SUBSCRIBE TO
CONTINUITY BRIEFING


Business continuity news

Never miss a news story: signup for our free weekly email newsletter.

REGIONAL PORTALS
Continuity Central currently offers three regional business continuity portals:
North America
United Kingdom
Asia Pacific / Australasia

In Hindsight - A compendium of Business Continuity case studies

Add to Google  

Use Google?
Click the button to add Continuity Central news to your Google home page
.

Follow us on Twitter  

Get immediate news
and information updates via our Twitter feed.

SUBMIT YOUR NEWS
To submit news stories to Continuity Central, e-mail the editor.

NEWSFEED
Want an RSS newsfeed for your website? Click here

OUR COOKIE POLICY
Before using this website ensure that you understand and accept our cookie policy. More details

Leaving business continuity

By Nathaniel Forbes, MBCI, CBCP.

Late in 2013 the head of BCM for one of Asia’s largest banks voluntarily transferred within his bank to a job entirely unrelated to BCM. He is the most-experienced, knowledgeable and highest-paid non-expatriate BCM professional I know in Asia.

I wondered why anyone with eleven years of full-time BCM experience and a compensation package the envy of his peers would make such a move. He agreed to answer my questions on-the-record if I didn’t use his name or identify his employer.

Interview: part one

Q: How old are you?
A: [laughs] You can say ’42 plus’.

Q: What did you do before you did BCM?
A: I was in business consulting.

Q: Do you come from an IT background?
A: My education is in IT, but I never [worked in] IT. I did IT audit.

Q: How did you get into BCM?
A: I got into BCM by a fluke chance, like everybody else. I was doing consulting in Thailand [in 2002]. It was supposed to be a 6-month contract. At the opportune moment [the end of the contract] – at that exact moment - [a bank in Asia] called and said, ‘Hey, do you want to try out BCM?’ I said, ‘I don’t care what it is, I’ll try it.’

I told them, ‘I’ll be honest. I had some experience in my previous bank, but I don’t really have experience.’ I wasn’t thinking about BCM at all. [The hiring manager] told me it was actually my other experience that interested him - my audit experience, my consulting experience: directly relevant to BCM. I will pick up BCM knowledge. But he was looking at the other skills that I had, which is why he was keen to have me on board.

Now, fast forward 11 years [to 2013]. Those are the same reasons my new boss gave [for approving my internal transfer]: ‘Hey, I will take you from BCM to do this [new job]’ - because of those other experiences that I gained from BCM work.

You see, a lot of people look at a BCM person, and straight away they categorize him into a nice little frame, and say that’s all he knows. But the reality [is that] a BCM person acquires certain skills and knowledge which are unique to such a role. One, communication: you’re communicating relatively complex ideas to a whole range of audiences, from the top guy to the bottom guy - the ability to articulate complex ideas in simple, layman’s terms. This is not something anyone can do.

You’re looking to react and think very fast in an incident, to generate [your] thoughts together, stay calm under fire and to make a decision. Or, if you’re not the person making the decision, [you must be] clear-headed enough to formulate a decision to the decision-maker.

To me these are skills which people tend to overlook in a BCM person, and think that BCM people only know BCM. But along the way, these are the skills the BCM person would have gained.

Selling, marketing. That’s a big role of a BCM guy. More than half the time, I find myself doing marketing, selling ideas, and trying to respond to bull…, people who do not understand, and yet, not offend them.

So, negotiator, marketer, communicator, planner, because a BCM person looks at the whole thing, the whole equation. Looks cross-functional, cross country…looks at sensitivities, cultural differences. He’s got to [understand] that Thais think about certain things, and what Indonesians think about. So as the group head, I am responsible to pick up all these skills and communicate to different people in different ways, in different cultures, different contexts.

If I minus off all the technical BCM stuff, let me tell you what the past 11 years has brought me. I can sit down on the same table with any good CEO, look them in the eye, and do a negotiation with them. Do you think anyone can do that? The BCM role gives you that.

