Feature Article
by Ted Brown, CBCP
The number one challenge facing BCP professionals today remains getting upper management buy-in. The events of September 11 have raised awareness of the exposures, but there still are organizations without a commitment to BCP.
Often, the reason for this lies in the presentation given to obtain support.
There is so much compelling data that BCP professionals wish to convey to upper management that they sometimes get lost in the information, packing hundreds of pages of data into their presentations. Planners would have a great deal more success if they treated their meetings with upper management as sales calls, using techniques that a good salesperson uses with clients.
The following steps should be taken when planning a presentation seeking to gain management support of a business continuity program.
1. Document the Objectives
It is not enough to have an objective of getting more funding or gaining executive support. Determine ahead of time exactly how much funding is needed, or exactly what form the executive support should take.
2. Verify Expectations
Determine what management’s expectations for the meeting are, and also verify the time allotted. Frequently, last-minute circumstances will shorten the time available. Find out the schedule before the meeting to prevent being cut off prematurely. 3. Be Prepared to Take What You Can Get It makes more sense to get the commitment for resources to achieve a 24-hour recovery time objective (RTO) than to demand the resources for a two-hour RTO and get nothing. 4. Anticipate Objections
Instead of hoping the executives don’t ask “How much?”, realize that the number one objection is the cost, and prepare accordingly. Let the results of the business impact analysis (BIA) justify the “investment” (not “cost”).
5. Gather References
Executives care what their competition is doing. Annual benchmark studies and salary surveys are good sources of information on the investments in BCP being made by industry, by size of organization, etc.
6. Prepare ‘Scare Tactics’
Without being sensational, remind the executives of the regulations that affect their business, and the impact of not complying with them. Examples of such regulations are Sarbanes-Oxley, HIPAA, Foreign Corrupt Practices Act, and Gramm-Leach-Bliley. Also research companies that have been damaged significantly in highly publicized news stories because of their failure to act responsibly.
7. Define the Risk/Reward of BCP
Upper management is used to making ROI decisions. Research and develop the business continuity program’s return on investment. This is a key part of a good presentation.
8. Package Resources
Work with vendors who can package consulting or software into their alternate site, hardware, or infrastructure equipment solution. It’s easier to get one purchasing approval than three, and this will likely save money in the long run, as well.
9. Recruit Partners
The “sales call” will have greater success if other departments within the organization support the BCP program. The power of a presentation supported by marketing, IT security, physical security, human resources, facilities, and risk management is highly significant.
10. Use the Visibility of the Internet
The Internet can be a great tool to increase the visibility of the BCP program. Within security constraints, a BCP home page can be developed that serves as the portal for all aspects of the program. This increased visibility yields increased support and commitment.