The initiation of BCM: how to obtain management buy-in

A Business Continuity Management System (BCMS) can cover a wide scope and range of activities.

This could be anything from a document management tool utilised for Business Continuity (BC) Plans, a mass notification system, or software designed for BC Management.

Given their experience and education in the industry, Risk and Resilience professionals understand that there is a need to implement a BCMS to best equip the organisation in the event of a business disruption.

Of course, as Business Continuity Software providers we are huge advocates of organisations utilising software to manage a BCMS, as there are so many advantages.

From the automation of functionality to the speed in which plans can be refined, there are numerous increases in efficiency and effectiveness provided by BC software.

However, like many other activities which cost time, resource and most importantly money, implementing a BCMS of any kind is something which top level management are likely to try to resist.

So, what is the best way to go about obtaining buy-in for such a system?

Let's look at the most convincing arguments Business Continuity professionals can go into the boardroom with, for the biggest chance of success.

A proposal for a BCMS should be structured in much the same way as any commercial proposal should be.

Managers will generally ask the same questions whenever any kind of pitch is brought to them, whether for office equipment, additional staffing or a system like a BCMS why is this needed (what problem will it solve?), what is the investment required (what do you need to make this happen?) and in what way will this benefit the company (what is the ROI?).

Of course, preparation is key here the better prepared you can approach the management team with the responses to these inevitable questions, the more likely you are to get them on your side.

To best prepare for the first question why we need a BCMS firstly, know your stuff!

Facts and figures that highlight things like the likelihood of a company experiencing a business disruption, and their chances of survival and recovery following such an incident, can really hit home to the audience.

A key additional factor to include in your argument is the ever-increasing risks that businesses are exposed to.

Global warming leading to more incidences of extreme weather disruption, improvements within technology bringing with them more ways in which a business can be disrupted from a technical perspective, and the continually increasing number of cyber-attacks on businesses globally create more risks of incidents. It is also worth considering, and being able to respond to, the common business drivers from those on the management team, such as:

Protecting revenues
Retaining market share
Protecting company reputation
Ensuring positive customer experiences
Satisfying stakeholders
Legal, regulatory and compliance requirements
Product and service delivery
Brand protection
Competitive advantage

One block you might come up against is the common cry of We have a disaster recovery/risk management/crisis management (delete as appropriate) plan already, we have this covered!'

Being able to counteract this is important management may need a little education on exactly how Business Continuity Planning (BCP) differs from recovering IT systems in case of a technology disruption.

Our blog Risk Management, Business Continuity and Disaster Recovery' might help you with explaining in layman's terms to those who aren't BC professionals, the difference between each concept and how each in turn are individually of great importance to any business.

Additionally, carrying out BC activities like a Business Impact Analysis (BIA) - including an examination of the financial risks the business is susceptible to - in advance of the pitch will support you in justifying the cost required in implementing a system.

This leads us to the next questions your managers will most certainly ask (if they haven't already) the first of which being What is it going to cost?'

This is one that is easy to answer, if you have carried out thorough research and preparation.

You should approach a minimum of 3 suppliers when looking to implement an external Business Continuity Management system, and clearly discuss the costs which will be involved with each supplier. You should then be able to go into the meeting with the exact details on each suppliers' offerings, and a clear idea on who you think the best supplier would be and why.

Another common question is Who will run it'? and/or What training will be needed'?

Work to understand what requirements from a resource and training perspective will be required for the kind of system you are looking to implement to be able to adequately respond to this query.

In the case of the business continuity software from C2, the software automates so many of the key functions and processes, far less human resource is needed for time-consuming, manual work, which is news to your managers ears!

Similarly, with regard to training some simple training is required (and provided) for those who will be users of the systems only other employees and stakeholders simply require a level of awareness of the tool.

Lastly, however, arguably the most important aspect to prepare for and be able to respond to, is the Return on Investment.

The clearer and more defined this can be, the better it will settle in the minds of the management board and be accepted.

Define this by assigning a potential financial value associated with a business disruption. This can be a difficult task!

There are several complex factors involved such as the type of incident, the magnitude and duration of the disruption, location of the event, and much more.

Work to consider the operational costs across all departments which would be affected, the impact on revenue, and the price incurred by loss of equipment and infrastructure.

A good way to structure the ROI would be to outline the financial impacts during a disruption and recovery period should there not be a Business Continuity Management System in place, the improvements in subsequent recovery time when a BCMS does exist, and the difference between the two.

Your finishing argument should then reiterate your key points exactly why a BCMS is needed and what returns the organisation will experience from having such a system in place in the event of a disruption.

We hope this will be a useful tool to use when creating and executing a proposal to senior team!

Here at C2 we have one main priority to make our customers jobs easier.

We do this by providing software and support solutions to allow for efficient and effective operational resilience. Talk to us today to find out what we can do to support your role within Business Continuity, and your organisation as a whole!