How to talk with your CEO about business continuity

You are a true believer and an expert in business continuity planning. Within your authority and job description limits, you have brought your organization up to a minimal level of business continuity compliance. Your IT is backed up off-site, and your disaster recovery plan looks good on paper, but how do you talk to your CEO about business continuity?

When it comes to meeting ISO standards for business continuity planning and execution, you’re nowhere near a comprehensive business continuity plan (BCP). In fact, you haven’t completed the first step, the business impact assessment (BIA). That is because you need CEO support to:

• Uncover your organization’s business processes and their role in providing products and services. You need to ask intrusive questions and don’t always get full cooperation from other managers and participants in the company’s operations.
• Accurately assess how not providing those products and services will impact your organization over time. This assessment encompasses not only current products and services but also strategic growth plans. There could be a generational struggle going on over the company’s future and direction.
• Adjudicate and set priorities and timeframes to resume business at a minimum level to keep the business running. The priorities involve a consensus of what business processes managers would want restored to keep the business solvent. Should the care and feeding of suppliers take precedence over customer confidence?
• Identify how your business resources are interdependent and support the overall activities of your business. Interdependence does not always equate to indispensability. Start poking around here, and you could get differences of opinion and pushback.

To a greater or lesser extent, each of the above can involve turf issues and silos of proprietary information. When you get into matters involving conflicting visions and competition for resources, the only way past resistance is top management, i.e., CEO support.

Lip service is not buy-in.

You need CEO support, commitment, and involvement for successful business continuity management. A successful BIA must transcend organizational boundaries, as illustrated in the preceding bullet points. Without the BIA, the BCP cannot get off the ground. Without management buy-in, the BCP will be a paper tiger without teeth.

The problem is that the buy-in is typically only the lip service of subjective commitment, especially at the CEO level. Senior executives are busy people and tend to view business continuity in their own pragmatic context: company growth, competitiveness, and keeping shareholders happy.

Besides, an effective business continuity plan, with its additional capital and workforce investments, amounts to an additional business insurance expense. Where is the return on investment?

The challenge is to convince the CEO of the need for an effective BCP. You are the expert, and your job is to analyze, document, and identify everything your organization needs to do to keep the company going if disaster strikes. Do your homework, and you’ll have your CEO’s backing to get the program moving. You’ll also provide the ammunition your CEO needs to convince senior managers that BCP is the foundation of company longevity.

What to tell your CEO about Business Continuity

1. The CEO has a due diligence responsibility.

Federal and state laws govern all types of financial and healthcare businesses. Those organizations must have a plan for business continuity in place. Also, any company with more than ten employees is covered by an OSHA blanket regulation to provide employees with a safe workplace. The best business continuity planning stresses employee safety as a key element of the plan.

2. Business insurance alone won’t save the business.

While business insurance will cover loss or damage to equipment and inventory, it will not cover loss of profits and other intangibles. You can buy business interruption coverage, but it is typically capped at $30,000 per incident and only after the insured thoroughly documents the organization’s net income.

The intangibles that business insurance will not cover include the following:

• Loss of opportunities in a volatile and expanding market (Your business is frozen in time.)
• Interrupted, delayed, or aborted new services or products because your business is frozen (The growing demand for your product has been strangled.)
• Destruction of your business reputation and value of your brand (Your credibility in the market is instantly destroyed.)
• Loss of customers, who must go elsewhere to stay in business (It costs far more to get new customers than to keep old ones.)
• The consequences of breach of contract or litigation from suppliers, customers, or regulators (If your BCP was either inadequate or nonexistent, you could face civil and legal penalties.)

3. There is a difference between disaster recovery and business continuity planning.

It is all about scope. Disaster recovery is just one element of business continuity planning. Disaster recovery focuses on the company’s information technology and data. It is a subsidiary element of business continuity planning.

On the other hand, business continuity planning dedicates resources and provides continual program evaluation and planning. It guarantees continuity of business operations with minimum downtime. Likewise, BCP has ramifications and applicability across the entire organization, not just a single piece like IT.

4.  BCP is in perfect alignment with business strategy and organizational objectives.

Whereas the BIA assesses the impact of a disaster on the continuation of business, the BCP will follow through by:

• Determining how the risks to the organization will affect operations
• Putting in place procedures for mitigating the risks
• Actual testing of those procedures to make sure they work
• Periodic and automatic reviewing of the BCP processes

A byproduct of the BIA/BCP process is a deeper understanding of the business and the processes that contribute to its continuation. The best BIA identifies inefficiencies and redundancies and is a tool for organizational improvement. The BCP is the ongoing strategy to keep the company compliant, resilient, and ready to meet any contingency through employee training and management buy-in.

Summary and conclusions

As the subject matter expert or leader in business continuity, you need to talk with your CEO and provide a convincing argument to invest organizational resources in this area.  Your main goal is to translate the technical talk, keep the discussion uncomplicated, and speak to the business.

In your briefing to the CEO, you need to present a case in the most precise and concise terms. You have done your research and can state the risks to your organization to protect its people and the consequences of disruptive events. You will need to find a realistic balance between alarmism and articulating the actual value of BCP for the organization.

Finally, to get past lip service, you must assist the CEO in embedding business continuity into the company’s culture—not always an easy task. Your argument must emphasize the need and value of collaboration, involvement of top management, and engaging the staff, who have a stake in keeping the company functioning, vital, and growing.

We can help you!

Bryghtpath is a leading developer in business continuity programs. We can help you prepare and present your plan to your senior executives.

Learn more about our approach and thought process around business continuity in our Ultimate Guide to Business Continuity.

Contact us and let us know how we can tailor our services to your unique business needs.