8 Things to Consider When Choosing a Business Continuity Consultant

You need a business continuity plan.  We’ve previously talked about all the best reasons to invest in business continuity–one of which may be that your industry is subject to government oversight, which has dire implications of unpleasant sanctions should disaster strike. (See this Gartner compendium of laws influencing business continuity and disaster recovery planning.)

Besides compliance, there are plenty of good reasons for investing in business continuity, with survival topping the list. The good news is that there are ample (and free) guidelines to plan, implement, and manage a business continuity program (BCP). (See our blog post on how using ISO 22301 fits into the picture of responding to emergencies so that a business can continue to function.)

The best approach is the business impact analysis…

Related to ISO 22301 is ISO 22317. This standard shows how to perform a business impact analysis (BIA).  Done properly and applied to the unique needs of the organization, the BIA is the bridge between the company’s mission-critical functions and moving forward after some disruptive event. (See our blog post on how to get senior management on board)

In-house or consultant?

So, the old adage that nothing worth doing was ever easy applies to business continuity planning and execution. It is complicated, but does it also mean that the process is too difficult or cumbersome to manage it in-house? Not necessarily, but BCP adds more to the list of things to do and requires resources.

More good news: Along with all that guidance there is plenty of professional help in the business continuity consulting management field (a BCM consultant, or BC consultant), who is experienced, skilled in interpreting, tailoring, and applying all those standards, checklists, and can ease the burden so that management can concentrate on the daily core business of delivering the product to the customer.

When should an organization consider hiring a business continuity consultant?  

Writing for TechTarget.com, Richard Jones, a VP at Burton Group, advises, “[T]he first step (after agreeing that a BCP is in order) is deciding who will lead the process. In-house personnel may be qualified, but if not a consultant is what you need”–or it could be a combination of the two.

It may be possible to do the job without a “hired gun.” In that case Jones advises looking for someone already on board who has led at least two successful business continuity exercises in organizations off similar sizes in approximately the same market to the organization.

Also, this updated piece from Continuity Central also has some sage advice on the subject. The organization should ask these three key questions:

1. If there is a staff member having the necessary knowledge, is it sufficiently up to date and “broad enough to develop a fully rounded business continuity plan?

2. If the staff person is not completely “up to speed,” would additional training fill the gaps in areas of deficient expertise?

3. Could an external consultant work with the staff member and minimize the amount of consultancy time needed?

Hiring a BCP consultant makes sense…

So, even if the organization has qualified business continuity planners in-house, hiring a consultant still would be the way to go to either jumpstart of supplement the business continuity planning. In-house personnel already have primary responsibilities, which would likely be more important to the business’s daily operation.

Therefore, vetting and hiring a BCP consultant would be appropriate regardless of in-house experience, depending on what the organization needs and its level of confidence in its preparedness to cope with an interruption in its business.

Quality is the vital determinant…

Finally, there is the crucial aspect of quality. Consultants have wide experience in this field; it’s what they do for a living. Their planning, advice, and knowledge of best business practices are based on formal standards. Those standards, like most safety manuals, are written in the wake of things gone awry and the lessons they leave behind as warnings for every business.

Any BCP plan in the final analysis is a solution to a vast “what-if” scenario. The consultant needs to provide evidence of a deep understanding of the client’s strategic priorities, risks, and vulnerabilities. The best business impact analysis is nothing more than an honest recognition of the latter. The BCP consultant needs to be able to articulate those risks along with mitigation strategies and present the client with business-specific methods and a roadmap to recovery.

8 things to consider when choosing a BCP consultant

The decision to hire a BCP consultant is similar to hiring any consultant. The difference is that the consultant has a product somewhat like casualty insurance. The client hopes never to have to open the plan and use it, but everyone needs to have full understanding and confidence that when the earthquake occurs, it won’t swallow the company whole.

Choosing the BCP consultant is a combination of achieving that trust and confidence, along with making commonsense business judgments.  Jones in the TechTarget.com article referred to above, recommends culling down the list of qualified and credentialed consultant candidates to no more than three and look for the following:

1. A reference list of at least 5 previous clients

Although, some businesses may prevent the consultant from listing that business as a reference, a consultant’s hesitancy to produce references is definitely a red flag. Check the consultant’s references for evidence of timeliness in meeting milestones and goals. (See item 4 below.)

2. A clear statement of pricing and billing policies

Look for a contracted price that includes everything the consultant will deliver, but no more. Trying to low ball the price could result in substandard consultant service. Jones points out that the most reputable BCP consultants “will refuse to drop prices in exchange for giving up part of the process.” Doing that “becomes a risk to their reputation of delivering complete and quality services…”

Then there’s this advice from Continuity Central.com on costs:

The project cost will always depend on its scope, and they are particularly susceptible to “scope creep.” For that reason it is crucial to have “a clear, unambiguous definition of the scope of the project and clear specifications for deliverables…”

In the end, the organization needs to compare the consultant’s cost quotations with what it would have to spend on in-house resources–e.g., software, equipment, training, and time.

4. The time factor

Where there is no effective business continuity plan in place, the organization must be act quickly to reduce its exposure. An experienced consultant will be able to complete the project on a timeline no quicker or slower than the client’s ability to review the documents, make the decisions, and provide the in-house people for interviews or testing.

Again, look for previous clients’ testimonials on timeliness of delivery.

5. Experience in the type of business

Small BCP consultant firms will usually focus on one single type of business. According to Jones, “They should have experience in your industry vertical.” Along with testimonials of prior customers in the same industry, the client should verify the consultant’s understanding of how the business works, what its customers expect, what business processes are vital to the health and continuance of the business.

6. The ability to provide training and mentoring

The consultant’s goal must be to train the client and guide the process as the client performs the work. Look for a model that empowers the staff to “continue forward and break the ‘umbilical cord’ to the BCP consultants.” The “cord,” however, can be replaced with an ongoing relationship, which will continue to improve the organization’s business continuity planning and response.

7. Provision of tools to continue the process

Again, Jones points out that, “It is imperative that the expectations are that your organization will take over control of the BCP process from the consultancy firm.” The consultant must first provide guidance and then mentorship to the client. The tools are the training materials, test checklists, and resulting increase in competence to respond, mitigate, and take the steps to keep everything going when disaster strikes.

8. Follow-up and assistance

The plan cannot be static. It must be re-evaluated when changes in the business environment–new regulations, organization, technology, etc., occur. The consultant must be available for help with continuous program improvement and guidance for corrective actions when some aspect of the plan is not working.

Can we help you?

Finding your way through business continuity planning can be complex and time-consuming. Bryghtpath has the business continuity experience, methodologies, and solutions that can help you evaluate and mature your program.

Learn more about our approach to Business Continuity in our Ultimate Guide to Business Continuity and then contact us today.