In more than 30 years in business continuity and crisis management, one question still makes me cringe: “Are there metrics we should be tracking?”
As I said on Managing Uncertainty, Episode 121: “In short, the answer is yes. Hell yes, there are.”
The better question is which business continuity metrics to track, and that depends on what you want to know. Do you want to know whether your program would work in the next disruption? Or do you want to know the boxes are checked?
Those aren’t the same thing. Plenty of programs report 100% plan completion every year and would still fall apart on a bad Tuesday. Compliance tracking tells you the program is busy. It doesn’t tell you the organization is ready.
You need metrics at four levels: operational compliance, plan quality, program maturity, and business outcomes. Each one answers a different question, and each one is incomplete on its own.
| Old View | New View |
| Plan completion is the measure of success | Plan completion is table stakes |
| A plan exists, so the process is covered | A plan is scored on whether it would work |
| Report activity to the board | Report outcomes and decisions to the board |
| A clean audit means we’re resilient | A clean audit means we were compliant |
| Metrics live inside the program | Metrics tie the program to business objectives |
1. Operational Metrics: Is the Work Getting Done?
Operational compliance is the foundation. It isn’t the whole story, but without it nothing else matters. Track it by business unit and by plan:
- Business Impact Analysis (BIA) completion
- Business continuity plan completion (for a new program) or annual updates (for a mature one)
- Exercise completion
- After-action items: open, closed, and overdue
- Training and plan owner attestation
I walked through what this looks like as a dashboard on Managing Uncertainty, Episode 235. The gauges we build for clients usually include:
- Plans and BIAs by status, shown as a funnel: not started, assigned, in progress, pending approval, approved.
- Late plans and BIAs against the due dates for each update wave.
- Percent approved, as a red, yellow, and green gauge.
- Exercise completion against plan count. Most of our clients require an annual tabletop exercise for every BC plan. If you have 79 plans, you should see 79 exercised by the end of the cycle.
- BIAs by recovery time objective (RTO), so executives see how many processes must be back in four hours versus a week.
- A view by division, broken out by the CEO’s direct reports, because that’s how executives think about accountability.
- A customer-facing view that shows only the processes customers feel, and their dependencies.
If IT disaster recovery is in scope, add critical applications, sites, key third parties, and infrastructure.
A small program can run all of this in a spreadsheet. A program with hundreds of plans across dozens of business units will want business continuity software, most of which produces these gauges out of the box.
Here’s the catch. As I said on that episode: “I know a number of business continuity programs that would totally ace this operational metric view. But their program is not very good.” They knock out plans and BIAs on schedule, and they have no governance, no policy, and no alignment with IT disaster recovery. Operational metrics can’t see that.
2. Plan Quality: Would the Plan Actually Work?
Your program is only as good as its plans. A plan can be complete, approved, and on time, and still fall flat the first time someone opens it in a real event.
Quality scoring catches this. Score each plan, often on a 1 to 10 rubric, against criteria drawn from the standards and your own requirements:
- Completeness
- Quality of the recovery procedures (could someone who didn’t write them follow them?)
- Whether risks with no available workaround have been formally accepted by the right executive
- Exercise participation
- Ongoing training
A quality score tells you whether a plan would work, not just whether it exists. It also gives plan owners something to improve, which a completion checkbox never does.
Illustration from Anna Olson and Jamie Anderson, “Resiliency scoring for business continuity plans,” Journal of Business Continuity & Emergency Planning (2016).
3. Program Maturity: How Good Is the Program as a Whole?
Maturity is the measure that matters most over time. It looks at the whole program, not just its outputs: governance, policy, leadership engagement, the BIA process, plans, exercises, IT disaster recovery alignment, and continuous improvement.
We score programs against ISO 22301 using the ResiliencyPulse maturity model. Some of our clients use the availability and recovery domains of the NIST Cybersecurity Framework or HITRUST instead, when those frameworks already drive their reporting. Whichever you pick, measure the same way every time so you can show the trend. Once a year, or every other year, is the right rhythm. Maturity moves slowly, and that’s the point: it shows whether the program is getting better, not just busier.
A good maturity assessment should end in a decision, not a list. I wrote about what one should tell you in What a Business Continuity Maturity Assessment Should Tell You (and What an Audit Won’t). If you want to score yourself first, our maturity models let you do it in-house.
4. Outcome Metrics: What Your Board Actually Wants
“We have 125 plans and they were all updated this year” is hygiene. Your board can’t make a decision with it.
On Managing Uncertainty, Episode 326: Compliance Is Not Resilience, I put it this way: “Compliance proves what you did in the past. Resilience is what you execute under pressure in the moment and into the future.” Board metrics should show the second one. For example:
- Uptime protected during the last vendor or software-as-a-service outage
- Revenue exposure reduced by relocating or redesigning a critical process
- Time to decision in this year’s crisis simulation versus last year’s
- Risks retired, and risks formally accepted, and why
These tie the program to things your executives already care about: revenue, customers, and decisions. That connection is also what wins you resources.
How to Measure Business Continuity Readiness
If an executive asks, “Are we ready?”, the honest answer comes from a short list of business continuity KPIs that cut across all four levels:
- Coverage: the percentage of critical processes with a current, tested plan
- Recovery performance: the percentage of tested processes and systems that met their RTO in the last exercise or test
- Follow-through: the percentage of exercise action items closed on time
- Quality: the average plan quality score, and the plans below your threshold
- Maturity: the overall maturity score, and its change since the last assessment
Five numbers, one slide. If you can’t answer them today, that’s your starting point.
Getting Business Continuity Metrics Right
Just start. Some BC leaders tell me their executives are too busy to hear about the program. Others are too embarrassed by where the program stands to report on it. Keeping your head in the sand is the path of least resistance, but that rarely ends well. Your board has a responsibility to understand disruption risk, and your board or audit committee should be briefed on the program at least once a year. Track something now, and improve it later.
Tie metrics to strategy. BC leaders get so deep in plan counts that they forget why the program exists. Every metric should connect the program to a business objective. If it can’t, ask why you’re tracking it.
Fit the tool to the job. Your program doesn’t have to be elaborate to be effective. A spreadsheet is fine for a smaller organization. Enterprise software earns its cost when you’re managing hundreds of plans across a global footprint.
The Ultimate Guide to Business Continuity covers how metrics fit into the rest of the program.
The final metric for any business continuity program is what happens when the disruption, the boom, actually arrives. Measure now so you already know the answer.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
- Build the metrics into your program. Our Business Continuity services include dashboards, plan quality scoring, and the governance that makes the numbers mean something.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your program metrics with us.
