3 Key Metrics for Business Continuity Program Success

In my 25+ years as a business continuity & crisis management expert, I often get asked one particular question that that makes me cringe:

“Are there metrics we should be tracking?”

In short and emphatically, YES!

What metrics should you be tracking?

It depends:

1. Do you really want to know whether your business continuity program is working; that your organization is resilient and actually prepared to respond to the next disruption?
2. Or do you just want to make sure all of the boxes are checked?

This is not a trick question.

We think that everyone should want their business continuity program and your business continuity plans to actually work!

But if you don’t quite grasp the difference between the two, you’re not alone.

I frequently encounter confusion around the fact that merely tracking business continuity program compliance—i.e., checking the boxes— isn’t the end game for business continuity success.

But it takes more than “Know the requirements-Do the things-Check the boxes” to gauge whether your business continuity program is effective and moving your organization towards its resiliency goals.

Employing the right combination of metrics—operational compliance, plan quality, and program maturity—are all equally important to understanding your organization’s true resilience.

Implementing a system that measures all three will give your organization the insights it needs to move your business continuity program to full maturity, sustainability, and success in responding to the next disruption.

Is your organization truly resilient, or are you just checking off the boxes?

Understanding Business Continuity Program Metrics

1.   Operational Compliance

As discussed above, operational metrics only tell part of the story. But they are still a foundational starting point for measuring the progress of your business continuity program.

At the very least you should be tracking progress at the business unit or plan level for:

• Business Impact Analysis (BIA) completion
• Business Continuity Plan completion (if just getting started) or updates (if already in place)
• Completion of business continuity exercises
• Whether after-action items identified in exercises have been addressed and improvements implemented

In short, your business continuity program manager should have a system to easily check and report on business unit progress towards basic business continuity program requirements.

For smaller organizations, a spreadsheet might be adequate for the job and could look something like this:

Large organizations with more complex operations may need a more robust solution.

2.   Quality Scoring

Tracking the progress of business continuity program activities in your organization is foundational to keeping your program on track. But your business continuity program is only as good as the underlying quality of your actual business continuity plans.

To avoid a situation where your plans look great on paper but fall flat in actual practice, many companies choose to implement a quality scoring system.

The concept is straightforward. Each business continuity plan is scored, often on a rubric of 1-10, based on criteria that are developed in alignment with both industry standards and company-specific needs.

Things that can impact this score include:

• Plan completeness
• The quality of recovery procedures
• Whether risks that have no available workaround have been acknowledged and accepted
• Business continuity exercise participation
• Continued training and evaluation

Quality scoring enables you to assess your team’s true resilience capabilities in response to a disruption. In short, it is an invaluable tool for understanding whether your business continuity program is truly effective or merely compliant and is one that I recommend every organization employ.

Illustration courtesy of “Resiliency scoring for business continuity plans.”

3.   Evaluating Program Maturity

When helping our clients evaluate their business continuity program, our ultimate objective is to get their program to a point of full maturity and long-term sustainability.

We measure this progress using a proprietary model based on the ISO 22301 standard across 98 core factors or elements by evaluating how close each element aligns with the company’s pre-defined standards (as informed by both industry standards and the specific needs of the business), we can identify gaps in the program and the strategic objectives that are needed to bridge those gaps.

The maturity metric is the pinnacle of business continuity program performance and integral to ensuring the long-term sustainability of your resiliency program.

Getting the Metrics Right in Your Business Continuity Program

1.   Just get started

Perhaps you are one of many business continuity professionals whose board and executives are too busy to hear about your business continuity program. Or perhaps you’re simply too embarrassed about your program to report on its progress.

In working with hundreds of companies as a business continuity expert, I’ve heard plenty of both.

Yet it is implicit upon your board, and arguably part of their fiduciary responsibility, to understand the risks of disruption and have a plan to respond to them.

Keeping your head in the sand is certainly the path of least resistance, but it rarely ends well. Your board or audit committee should be briefed at least annually on your business continuity program progress. That means that you need to start tracking something—and start tracking it now.

2.   Make sure your business continuity program metrics support your organization’s strategic objectives

Business continuity leaders can often get so caught up in the details that they forget about the importance of linking their business continuity program objectives to that of the company as a whole.  Whatever metrics you develop should help you establish direct connectivity between the two. This is especially important when it comes to making the business case for business continuity resources and tools.

Likewise, if using a consultant, it’s important to work with someone who understands how your business continuity program integrates with other risk disciplines within the organization and supports the organization’s strategic business initiatives.

3.   Implement the solution that’s right for you

Your business continuity program doesn’t have to be world-class to work well.

For example, some companies benefit from a robust SaaS business continuity software platform that can roll business continuity capabilities such as the Business Impact Analysis, business continuity planning, and more, including metrics, into one package. We have a few that we love and can help our clients on board, configure, and learn how to use effectively. Still, not everyone has hundreds of business continuity plans to manage across a business with dozens of units and a global presence. In that case, a less robust and expensive solution might be sufficient.

Choose the solution that is right for your business. A trusted consultant can help you determine the best approach to meeting your business continuity program metric needs.

Is Your Business Ready for the next boom?

It goes without saying that the final and ultimate metric for any business is when the boom, the disruptive event, actually happens.

Will your organization be able to respond effectively and snap back quickly from the next disruption?

Time will tell, but by implementing the right measures of program progress, performance, and maturity, you can breathe a bit easier during the wait.

Are you confident that your business is ready for the next boom?

Want to work with us or learn more about Business Continuity?

• Our proprietary Resiliency Diagnosis process is the perfect way to advance your business continuity & crisis management program. Our thorough standards-based review culminates in a full report, maturity model scoring, and a clear set of recommendations for improvement.
• Our Business Continuity (including effective Business Continuity metrics) & Crisis Management services help you rapidly grow and mature your program to ensure your organization is prepared for the storms that lie ahead.
• Our Ultimate Guide to Business Continuity contains everything you need to know about Business Continuity
• Our free Business Continuity 101 Introductory Course may help you with an introduction to the world of business continuity – and help prepare your organization for your next disruption. Our paid 5-Day Business Continuity Accelerator might just be the thing you need to jumpstart your business continuity program.
• Learn about our Free Resources, including articles, a resource library, white papers, reports, free introductory courses, webinars, and more.
• Set up an initial call with us to chat further about how we might be able to work together.