How to choose a business continuity consultant

On 8th September 2006 we launched our business continuity Wiki, to enable the development of collaborative documents. The first article is now complete and provides advice on how to decide whether an external business continuity consultant would be a useful resource to aid your company’s BCM program and, if so, how to go about choosing one:

The first step when deciding whether to use a consultant to facilitate the development of a business continuity plan is to assess the resources that your company has in-house by answering the following questions:

Is there a member of staff who already has the necessary skills? If so, are you sure that his/her knowledge is up to date and broad enough to develop a fully rounded business continuity plan? Will that person have enough time available to devote him/herself to developing the plan? Will he/she be able to gain the necessary cooperation of senior managers when researching the information needed? What software resources, if any, will that person need to help write the plan? What budget will the company make available for refresher training, attendance at conferences, relevant books, templates and any software?

Is there a member of staff who, although not completely 'up to speed' with business continuity management, could be trained in the necessary skills? How much training will they need? What areas of expertise does he/she lack? How much budget can you make available and how will the cost of training compare with that of using a consultant? How long will it take before he/she is in a position to start the planning process? How will you verify that the training that is provided is adequate for the person's needs? How will the business continuity plan be quality controlled, reviewed and audited?

Is there a member of staff who, although not capable of fully developing a business continuity plan, could work with an external consultant to minimise the amount of consultancy time needed? Could a consultant be used for the more complex areas of the planning process and for quality control to supplement your in-house resources?

You may choose to use a consultant to bring a third party external perspective to the debate or project. Even if you have some skills and expertise available in-house the person/people may not necessarily be as up to date in thinking or technology skills as a consultant that specialises in this area should be. Or in-house staff may not feel able to challenge accepted internal views, opinions and the status quo.

Once you have a feel for your in-house resources you are in a position to weigh up how much external consultancy support you will need. The following areas should be considered:

Cost
The cost of the project will depend, to a large extent, on its scope. Business continuity projects are particularly open to ‘scope creep’. Having a clear, unambiguous definition of the scope of the project and clear specifications for deliverables is critical. Consultancy fees will vary depending on the experience of the consultant and the current demand for their services. Different consultants will also spend varying amounts of time on a project. The best advice is to obtain quotations from a handful of consultants and insist that timescales are included in the quotation.

When developing requests for proposals (RFPs) provide guidance to the consultant if there are severe budget constraints so that they can focus their response.

Identify whether you require the consultant to do the whole job with your input, or whether you want skills transfer and will be providing resource to help.

Compare the consultants' quotations with the cost of your in-house resources - including software, equipment, training and time.

Timescales
Having identified the need for a business continuity plan or the updating of an existing plan, you will also be aware of the need to act quickly to reduce the company's exposure to business risks. Timescales are therefore important. Assess whether it is worth paying extra for a highly experienced consultant who will be able to do the job quickly. Ask for references from previous projects and pay attention to whether these were completed on time. Do not impose tight timescales if you, the client, cannot meet them yourself in terms of document review, decision-making, availability of personnel for interviews or lead-time for testing.

Quality
This is a vital aspect. How confident are you in the quality of plan that could be produced in-house? Consultants usually bring with them a wider experience of business continuity planning. They have seen what is necessary in businesses similar to your own, they have created plans, tested plans, seen plans invoked. Consultants should be well-versed in best practice, and their own business will stand or fall on the quality of the plans that they produce for their clients. Do you wish to follow formal standards?

Again if you decide to go down the consultancy route, take up references from previous clients: were they happy with the quality of work and the business continuity plan produced?

Next steps
If, having gone through the above process, you decide to use a business continuity consultant the next question to address is how to choose the right consultant for your business needs.

The Business Continuity Institute's guidance on choosing a consultant starts with the following warning: "Anyone can have stationery and business cards printed showing that he purports to be a "consultant". So caveat emptor -establish essential criteria to match the person/consultancy with the task and be prepared to probe the references and qualifications presented. Your time and money will be wasted if a consultant is engaged who subsequently proves to be inadequate."

