Whether you are a full-time Business Continuity/Disaster Recovery professional, or a part-time planning coordinator, you’ve probably asked yourself the same question: why can’t I motivate people to write and maintain plans for their areas of responsibility?
If a solution to that problem isn’t found, the result is often a less-than-satisfactory compromise that manifests itself in one of three ways:
- “Boilerplate” plans: a ‘scope & responsibility’ section, a call-tree, lists of other critical contacts, and bunch of Appendices with lists of critical IT applications, vital records, forms, and other contact phone numbers. It’s not really a ‘plan’ – but at it’s something on paper that may satisfy auditors.
- “Fill-in-the-blank” plans: templates into which users to type words appropriate to their function or department. Not much thinking is required and little or noplanning – but there’s a better chance of slipping the results past an auditor.
- “Ghost-written” plans: members of the BCM team write ‘Plans’ for individual business units – with little or no assistance from the business unit (other than the answers from their BIA survey). The resulting Plans have some meat to them – but can’t be as viable as ones created by the actual owners of the processes or functions.
Despite support from Senior Management – and even threats of reprisals at performance review or annual bonus time – it often seems that nothing can motivate some Department and function ‘owners’ to put in the time and effort to write actionable, viable recovery or continuity plans.
Why not? The answers may be simpler than you think.
Why Johnny Won’t Plan
No ROI
Planning takes time – to think, write, review, edit and rewrite. Yet that time (in terms of man-hours) produces no measurable return; it doesn’t contribute to the bottom line, nor improve efficiency. When it’s time to write up the monthly report, does the boss want to hear how many hours were spent working on the Business Continuity Plan (instead of helping assure his bonus)? Not likely. The boss only wants to be assured there is a Plan – but may not want anyone to waste ‘productive time’ creating it.
If managers get paid to improve their employers’ bottom line, then time spent on non-productive work (read: BCP) is not perceived as a valuable part of the job – it’s just ‘busy work’ that they’ll get around to when, and if, we can find the time.
All Risk, no Reward
Are function managers, Department leaders (‘Plan Owners’) rewarded for successful BCP development and testing? In most organizations, there is no bonus for BCP excellence – just penalties for non-compliance.
If avoiding the penalty is the Plan Owner’s sole motivation, why not just meet the minimum requirements? Anything else is a waste of time.
Why Johnny Can’t Plan
Blank-Page Panic
It’s simple human nature. Most people are not confident writers; they are intimidated by the blank page. They don’t know where to start or how to create what they believe is expected of them. They need help; and when help fails to materialize, they freeze up.
Their panic manifests itself as ‘writer’s block’ – the inability to put words on the page. Writer’s block isn’t a real disease, and it isn’t contagious. But time after time, organizations find themselves plagued by an epidemic of BCP ‘writer’s block’.
Without insufficient guidance, most Plan Owners will find it difficult or impossible to confront the blank page. And won’t.
Analysis/Paralysis
Ever ask the CFO how critical his Accounting Department is? He or she will tell you it depends on what day of the week, what week of the month and what month of the year the ‘incident’ occurs. They can’t separate the process from the event.
Similar thinking is a hurdle for many Plan Owners: they can’t focus on the ‘how to” because they get hung up in the ‘how come’. By focusing on what may happen (‘But if the building floods past the 2nd drawer of the file cabinets on the third Thursday of a month ending in ‘R’½”) they are unable to focus on what’s important to their process, regardless of the circumstances. They come up with more and more complex disaster scenarios – until finally deciding that because the variables are infinite, planning is futile.
How Low is the Bar?
Sometimes the BCM staff has to shoulder part of the blame. Having tired of fighting an uphill battle, standards may get implemented that can be met by 75, 90, perhaps even 100% of Plan Owners.
A bar set low enough guarantees that Plans will meet – but seldom exceed – those minimum requirements. Like the Public School System: you don’t have to prove your worthiness to get in – you just have to show up.
Often, organizations create Plan ‘templates’ designed to meet the requirements of their auditors. Meeting those requirements will please the auditors, but the resulting Plans will seldom meet the needs of the organization when an actual disruption occurs.
Why not? Most auditors look for high-level content, compliance with standards and proof of maintenance. Auditors seldom have the depth of knowledge to determine if anything truly important is missing, or if the plan will actually work in a crisis.
Set the bar too low and you get what you asked for. And nothing more.
Just because Johnny doesn’t plan, shouldn’t mean he can’t – if you provide the right direction, tools and feedback to help him be successful.
