If you think that having good governance for your business continuity and crisis management program is just an exercise in bureaucratic box-checking, you’re missing the point.
Like most people who come to us with a problem, you might have issues:
- Getting your executives to care about your business continuity and crisis management program
- Getting other teams to participate in business continuity activities
- Getting IT to build the availability and disaster recovery strategies that you need to ensure continuity of operations for business teams
Good governance—i.e. having the right people, policies, and practices to direct and control your business continuity and crisis management program—is the answer to all three of these problems.
Having an effective governance approach for your business continuity and crisis management program can help your program on multiple fronts. It creates opportunities to advance your program with executive and board leaders, facilitates cross-departmental coordination and buy-in, and ensures a forum to have the conversations that are important to improving and maturing your program.
That’s why governance is the first of the six enabling functions in our Resilience Operating Model®: it decides who owns resilience, who activates, who escalates, and who signs off.
Here’s our best advice on how to make sure your governance approach helps you reach your resilience objectives.
Key benefits of good business continuity governance
Builds visibility and awareness for your business continuity program
Most people still don’t understand what business continuity and crisis management are, let alone their value to their organization. As a business continuity leader in your organization, you need to be prepared to educate and champion your program to others at every opportunity.
Good business continuity governance is one of the best ways to do this.
Steering committee meetings provide an important forum for you to discuss how your business continuity program aligns with key departmental and company objectives and build buy-in among your stakeholders. Requiring annual or semiannual reporting to your board and executive management is also an effective way to ensure you have the opportunity to regularly champion your program to company leaders.
Helps identify and address gaps in your business continuity program
Steering committee meetings are an important forum for measuring progress and addressing program challenges. With this information in hand, you can then prioritize actions to resolve, mitigate, or accept identified gaps in your program, like recovery capabilities that may still fall short of your requested technology RTOs.
Your business continuity & crisis management steering committee—usually an interdisciplinary team of six to eight people—should meet at least quarterly to ensure your program is aligned to corporate strategy and objectives and is maturing and making forward progress towards annual goals.
Provides a mechanism for accountability
Putting your business continuity program’s performance into operational metrics is a guaranteed way to get business continuity stragglers on board. No one wants to be the department highlighted in red in your business continuity program metrics.
And while I always advocate the carrot over the stick, creating metrics around your program’s performance—and highlighting who is falling short—is a guaranteed way to get their attention. If you’re not sure what to measure, start with 3 Key Metrics for Business Continuity Program Success.
Supports conformance with ISO 22301
We highly recommend the International Organization for Standardization’s (ISO) standards as a starting framework for your business continuity program and plans (ISO 22301). While conforming to ISO standards is completely voluntary, it’s an important industry benchmark that matters to most boards, compliance frameworks, and investors. And because ISO standards are based on a proven process for program improvement, conforming with ISO 22301 is one of the best ways to make sure your business continuity and crisis management program improves and matures over time.
While ISO 22301 does not establish a prescriptive governance approach, it does require a process for establishing business continuity objectives, ensuring leadership oversight and accountability, and a framework for measuring and improving upon program objectives. This implicitly requires that there is some sort of governance process, such as a business continuity steering committee, which sets and monitors these objectives.
With this in mind, every business continuity policy that we create for our clients includes governance and accountability requirements, including roles and responsibilities of the executive sponsor, steering committee, and others in the governance process.
How to implement effective business continuity governance
1. Get your policy in place
Creating a business continuity policy that aligns with ISO 22301 standards is an important first step to standing up your governance approach. It will guide you in:
- Setting a strategic approach for your business continuity and crisis management program,
- Getting agreement on key definitions and objectives,
- Establishing key roles and responsibilities, and
- Defining governance and accountability requirements.
Ideally, this policy should be created at the outset of starting your business continuity program. If you already have a program in place but no policy, it’s never too late to start. We walk through what belongs in one on Ep. 332 of Managing Uncertainty, What Belongs in a Resilience Policy.
2. Set clear roles and responsibilities
Your business continuity policy should include clear roles and responsibilities for various aspects of your resilience program. The board, executive team, executive sponsor, and especially the steering committee, all have key roles to play in ensuring your program’s success.
It’s equally important to make sure that you place the right person in each role. This is especially important for your executive sponsor(s)—your program’s champion(s) within the organization—and your steering committee members. Here’s how an executive sponsor can champion your program.
3. Build a strong steering committee
The steering committee is the primary governance body for your resilience program. On a practical level, this is where and when things get done.
Your steering committee meetings are the time and place to talk through program challenges, obstacles, and key areas of opportunity to improve resilience.
To make sure you get the most out of your steering committee, your business continuity policy or steering committee charter should include the following:
Roles and Responsibilities—Ideally, your steering committee should include management representatives from select teams across the organization. This includes your business’s main lines of operation and anyone critical to supporting those operations.
Meeting Frequency—We recommend that most steering committees meet at least quarterly, if not monthly, depending on the maturity of your program and the complexity of your organization. As your program matures, you can adjust your meeting frequency as needed.
Meeting Agenda—Every organization is different, but most standing agendas should include:
- A discussion of program status, including operational metrics and any strategic initiatives or projects important to your IT disaster recovery, crisis management, and business continuity programs
- Review and discussion of program gap findings from incidents or exercises and plans to close those gaps
Your standing agenda should also make provisions for an annual review of your program structure, framework, and policy.
It’s also a good idea to make sure your policy includes an annual briefing to both your board (or the board risk and audit committee) and your executive management team.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
- Run it as one program. Resilience as a Service runs business continuity, crisis management, and IT disaster recovery for you, steering committee included.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your governance model with us.
How to Set Up a Crisis Management Team in Your Organization