The Institute offers the following checklist of considerations:
a) Qualifications - these must be relevant to the task,
b) Experience - preferably in identical or similar tasks to those they will carry out for your business, and of the national culture and geographic region
c) Personality - will he/she be acceptable to the workforce or will he/she antagonise them?
d) Presentation skills - written and oral.
e) Financial integrity - does he/she hold professional indemnity insurance?
Consultancy companies should be prepared to:

- Make a presentation and/or a submission describing their approach to the task,
- Provide a quotation for the project,
- Allow you to meet the individual who will be responsible for the project
- Produce a formal proposal, identifying project milestones, review stages and defining the deliverables.
- Clarify the terms of payment.
- Make a service level agreement.
- Sign a contract.

Additional comments not written into the above article were as follows:

General comments from John Glenn:

Your work starts off with a supposition - which I suspect is false - that the organization:
(a) Knows what business continuity (vs. DR) is all about
(b) Knows what attributes the BC planner (internal and external) should possess. I concur that the BC Sponsor (who we will task with finding a planner) should look for an internal person with BC knowledge beyond being able to spell BIZ-NES Kon-tin-nu-ity. (We had an experienced planner at a place I once worked; he was ignored - to the detriment of the employer).If the staffer has some experience or potential, that's the time to contract with a planner/mentor or, as a poor second, send the planner candidate off to school. I would suggest that in addition to the above, the sponsor should consider the size and complexity of the business continuity programme - if small and an admin assistant or similar can maintain it, hire a consultant to come in, do the work, and go away. There won't be enough follow-on work to keep a professional planner busy or to justify the planner's cost (compensation, overhead).

I suspect that most planners in the Colonies do NOT carry indemnity insurance. This is, I think, more common in the UK and maybe in the EU. (I do know one planner who carries insurance; he is - as far as I know - the exception rather than the rule.)

Two words about alphabet soup (*BCI, *BCP, etc.): Eye Candy. I know planners lacking certification who are excellent planners. I know planners who have certification who can't plan their way home at night, and I think I know a planner who just made up her certification.

General comments from Ray Liepa:

Linked to all the above comments is the question of what methodology you going to use, and against what standards? For example: Is the BCI GPG Good Practice Guidelines or the British Standard BS 25999 to be used as a standard, and if so then has the consultant under consideration a satisfactory experience level in all the business continuity stages (i.e. through the whole BCM lifecycle)?

Although you may only want a consultant to develop and complete BCM work for you in one of the stages, it does in reality link to the next stage, and quite likely from the previous stage too. Experience is paramount, based on using a known and acceptable (to you) standard and methodology. I won't go into products, but if, as an organisation you already have a substantial investment in ‘product A’, then it would surely be a benefit to you if the consultant also had experience with product A, so this might become a consideration too (but not necessarily a prerequisite).

However - back to experience (and hopefully supported by a suitable certification from the BCI or DRII), I am often flabbergasted by the simple and basic questions that appear from the discussbusinesscontinuity Yahoo Group (http://finance.groups.yahoo.com/group/discussbusinesscontinuity/). It shows in many cases that persons have been employed (and heaven forbid that some of these might be ‘consultants’) with close to zero understanding of the BCM lifecycle / standards, and very little, if any, genuine BCM experience. Thoughts on choosing a consultant can go on and on, but as my final comment here; is the consultant expected to work alone or in a team - and have they done that successfully before? It makes a huge difference if someone has had BCM experience in a team, and then suddenly has to work alone for a year doing all the job functions / research / documentation / presentations / negotiating etc. that was shared before - so are they up to it? Here we touch on all the human factor issues such as personality, motivation, handling pressure, goal setting, managing one's own time etc etc, so my closing comment has to be: consider all the requirements and factors for the position from both the human side and from the organisational side before making a final decision.

This article will remain live on the Business Continuity Wiki: see http://businesscontinuity.wikispaces.com/Choosing_a_Consultant If any significant additions are made an updated article will be published to replace the one you have been reading.

•Date: 22nd Sept 2006 • Region: World • Type: Article •Topic: BC general
Rate this article or make a comment - click here