And here is Part II…
6. Probability: I’ve sat in meeting where executives on down have said that the probability of anything occurring (by way of a disaster) is pretty low. OK, that’s fair enough and a true statement. However, many will think that since the probability is so low, they don’t need a BCM/DR/ERM program in place. They can manage it when it happens – if it happens at all. But it’s like the lottery; you can’t win if you don’t play. With disasters, you can’t recovery/respond appropriately if you aren’t prepared for when it occurs. I’ve sat in meeting where the probability has been stated and the discussion goes on an on about the probability of each and every type of disaster that occur. As a result, nothing actually ever gets decided because each little situation and resulting scenario is discussed at an agonizing length.
7. Assumptions: Often, too many assumptions are made during the planning stages. When doesn’t happen is that the assumptions are challenged. But, in many a meeting they get challenged over and over again to the point, where no one takes a stand and says that things must move forward. One meeting I sat in challenged every assumption (Good, you’d think) but what happened that even after the assumption was challenged and re-written/captured, the re-written assumption would be challenged by the same individuals that challenged the assumption in the first place. It was as though they were delaying things for the shear enjoyment of delaying it. Assumptions have to be made at some point along the way (and yes, challenge them at times) but if you don’t set a few assumptions in place it will be hard to make some decisions. You can always state that ‘x’ decision is predicated on the fact hat ‘y’ will occur and then move forward. When you test/exercise, you can always revisit that decision/assumption and see if it needs reviewing and amending.
8. Impacts: If they impacts of a disaster or crisis are too small many will not find a need for a BCM/DR/ERM program. In fact, they’ll move it to the back burner of their discussions and not provide any support or resources (both financial and physical) to address the programs need. The problem is that many of the impacts aren’t fully addresses using a proper Business Impact Analysis (BIA). Sometimes its just people chatting and they state that the impacts are small and won’t hurt the corporation believing that this is what executives want to hear. So, executives believing they are getting the correct information make decisions based on that; they delay the development of any program or required contingency strategies and plans. Not having the correct information with regards to the impacts can not only cause a delay in the programs development (as noted above) but it can also cause the wrong decisions and direction to be chosen for the corporation.
9. Accept the Risk: Accepting the risk of a disaster is an acceptable response, despite what many might think. If the probability is low and the impact is low, what’s the point of having a BCM/DR/ERM program in place? Of course, the proper determination of the probability and impact may not have been performed but still the decision has been made. If a disaster occurs, the corporation will deal with it at that time. Yes, it might be too late to recovery properly but still, it’s an acceptable decision made by the executives. Even if we, as professionals, don’t agree with this kind of response and decision, it’s still a decision made by executives who are prepared for whatever occurs. This decision obviously delays any program development; in fact, it puts it on ice.
10. Over Confidence: This really links to #9 above. Over confidence in people, policies and processes – and experience – will sometimes lead executives to believe in their own infallibility. Well, I got news for you; you’re wrong. Everyone and every corporation is susceptible to a disaster; no one is immune. Over Confidence means all sorts of assumptions have been made (many subconsciously) about a disaster and how it will play out. When someone is over confident they will delay addressing any risks that can actually harm them, thus in the corporate world, over confidence will mean that the potential risks facing the company will go on being ignored or not responded to. When a disaster occurs the company isn’t prepared and all the thoughts – the level of over confidence – is proven to be wrong and disastrous. This also occurs with corporation with established programs. Instead of challenging the plans (exercising/testing) they will believe what they have is satisfactory and can address any situation; even when these plans are out dated and haven’t been reviewed or maintained in months or years.
11. Finger Pointing: This section might not be something you’ll like but it is something I’ve seen in the past (and I doubt I’m completely alone here). There are still managers and executives out there that will delay decisions so that they can later state what the ‘real’ decision should have been. This means they are finger pointing at other individuals to make themselves appear correct and the saviour. For those who’ve read my writings for some time, you’ll recognize this as part of the Might Mouse Principle. It’s an outdated action and doesn’t have any part in today’s business world (at least for those that are successful) but it does still occur. If proper assumption challenging occurs and the right people are involved gathering the right information, then no manager or executive (or employee involved for that matter) can point fingers because they were part of the overall decision process and are part of the decisions made. It’s also highly unprofessional.
12. Over Analysis: This might seem like a given but over analysis will delay decisions and bring things to a screeching halt. What I mean is that others will analysis other areas BIA results or contingency requirements. There is no need for them to review other departments findings but they will analysis things anyway and point out things that may or may not be inconsistencies, while ignoring their own areas (as they believe their results are correct).
I’m sure many readers will come up with other items that have delayed their plans and program development. In fact, I can
think of many myself that aren’t listed here but these were the ones I was experiencing during a specific meeting. I can add No Dedicated Resources, no training, no awareness, no exercising/testing and many other things that would delay or hinder a programs success and development, but these weren’t part of the meeting I was part of.
If you’re experiencing any delay in your program ability to move forward, see if any of the above is occurring or if you can see some of these actions in the individuals you need assistance from. You’ll need to address it appropriately and resolve these issues so that you can get your program moving forward once more. Remember, the longer you delay in getting these obstacles out of your way, the closer a disaster is coming to your company; you can’t escape a disaster or crisis forever.
Don’t let a paralysis of analysis stop you from building a strong program (and plans). It could be the wrong people are involved and
you may have to look at others for assistance but in the end, paralysis by analysis is like a deer caught in car headlights; it just stops and stares in shock…as danger moves closer.
“Heads in the Sand: What Stops Corporations From Seeing Business Continuity as a
Social Responsibility” and
“Made Again Volume 1 – Practical Advice for Business Continuity Programs”
by StoneRoad founder,
A.Alex Fullick, MBCI, CBCP, CBRA, ITILv3