| When the customer might not always be right…
In the implementation of business continuity management be very careful of the old adage – the customer is always right. If this is allowed to be applied across the board without first assessing each situation or changes requested, you might be heading for a lose / lose situation as opposed to a win / win. How can that be? Well, let’s look at an example within the Business Continuity Institute’s (BCI) business continuity management lifecycle , which is linked to one of the BCI’s ten certification standards. Let’s take stage one of the BCI’s lifecycle model – the business impact analysis and risk assessment (BIA / RA); and link it to the first BCI certification standard; project initiation and management. Remember that at the same time there are also strong hooks into the programme management of stage six of the lifecycle model. The workings of this example could apply equally whether you are an internal company business continuity resource, or an external consultant to a client. Firstly, let’s just remind ourselves that, although the business continuity management lifecycle is an ongoing process, each of the BCI stages one - five can initially be looked upon as a project in its own right, with its own project phase requirements for resources, including time and budget. As the business continuity practitioner you need to take charge to the extent of owning the daily management of the project, and need to take ownership for the successful outcome in terms of deliverables being on time, quality, and within budget. Yes, there is (please don’t say there isn’t one!) a company project sponsor to liaise with, keep informed, report to, and keep happy in terms of successful outcomes; but don’t allow this person to take over the project management to the extent of continually changing and extending the scope without first discussing this with you and getting agreement. When assessing any requested or potential scope changes, remember, as a business continuity practitioner and in terms of the BCI code of ethics, you also have a duty to act in the best interests of the client. This means you need to assess these requests for additional work or extended scope in that context, and ask yourself the question: does it provide a benefit and / or add value to the project deliverable and the BCM process? Remember too that often, additional scope = additional time = additional costs, so have you made the project sponsor aware of this implication, and does he / she agree to it before you plug it into your project plan and action it? Keep in the back of your mind that one of your worst enemies in the implementation could be ‘scope creep’. If this is not properly managed, scope creep can very quickly become the cause of project failure: failure to deliver a pre-agreed deliverable on time, failure to deliver within the agreed budget, failure to maintain quality, and failure to keep the project sponsor happy. Business continuity management is a process, which implies an ongoing course of actions. You are at this stage probably only involved in one stage as a project in its own right. Therefore to address all aspects of the process, in the case the BCM lifecycle, you are likely to be involved in a number of consecutive or parallel projects, each with its own start and end date. If you “fail” on the first one, are you putting a spanner in the works for continuation of business continuity management in all its senses: funding, resources, co-operation, executive approval and support, and successful outcomes? This is all not to say that scope creep and scope change is not allowed at all. Sometimes it is necessary for a successful outcome, and sometimes it is a “nice to have” which will improve or augment the deliverable, but sometimes it is not necessary, and the red flag should be raised. So perhaps the best response to scope change requests by the project sponsor, after taking into account any company or pre-agreed change control requirements and approval, is to say “yes but”. The “yes but” approach allows you inform, discuss, and negotiate with the project sponsor so that person can reconsider all the implications of a particular scope change, and reassess the situation, perhaps even coming to the conclusion that the scope creep is not necessary for a satisfactory result. Let’s plug all this into a hypothetical working example. This is the start of formal business continuity management implementation in the company. A business continuity awareness programme has been agreed to, and the project sponsor has been led through the proposed process and understands the BCM lifecycle. Part of the project initiation for the BIA / RA is to create the project plan for the project charter document, which will be agreed to and signed off by the project sponsor before the work commences. After suitable preliminary investigation and discussion it is agreed that, in addition to the site and IT facility inspections, 10 BIA departmental workshops and 26 individual risk interviews will be required to gather all the information to complete the report, which is the main deliverable for this stage. The majority of the work will be at the head office, and one remote branch office will be selected and visited (as a pilot project for several other remote branch offices to be visited at a later stage in another project phase) at which the following will be carried out: business continuity awareness presentation, BIA workshop, site inspection, one risk interview. Six hours of travel time are involved in getting to and from the remote office, but all agreed work items could be carried out in one (very long) day without incurring overnight stay costs. A project plan for the BCI stage one items has been drawn up, and the resources, timescale, and costs have been agreed to. The project charter is signed off and work is about to commence. Then the project sponsor has a brainwave. These workshops and interviews sound great, let’s just have more; say 14 BIA workshops and 32 risk interviews by adding more people from the same departments already included in the project phase. While we’re at it, as you are visiting the selected remote office, there are two other offices nearby. Why not have three sites visits, and while we’re at it, have a risk interview at each site too. Surely you can still squeeze it into one day, perhaps you just need to fly down the night before and start early the next morning? The project sponsor initially thinks all this can be carried out at virtually no additional cost, except perhaps for a hotel room for one night. This is where you need to take ownership for the client’s combination of naivety and over exuberance. Remember, you have done this many times before, are aware of the timeframes required, but the project sponsor has not. Let’s analyse this hypothetical situation now. The original scope (ignoring site inspections) was 10 BIA workshops and 26 risk interviews. It was also agreed that with one consultant, three BIA workshops could comfortably be carried out per day, or four in-depth risk interviews per day. This included travel times to head office and writing up of notes. The original man-days required on site (excluding report writing time) were therefore 10÷3 = 3.3, plus 26÷4 = 6.5. Total days is therefore 9.8, rounded up to 10 days. Now we add the additional request, for another four BIA workshops and another six risk interviews. The additional time required could be 4÷3 = 1.3 plus 6÷4 = 1.5. This gives a total of an extra 2.8 days, rounded up to three days. Three extra days which are to be charged at how much per day? Will this cost equate even remotely to extra benefit or value added to the deliverable? Will there even be any extra value or benefit at all? Then we need to look at the proposed remote office scope creep. Even if you fly down to the remote branch office the previous night, and incur hotel and expenses costs for the client, could you still fit everything into one day? Three site visits and inspections, three risk interviews, BIA awareness presentation, and the BIA workshop? Being realistic you probably could not do justice to this within one day (allowing for travel times between sites), and the output would probably have to be skimped if the project sponsor insisted in doing this, thus potentially overlooking important business impacts or risks, or other pertinent information. Thus quality of the deliverable could be compromised, bearing in mind that the original scope was to only visit a single remote office on one day as a pilot project for the other branch offices at a later stage. Thus the main points to consider when assessing scope change requests
are: Author: Ray Liepa MBCI, business continuity consultant, ContinuitySA (Pty) Ltd: South Africa. ray.liepa@continuitysa.co.za
•Date:
7th December 2004 •Region: S.Africa / World
•Type: Article •Topic:
BC general
|
