idea #4: Risk Identification
While performing hazard risk and business impact analyses across all physical locations and within each process or function, threats and vulnerabilities will always be discovered. This critical risk identification, then, allows the organization to mitigate the risk where possible and prepare for the risk by developing plans and conducting exercises and training to improve performance.
Every time you discover a risk, you have the opportunity to make operational changes or physical enhancements that will reduce or eliminate the possibility of some or most of the organizational risks. This saves money at the time of a disaster, but may also contribute to insurance savings on an annual basis.
Idea #5: Operational Improvement
When you perform risk assessments and develop continuity plans to recover from those risks, you may discover that the greatest value of a comprehensive Business Continuity planning process is awareness. This is awareness that is gained from examining the details of one’s own business process, not just how to plan for a disruption.
The planning process can create increased awareness that results in opportunities to make operational improvements, often in areas that had not previously been explored. These improvements can result in more efficiencies and increased productivity. During a recent exercise, I was surprised when the team failed a particular mission-critical business process with a 60-minute RTO and the client said it wasn’t a big deal. I replied, “how could missing an Recovery Time Objective (RTO) of 60 minutes not be a big deal?” The clients then sheepishly said that they had stopped doing that particular process at the end of the previous year and had never updated the Business Impact Analysis. So, they had many plans and expensive technology requirements in place to meet an RTO that was no longer needed; money that could now be released for other things, resulting in a big cost savings.
Idea #6: Knowledge Capture
How effective are your training materials? Do they cover everything that someone would need to know to perform that function? What is the condition of your Standard Operating Procedures (SOPs)? A tremendous amount of critical day-to-day business information is often scattered among spreadsheets, original documents or in the heads of a few subject matter experts. What happens when the SME is on vacation or – yikes – if they retire? This is increasingly an issue in many companies as baby boomers leave the workforce, often taking a headful of knowledge with them.
Business Continuity planning is a perfect avenue to collect and organize that information for future use (including process improvements), and to prevent the information from being lost forever. It is a great way to build a training program or to enhance the skills of more junior staff.
Idea #7: Increased Robustness
The Business Continuity planning process can strengthen the organization, not just by preparing for major disruptions, but also by giving employees the skills and knowledge to react more effectively to mitigate smaller everyday problems as they arise – and before they can become major disruptions.
Everyone knows what it’s like when the most senior person with everything in their head goes on vacation. People scramble frantically to make sure they know what to do if something goes wrong. Just think of the amount of increased resiliency you could create by transferring information through plans, documents, training and exercises. Everyone’s knowledge will increase, along with the company’s ability to recover.
Idea #8: Deeper Knowledge
This last idea came up recently when we completed an engagement with a client, who shared this story with us: We had completed a major cyber exercise with them the year before. One of the initiatives from that exercise was to develop manual work-arounds for critical business processes whenever possible. Originally, the staff said that many things could not be done manually at all – but something interesting happened when they really started to peel apart the work. They discovered that there were, indeed, work-arounds for some of the most critical activities. To be sure, those work-arounds weren’t easy and they were time consuming, but they could be done. The person who shared the story with us said the manual process had given the team a much deeper knowledge about the system than they had ever had before, and a much greater understanding of how it all worked together. That kind of learning is invaluable.
Even in routine planning, when engaged in the planning process, we have had clients say that they actually learned even more about their current processes and how to do them more effectively and efficiently. And even for a veteran employee, this process can lead to a deeper knowledge, which can help the day-to-day work.
So this brings us to the question of communicating the value that you are creating in your program, plans and exercises. You need to start thinking of business continuity as a product that needs to be marketed strategically within your organization. Really.
We divide these marketing efforts into two categories: overt and covert. Overt marketing efforts are just as the word describes: they’re done or shown in the open and are plainly or readily apparent to everyone. For example, you could encourage employee home preparedness during the month of September, which happens to be “National Preparedness Month.” To build resiliency, you need employees to show up at time of disaster, and they will only show up if their families and homes are OK. One way to make that more possible is to encourage home preparedness, thus your National Preparedness Month activities feed into a win-win for your program and the company.
Covert marketing, on the other hand, is not openly acknowledged or displayed. There are ways you can share information and knowledge, thus informing others, but can also demonstrate the value you provide. For example, if your manager is keenly interested in cyberattacks and cyber preparation, it would be very appropriate (and help build your program’s value) if you kept him or her informed of key attacks or responses by other similar companies or competitors. Keep them in the loop on things that they might not likely see themselves, which can reinforce the value you bring to the organization. And when appropriate, do analysis of contemporary events and share that with key individuals.
And whenever key events occur, find ways to bring the information to the right people in your organization:
- Write after-action reports for real activations or exercises. Be sure to outline the ways that the continuity process helped, the key lessons learned and next steps
- Refer back to your internal marketing plan. Whether you had a real activation or held a great exercise, tell your story by internal communications vehicles, such as company articles, whitepapers and/or presentations.
Where Do You Go From Here?
Now that you are, perhaps, thinking about things a bit differently, you have work to do:
- Get your team together to “whiteboard” the value question.
- Have your elevator speech ready.
- Be ready to share the top five (at least) values on investment that your continuity program provides to your company.
- Start spreading the word.
- Start today!