Comment: Value to the organization

It is as hard to quantify the value of BCM experience as it is to quantify the value of a BCM programme. In cost-benefit analyses of BCM people and programmes, the ‘benefits’ are quantifiable only after the BCP is activated. If that never happens, or happens only rarely, the quantifiable value of the person managing the program is never, or rarely, evident.

It’s encouraging that the bank that hired this person for his BCM expertise found his management skills – “communicator, marketer, negotiator, planner” – to be just as valuable, and too valuable to let go. His ability to apply The BCI's Good Practice Guidelines management practices (Policy & Programme Management, Embedding) was as important as his ability to apply BCM technical practices (Analysis, Design, Implementation, Validation). That is, he’s valuable to his employer not because he knows what recovery time objectives are, but because he can bring people above and below him in the organization to consensus about them.

Interview: part two

Q: Why did you quit your BCM role?
A: A whole host of reasons. One from my own particular consideration was, ‘How much longer can I be on 24x7 standby? At what point do I say, ‘enough is enough?’ [When] I’ve been called at 03:00 a.m. in the morning three times in a month, it’s not funny. So that’s one angle.

The other angle was, for this role to be sustainable, you need the organizational structure and [management] role to support the [BCM] function. I may be in the position where I don’t get real-time information from the parties affected. The technology team may say, ‘Hey, don’t bother me, I’m busy right now.’ The operations team may say, ‘Get it done, call these guys.’ So my closest partners are the ones talking to me because they need me for information. Those that I need information from, they’re like,’ If you’re not here to help me, you stay away.’ So, it’s always a challenge.

I would say the organization within the company where [my] role was operating was not sustainable, [support was] definitely not provided. But it’s more the amount of empowerment, I would say, that this role had. [I] ended up being more of a postman [mailman] most of the time. It’s tiring because you’re not empowered to do the job well, but penalized for not doing the job well. That’s the part that killed me.

Q: In your 11 years of being in BCM, what percentage of the time did you feel this lack of empowerment, of being judged for not doing the job right?
A: I’d say a good fifty percent.

Q: Do you think that’s common?
A: The sense I get when I talk to people is they face similar constraints. So I believe it is not unique. We are surrounded by people who give us the impression that BCM is a necessary evil. ‘We’re doing this because’ - and no manager will come out and admit this – ‘but we are just doing this because the regulator says so.’ You’ve got to save face, but you know that’s what they’re thinking. They feel, ‘Yeah, come to me if it’s necessary’. Everyone knows that we should be doing this regardless of what the regulator says. But people who actually believe this are few and far between.

So over the years, especially the longer you do BCM, the longer you are exposed to such reality. I tell you, over the years you will be influenced. You will cease to believe in what you’re doing, and you will [only] be doing it because it’s a job. I think that lack of passion is very dangerous.

If you yourself as a BCM person stop believing in what you’re doing, how can you sell the skills and knowledge that BCM has given you ?

If you don’t believe in what you’re doing, you won’t be able to identify the positive strengths the job has given you. People tend to short-sell themselves, I feel, if they themselves don’t believe that what they’re doing is worth something.

I think that’s the biggest key here. People won’t be able to move on if they want to. A lot of people I speak to, some of them, are actually quite good at what they’re doing. They are just focusing on the physical, technical aspects of what BCM is all about. If you focus on that, people are not interested. But if you sell it as, ‘I am able to look at this picture, analyse it, and understand it and come back to you in very layman’s terms’...

Comment: The cost to his career

I’ve always thought that the primary task of a BCM professional is to bring the stakeholders in his or her organization to consensus – about risk, about impact, about strategies, about implementation budgets. It doesn’t so much matter what they agree on as it matters that they agree on anything. Only then will there be adequate resources to ensure that the selected strategies are implemented, exercises scheduled, plans updated. I just hadn’t imaged until now that bringing an organization to consensus could be so difficult, desultory and debilitating.

