As a consultant, I get asked this question a lot. Either when a client is in the process of establishing a new function, or they have become disenchanted with the results they are getting, or they are having problems getting cooperation or visibility for the Program. Usually, however, they ask the question wrong. They ask where it should report, or who it should report to, but miss the fact that it is really a two part question. As with any business function, where BCP reports can be as problematic as having the wrong management overseeing it, so it’s both where and to whom. Allow me to discuss some of the pros and cons and offer some general guidance on the proper placement of the BCP function which will help ensure its best opportunity for success.
Where should BCP report? I’ve encountered successful BCP functions reporting at numerous places in the organization. Frequently, it resides in the technology department, but quite often it sits under other more general business functions, such as administration, treasury, project management, physical security, or facilities. Wherever it sits, it must have the following to be successful:
- It should report somewhere where it won’t get lost. In highly complex organizations where there a multitude of foci, it is more difficult to bubble up the important BCP issues to the top for proper attention to detail. So much noise is generated with everyone else’s issues that the voice of one crying in the wilderness receives little or no attention. Meeting agendas are so clogged that BCP issues are saved for last and often get short shrift, or they run out of time before they can be even addressed.
- It should not report too high in any organization. I’ve seen it report to the CIO, the CFO, or the COO and watched as those busy managers just had too much on their plates to give BCP any but the slightest attention. Better to have a reasonable chain of command that can get on their calendar when necessary with an agenda properly focused on what BCP needs.
- It should not report too low in any organization. If BCP sits too far down the chain the relevant issues won’t ever bubble up and the decision process will become overly onerous and long. Sitting too low says to the rest of the organization that BCP isn’t very important and the BC manager doesn’t rate as someone they should listen to. What you’re looking for is “just right”, like in the story of the three bears. Close enough to decision makers to get the right amount of attention but not so low that BCP gets drowned out by everything else. And “just right” is different in every organization. Like Goldilocks, you’ll figure it out.
- It should not report to the audit department. Audit’s role is to ensure an organization’s processes and documentation comply with internal and external policies and requirements. In effect, they check the work of others. Implementing the BC Program themselves removes their ability to objectively review the content and procedures of the BCP. While they might have some great ideas and tribal knowledge to offer, they should refrain from direct responsibility for implementation, freeing them to fulfill their charter. Any smart BC Manager will maintain open communication and cooperation with audit, but it is my opinion that the reporting of BCP should be placed elsewhere in the organization.
- The reporting structure should include BCP accountability. Most organizations use a management by objective (MBO) accountability for managers that will be used to measure personal success for the year. Having a personal MBO for the success of the BCP function reporting to them does wonders to focus attention and provides incentive to ensure BCP gets the cooperation it needs both inside their realm and across the company.
- Reporting to Technology is sometimes problematic. Sometimes locating BCP in Technology sends the message to the rest of the organization that BCP is primarily, maybe completely, a technology problem, in effect just disaster recovery. Get the systems up and running and everything will be fine. Not. Years ago, getting the lights blinking at the recovery center in Philadelphia was all we in disaster recovery had to worry about. In the years since, especially after 9/11, the mission has expanded to include everything else. A correctly implemented BCP must address outage issues residing in the business functions, facilities, remote locations, assembly lines, and on and on. Locating the BCP in Technology sometimes clouds organization thinking about extending disaster recovery beyond the data center to include true business continuity.
- Not reporting to Technology is sometimes problematic. Contrarily, reporting to a non-technology area can lead to barriers in communicating with the technical staff and management. (I’ve had sys admins and DBA’s talk slow to me like English was my second language until I explained I was one of them once, before I went over to the dark side.) BCP can be viewed as an outside organization that really couldn’t understand the massive undertaking of recovery and is there to lay more burdens on an already over worked and underfunded technology group. If it reports elsewhere, the BCP group must work hard to build relationships and earn respect to gain cooperation. They should acknowledge what they don’t know, ask good questions and listen to the answers, and show appreciation when they ask already busy people to do one more damned thing, for them.
To whom should BCP report? Now we’re getting to the other side of the equation. In all honesty, I’d rather have BCP report to the right person in almost any area in the company than the “right” organization with the “wrong” person in charge. Why? Because the right manager can accomplish BCP initiatives wherever he or she sits in the organization. He knows how to get things done, has a solid reputation, knows and is known by the right people, and knows how to manage for success. Here are some things to consider when choosing who should manage BCP reporting (I’ll be using “he” instead of he/she for convenience, but I have seen and worked for great managers of both sexes):
- He should understand the importance of BCP. Having had the additional function plopped on his plate, he should endeavor to educate himself in the BCP mission and issues. He must learn to recognize the critical importance of BCP and be prepared to devote as much time and effort as necessary to accomplish success for his new reports. The “wrong” manager will think little of the importance of his new function and won’t even learn how to spell BCP, much less acquire the knowledge to speak intelligently to senior management about it.
- He should be well versed in the corporate tribal knowledge. Knowing the inner workings of the organization as a whole will enable him to guide the BCP staff in accomplishing their mission. He will know how things are supposed to work, how they really work, and understands the difference. Each company is unique and speaks their own language (I once was corrected at MBNA that they referred to employees as their “people”, not “staff”). He will also know who the right decision makers are, how to approach them, how and when to report status to them, etc.
- He must be able to open the right doors for BCP. A successful BCP requires access to highly placed decision makers and the new reporting manager must be able to open doors to the executive suite at appropriate times and with actionable information they need to see. He should command their respect and use that influence to garner a spot on their calendar. He will also know what BCP needs to attain visibility, such as which meetings to be invited to, which email lists to be included on, what memos to read, and how to acquire a place on other managers’ agendas. He should be able to smooth the way for his new staff to interact with senior leaders of other areas that are important to the success of their mission. Sort of virtue by association.
- He should be a good manager and coach. He will have to evaluate the strengths and weaknesses of his new staff and determine how best to deploy them. In some, he will recognize their ability to interface successfully with senior management. Others he will determine are better suited to background roles. He should also evaluate their technology knowledge, writing ability, and company business awareness and make plans to fill in the blanks, perhaps using his education budget. As a coach, he should be an encourager to keep spirits up in the face of the adversity they will face and keep the focus sharp on the objectives that will make BCP successful.
Placing a BCP function in the right reporting structure and under the right manager is worth the time and effort and will go a long way toward enabling their success. Both where, and to whom, should be equally considered, and every company is different. I wish you success as you make your determination and welcome any comments on this blog. My contact information is also on this site and I welcome any opportunity to help create world class BCP organizations.