Not having organizational or managerial support is a problem, of course, but it is a problem everyone who practices BCM has experienced, and very few of them quit their jobs because of it. Or do they? Are attrition rates higher than it appears?

I’ve written in the past that the BCM profession is a dead-end. Since then I’ve concluded that BCM can’t be called a ‘profession’ if there’s no career path. This person quitting the job is evidence that it’s not a profession. It’s a white-collar practice. It can be an avocation, a calling, a practice, even a passion: but it’s never going to be a profession if it loses people like this.

The loss of experienced people is the single greatest risk to continuous improvement of an organization’s resilience, the fundamental objective of a BCM programme. It is a greater risk than the loss of their BCM knowledge. Anyone can learn the basics of BCM in a few weeks. Learning to apply BCM methodology - to fit the square pegs of good practice into the round holes of workplace reality - takes experience, judgment and judicious application of precisely the management skills this person has developed.

He is too well-compensated and will soon be too old to make many more career changes. Over time he’ll lose the passion unless he gets back into BCM full-time in, say, the next twelve months. The longer he’s out of BCM, the less likely his chances for a top BCM regional job in Asia at one of the bulge bracket banks. The guys now in those positions are only departing them on stretchers or in caskets.

On the other hand, he’ll sleep a better at night knowing his Blackberry isn’t going to ring at 3:00 a.m.

Interview: part three

Q: Would you go back to BCM?
A: Why not?

Q: What’s the attraction of BCM?
A: The excitement!

Q: The ‘lights and sirens’?
A: Sure. It takes a certain personality, I guess, to do BCM. I know people who can do BCM, they’re good at policies, they can think blue sky, strategy, but they never answer calls, they never respond to SMS. They’re never there when you call them.

You may do BCM theoretically, but to be a true BCM person, you need a lot more than just understanding the concepts. To a certain extent, it must become second nature.

I started my new role in November [2013]. Even now, I find myself paying attention to a lot of things that I picked up as a result of the BCM job. I look at the recent number of infections of H1N1 in Taiwan and straightaway in my mind I formulated what I would do, what we should be looking out for. I looked at the Jakarta flooding, and straightaway I ask my ex-colleagues, ‘Hey, how’s it going?’ They ask,’ Hey, you are still keeping track of all these things?’

I find myself reminding myself, ‘Hey, I’m a long way from that job.’

But even now when I get an SMS and I see an issue, straightaway my mind will [imagine] what the implications are, what it means, who’s impacted, stuff like that. I hope if I take long enough, all this will go away, but I doubt it!

Q: If someone said to you , ‘OK, I’ve got a BCM job’, how would you evaluate the offer?
A: If the person says I’m going to [pay] you 100% more to do the job you have been doing, it’s a no-brainer. But no one will do that anymore. So I will definitely look at the scope. To be very honest I will be quite attracted to a start-up role. Let’s do it all over again. Call me silly, but…

Q: What do you mean by a start-up role?
A: [A role] where I would really have a chance to revamp the program totally. That is what would excite me. If I’m going into a very mature organization, where everyone THINKS they have everything, then that’s probably not the organization for me because I will not be interested in just humming along - at least at this stage of my life now. Give me another 10 years, this could be a very different conversation. I’ll just hum along!

Q: A couple of years ago, physical security was added to your BCM portfolio, is that correct?
A: There were discussions to add it. It happened after I left.

Q: Did you want that?
A: Sure! It was interesting.

Just to follow up with the previous question, I think if someone came along with a BCM role with other portfolios added on to it - like physical security, like health & safety, even compliance - that would be interesting. I mean the convergence now is for BCM to be not just stand-alone, but to have other synergistic areas added to it. So could somebody come along and say, ‘Would you like to look at a combined role in physical security, information security, BCM?’ I’ll say it would still be possible. Or even human resources, for that matter.

Q: In your judgment, where should BCM report?
A: In my opinion, there is no one, right answer. It sounds like a cliché, but it’s true. I used to think that BCM should be in the risk area. In a way, the calibre of the people would be better to understand risk, the implications, the analysis part. Obviously, they’re strong. But when it comes to execution, they may not be the strongest bunch of people. This comes back to the point about the difference between a person who understands BCM and a person who actually does it.

Now contrast that with some BCM functions that reside in the technology and operations areas. On the flip side, these guys are good at execution, clockwork. May not be the best at analysis and all that, they probably have no time for that, they tend to just do and react and without giving it too much thought.

So if you ask me where should it be, it’s tough to find the right middle ground for it. Some organizations have it under compliance. Would that work, as well? Sure, at least from the theoretical analysis point of view, sure, they’ll be quite good at it. But execution, again, I’m not sure.

You see, BCM is all about execution. It’s the ability to execute that matters. During peacetime you can say all you want, nice theories, consideration of mitigating strategies. But when it comes to the crunch, it’s about how you execute which is important.

Q: When you were head of BCM, how many levels below the CEO were you?
A: Four.

Q: And the person who took over your job is now five levels below, is that correct?
A: Yes.

Q: That doesn’t sound like a company that valued BCM.
A: Well, I wouldn’t be able to conclude that because there [were] other considerations. I’m not sure if [changing the reporting] reflects the amount of value placed on the function. In fact the reverse could be true, right? Because enough thought was given to where it should be placed. Either way, the jury is out.

Q: Is there a consideration that you can tell me?
A: Sure. Again, it comes back to the previous question on where BCM should sit. Now BCM has come under risk management. We discussed and we felt, for those reasons I told you, there are synergies with BCM residing within the risk function. Previously, [BCM] was directly under the COO. But in the other [countries], it was under corporate real estate because [the BCM functions in those countries are] small. A one-man desk. So they were parked under real estate. Again, there are synergies.

Q: Like physical security?
A: No, physical security is [a separate] function. When asked my opinion, I said, look, currently the synergies are good because in those other countries most of the risks are physical, building-related. In Hong Kong they have typhoons, they have typhoons and earthquakes in Taiwan, in India [they have] floods. It’s building management that has the synergies.

But we felt that the building management guys know [nothing] about doing proper risk assessment. You know, when asked to stand in front of the CEO and communicate certain things, building managers are not exactly the best people.

Comment: The cost to his organization

Will this person’s replacement be sufficiently inquisitive, independent, to decide to skip the orthodoxy of impact and devote the company’s resources to scenario-based planning? You know there will come a moment when the lost experience will make some difference. We may never hear about it.

You could argue that his skills and experience can be replaced by those of someone else. Maybe, but that’s like believing that anyone can be President of the United States. In theory? Yes. In practice? The odds are about 320 million-to-one.

Will his replacement be mentally tough enough to withstand the dragging down from colleagues who don’t respect his BCM expertise?

Interview: part four

Q: After several IT-related incidents in a row, you completely changed your approach to BCM planning. What was the change in your approach?
A: Slight correction. It wasn’t a complete change. It was an addition.

Q: From what you told me, it was unorthodox. You won’t find it in any standard.
A: I’m still a very strong believer in impact-based planning. [It’s] definitely more economical to do that, and you can cover multiple scenarios. The problem is for scenarios [with] a higher likelihood of occurring again and again - say, ATM failure, or core banking system failure, or the SWIFT connection is down - those scenarios [don’t] happen once in 50 years. Those scenarios could happen every week. So for those scenarios, planning by impact, while it is good, does not really allow us to execute in a timely and precise manner.

When I plan for impact-based, the impact statement is ‘loss of systems’. So everyone [goes] about writing their work-arounds in a rather generic way. That’s impact-based planning, which is fine, but because the planning [is] by its very nature generic, when anything happens, obviously they [won’t have thought] of certain things, so we have to adapt. We have to take a step back, look at that plan, and think about it, which is time wasted.

In this current age of technology, system downtime of 15 minutes is unacceptable for customers. The amount of time we need to spend thinking in such a scenario is bad, which is why we started scenario-based planning.

We make the scenario-based plan as good as we can for all the key, critical functions affected by that system. We even nail down the system component that failed, so [our planning] is direct. And if it happens again, now we know for sure. Previously we had to do a conference call where we [would] get all operations in to get feedback. We’d say, ‘OK, how are you affected? What’s the volume you’re looking at? Are you able to even pay? etc.’ Now we know for sure if this system is down, I don’t have to call a conference call… I may still make a call, but for a different reason. I will already know there are five departments that are affected, I know how they are affected I know what cut-off times they should be shooting at for clients. That’s the beauty of scenario-based planning.

Q: But you can’t do that for every possible scenario…
A: Obviously.

Q: So you picked scenarios on the basis of what?
A: We started only for those systems that had failed before and [were] likely to fail again.

The other non-system scenario we have done is a haze scenario. We have gone through the historically highest PSI reading in Singapore, and we wrote a scenario-based plan that looked exactly like a re-enactment of what happened in 2013. So we know exactly at what time we are going to call compliance, at what time we are going to call MAS, exactly when we’re going to issue the first staff statement to reassure everybody, when am I going to send a truck over to my store room to retrieve all my masks. So that plan works like clockwork execution. And it’s all pegged to PSI readings. At a certain PSI reading we’re going to do this, at that reading we’re going to do that. Very specific.

Q: How many scenarios could you do?
A: Very difficult. For it to make sense, it cannot be 150 types. The [fewer] key scenarios you have, the better again you are at reacting and executing. So I would say anything more than 15 would be a lot. So those are the key ones.

Q: I don’t know anyone who’s done on a haze plan. Why did you do that?
A: It’s just based on lessons learned while it’s fresh…

Q: And we can reasonably assume it’s going to happen again.
A: Exactly. It’s going to happen again every year, year after year. [It already has.]

Comment: Lost value to the BCM community

I liked this part of the interview because it was a clear example of practical thought leadership that challenges what passes for ‘good practice’ in BCM. If ‘thought leadership’ doesn’t mean challenging conventional orthodoxy, I don’t know what it means. Genuine thought leadership is conspicuously missing from the global BCM training and certification bodies.

  • Here is an experienced BCM practitioner who has come to believe that impact-based planning is not enough, that scenario-based planning is the only way to execute like ‘clockwork’.
  • Here is a BCM practitioner who doesn’t believe that BCM should automatically report to a risk management function.
  • Here is a BCM practitioner who thinks BCM could be integrated with health & safety, compliance, even – the heresy! – with human resources.

This is a colleague I’ve known for many years who has mentored new BCM practitioners. He is a role-model. He once brought a table-full of his colleagues to a course I taught; he’s not stingy when it comes to training and education. He’s taught BCM courses himself. He’s been a leader in his country’s financial sector association. He is a spokesman for the practice of BCM there. Whether he recognizes it or not, he carries the aspirations of a whole generation of BCM professionals who want shots at the top BCM jobs in the region that are now held by expatriates. If anyone is going to get one of those positions, it will be this guy.

What’s the value of that kind of experience to the practice of BCM? Priceless.

The author

Nathaniel Forbes, MBCI, CBCP, is director of Forbes Calamity Prevention.

•Date: 27th March 2014 • Asia / World •Type: Article • Topic: BC general

Business Continuity Newsletter Sign up for Continuity Briefing, our weekly roundup of business continuity news. For news as it happens, subscribe to Continuity Central on Twitter.
   

How to advertise How to advertise on Continuity Central.

BCM software

BCM software

Phoenix

Business continuity software

The Business Continuity and Resiliency Journal