|
Leaving business continuity By Nathaniel Forbes, MBCI, CBCP. Late in 2013 the head of BCM for one of Asia’s largest banks voluntarily transferred within his bank to a job entirely unrelated to BCM. He is the most-experienced, knowledgeable and highest-paid non-expatriate BCM professional I know in Asia. I wondered why anyone with eleven years of full-time BCM experience and a compensation package the envy of his peers would make such a move. He agreed to answer my questions on-the-record if I didn’t use his name or identify his employer. Interview: part one Q: How old are you? Q: What did you do before you did BCM? Q: Do you come from an IT background? Q: How did you get into BCM? I told them, ‘I’ll be honest. I had some experience in my previous bank, but I don’t really have experience.’ I wasn’t thinking about BCM at all. [The hiring manager] told me it was actually my other experience that interested him - my audit experience, my consulting experience: directly relevant to BCM. I will pick up BCM knowledge. But he was looking at the other skills that I had, which is why he was keen to have me on board. Now, fast forward 11 years [to 2013]. Those are the same reasons my new boss gave [for approving my internal transfer]: ‘Hey, I will take you from BCM to do this [new job]’ - because of those other experiences that I gained from BCM work. You see, a lot of people look at a BCM person, and straight away they categorize him into a nice little frame, and say that’s all he knows. But the reality [is that] a BCM person acquires certain skills and knowledge which are unique to such a role. One, communication: you’re communicating relatively complex ideas to a whole range of audiences, from the top guy to the bottom guy - the ability to articulate complex ideas in simple, layman’s terms. This is not something anyone can do. You’re looking to react and think very fast in an incident, to generate [your] thoughts together, stay calm under fire and to make a decision. Or, if you’re not the person making the decision, [you must be] clear-headed enough to formulate a decision to the decision-maker. To me these are skills which people tend to overlook in a BCM person, and think that BCM people only know BCM. But along the way, these are the skills the BCM person would have gained. Selling, marketing. That’s a big role of a BCM guy. More than half the time, I find myself doing marketing, selling ideas, and trying to respond to bull…, people who do not understand, and yet, not offend them. So, negotiator, marketer, communicator, planner, because a BCM person looks at the whole thing, the whole equation. Looks cross-functional, cross country…looks at sensitivities, cultural differences. He’s got to [understand] that Thais think about certain things, and what Indonesians think about. So as the group head, I am responsible to pick up all these skills and communicate to different people in different ways, in different cultures, different contexts. If I minus off all the technical BCM stuff, let me tell you what the past 11 years has brought me. I can sit down on the same table with any good CEO, look them in the eye, and do a negotiation with them. Do you think anyone can do that? The BCM role gives you that. Comment: Value to the organization It is as hard to quantify the value of BCM experience as it is to quantify the value of a BCM programme. In cost-benefit analyses of BCM people and programmes, the ‘benefits’ are quantifiable only after the BCP is activated. If that never happens, or happens only rarely, the quantifiable value of the person managing the program is never, or rarely, evident. It’s encouraging that the bank that hired this person for his BCM expertise found his management skills – “communicator, marketer, negotiator, planner” – to be just as valuable, and too valuable to let go. His ability to apply The BCI's Good Practice Guidelines management practices (Policy & Programme Management, Embedding) was as important as his ability to apply BCM technical practices (Analysis, Design, Implementation, Validation). That is, he’s valuable to his employer not because he knows what recovery time objectives are, but because he can bring people above and below him in the organization to consensus about them. Interview: part two Q: Why did you quit your BCM role? The other angle was, for this role to be sustainable, you need the organizational structure and [management] role to support the [BCM] function. I may be in the position where I don’t get real-time information from the parties affected. The technology team may say, ‘Hey, don’t bother me, I’m busy right now.’ The operations team may say, ‘Get it done, call these guys.’ So my closest partners are the ones talking to me because they need me for information. Those that I need information from, they’re like,’ If you’re not here to help me, you stay away.’ So, it’s always a challenge. I would say the organization within the company where [my] role was operating was not sustainable, [support was] definitely not provided. But it’s more the amount of empowerment, I would say, that this role had. [I] ended up being more of a postman [mailman] most of the time. It’s tiring because you’re not empowered to do the job well, but penalized for not doing the job well. That’s the part that killed me. Q: In your 11 years of being in BCM, what percentage of the time did you feel this lack of empowerment, of being judged for not doing the job right? Q: Do you think that’s common? So over the years, especially the longer you do BCM, the longer you are exposed to such reality. I tell you, over the years you will be influenced. You will cease to believe in what you’re doing, and you will [only] be doing it because it’s a job. I think that lack of passion is very dangerous. If you yourself as a BCM person stop believing in what you’re doing, how can you sell the skills and knowledge that BCM has given you ? If you don’t believe in what you’re doing, you won’t be able to identify the positive strengths the job has given you. People tend to short-sell themselves, I feel, if they themselves don’t believe that what they’re doing is worth something. I think that’s the biggest key here. People won’t be able to move on if they want to. A lot of people I speak to, some of them, are actually quite good at what they’re doing. They are just focusing on the physical, technical aspects of what BCM is all about. If you focus on that, people are not interested. But if you sell it as, ‘I am able to look at this picture, analyse it, and understand it and come back to you in very layman’s terms’... Comment: The cost to his career I’ve always thought that the primary task of a BCM professional is to bring the stakeholders in his or her organization to consensus – about risk, about impact, about strategies, about implementation budgets. It doesn’t so much matter what they agree on as it matters that they agree on anything. Only then will there be adequate resources to ensure that the selected strategies are implemented, exercises scheduled, plans updated. I just hadn’t imaged until now that bringing an organization to consensus could be so difficult, desultory and debilitating. Not having organizational or managerial support is a problem, of course, but it is a problem everyone who practices BCM has experienced, and very few of them quit their jobs because of it. Or do they? Are attrition rates higher than it appears? I’ve written in the past that the BCM profession is a dead-end. Since then I’ve concluded that BCM can’t be called a ‘profession’ if there’s no career path. This person quitting the job is evidence that it’s not a profession. It’s a white-collar practice. It can be an avocation, a calling, a practice, even a passion: but it’s never going to be a profession if it loses people like this. The loss of experienced people is the single greatest risk to continuous improvement of an organization’s resilience, the fundamental objective of a BCM programme. It is a greater risk than the loss of their BCM knowledge. Anyone can learn the basics of BCM in a few weeks. Learning to apply BCM methodology - to fit the square pegs of good practice into the round holes of workplace reality - takes experience, judgment and judicious application of precisely the management skills this person has developed. He is too well-compensated and will soon be too old to make many more career changes. Over time he’ll lose the passion unless he gets back into BCM full-time in, say, the next twelve months. The longer he’s out of BCM, the less likely his chances for a top BCM regional job in Asia at one of the bulge bracket banks. The guys now in those positions are only departing them on stretchers or in caskets. On the other hand, he’ll sleep a better at night knowing his Blackberry isn’t going to ring at 3:00 a.m. Interview: part three Q: Would you go back to BCM? Q: What’s the attraction of BCM? Q: The ‘lights and sirens’? You may do BCM theoretically, but to be a true BCM person, you need a lot more than just understanding the concepts. To a certain extent, it must become second nature. I started my new role in November [2013]. Even now, I find myself paying attention to a lot of things that I picked up as a result of the BCM job. I look at the recent number of infections of H1N1 in Taiwan and straightaway in my mind I formulated what I would do, what we should be looking out for. I looked at the Jakarta flooding, and straightaway I ask my ex-colleagues, ‘Hey, how’s it going?’ They ask,’ Hey, you are still keeping track of all these things?’ I find myself reminding myself, ‘Hey, I’m a long way from that job.’ But even now when I get an SMS and I see an issue, straightaway my mind will [imagine] what the implications are, what it means, who’s impacted, stuff like that. I hope if I take long enough, all this will go away, but I doubt it! Q: If someone said to you , ‘OK, I’ve got a BCM job’, how would you evaluate the offer? Q: What do you mean by a start-up role? Q: A couple of years ago, physical security was added to your BCM portfolio, is that correct? Q: Did you want that? Just to follow up with the previous question, I think if someone came along with a BCM role with other portfolios added on to it - like physical security, like health & safety, even compliance - that would be interesting. I mean the convergence now is for BCM to be not just stand-alone, but to have other synergistic areas added to it. So could somebody come along and say, ‘Would you like to look at a combined role in physical security, information security, BCM?’ I’ll say it would still be possible. Or even human resources, for that matter. Q: In your judgment, where should BCM report? Now contrast that with some BCM functions that reside in the technology and operations areas. On the flip side, these guys are good at execution, clockwork. May not be the best at analysis and all that, they probably have no time for that, they tend to just do and react and without giving it too much thought. So if you ask me where should it be, it’s tough to find the right middle ground for it. Some organizations have it under compliance. Would that work, as well? Sure, at least from the theoretical analysis point of view, sure, they’ll be quite good at it. But execution, again, I’m not sure. You see, BCM is all about execution. It’s the ability to execute that matters. During peacetime you can say all you want, nice theories, consideration of mitigating strategies. But when it comes to the crunch, it’s about how you execute which is important. Q: When you were head of BCM, how many levels below the CEO were you? Q: And the person who took over your job is now five levels below, is that correct? Q: That doesn’t sound like a company that valued BCM. Q: Is there a consideration that you can tell me? Q: Like physical security? But we felt that the building management guys know [nothing] about doing proper risk assessment. You know, when asked to stand in front of the CEO and communicate certain things, building managers are not exactly the best people. Comment: The cost to his organization Will this person’s replacement be sufficiently inquisitive, independent, to decide to skip the orthodoxy of impact and devote the company’s resources to scenario-based planning? You know there will come a moment when the lost experience will make some difference. We may never hear about it. You could argue that his skills and experience can be replaced by those of someone else. Maybe, but that’s like believing that anyone can be President of the United States. In theory? Yes. In practice? The odds are about 320 million-to-one. Will his replacement be mentally tough enough to withstand the dragging down from colleagues who don’t respect his BCM expertise? Interview: part four Q: After several IT-related incidents in a row, you completely changed your approach to BCM planning. What was the change in your approach? Q: From what you told me, it was unorthodox. You won’t find it in any standard. When I plan for impact-based, the impact statement is ‘loss of systems’. So everyone [goes] about writing their work-arounds in a rather generic way. That’s impact-based planning, which is fine, but because the planning [is] by its very nature generic, when anything happens, obviously they [won’t have thought] of certain things, so we have to adapt. We have to take a step back, look at that plan, and think about it, which is time wasted. In this current age of technology, system downtime of 15 minutes is unacceptable for customers. The amount of time we need to spend thinking in such a scenario is bad, which is why we started scenario-based planning. We make the scenario-based plan as good as we can for all the key, critical functions affected by that system. We even nail down the system component that failed, so [our planning] is direct. And if it happens again, now we know for sure. Previously we had to do a conference call where we [would] get all operations in to get feedback. We’d say, ‘OK, how are you affected? What’s the volume you’re looking at? Are you able to even pay? etc.’ Now we know for sure if this system is down, I don’t have to call a conference call… I may still make a call, but for a different reason. I will already know there are five departments that are affected, I know how they are affected I know what cut-off times they should be shooting at for clients. That’s the beauty of scenario-based planning. Q: But you can’t do that for every possible scenario… Q: So you picked scenarios on the basis of what? The other non-system scenario we have done is a haze scenario. We have gone through the historically highest PSI reading in Singapore, and we wrote a scenario-based plan that looked exactly like a re-enactment of what happened in 2013. So we know exactly at what time we are going to call compliance, at what time we are going to call MAS, exactly when we’re going to issue the first staff statement to reassure everybody, when am I going to send a truck over to my store room to retrieve all my masks. So that plan works like clockwork execution. And it’s all pegged to PSI readings. At a certain PSI reading we’re going to do this, at that reading we’re going to do that. Very specific. Q: How many scenarios could you do? Q: I don’t know anyone who’s done on a haze plan. Why did you do that? Q: And we can reasonably assume it’s going to happen again. Comment: Lost value to the BCM community I liked this part of the interview because it was a clear example of practical thought leadership that challenges what passes for ‘good practice’ in BCM. If ‘thought leadership’ doesn’t mean challenging conventional orthodoxy, I don’t know what it means. Genuine thought leadership is conspicuously missing from the global BCM training and certification bodies.
This is a colleague I’ve known for many years who has mentored new BCM practitioners. He is a role-model. He once brought a table-full of his colleagues to a course I taught; he’s not stingy when it comes to training and education. He’s taught BCM courses himself. He’s been a leader in his country’s financial sector association. He is a spokesman for the practice of BCM there. Whether he recognizes it or not, he carries the aspirations of a whole generation of BCM professionals who want shots at the top BCM jobs in the region that are now held by expatriates. If anyone is going to get one of those positions, it will be this guy. What’s the value of that kind of experience to the practice of BCM? Priceless. The author Nathaniel Forbes, MBCI, CBCP, is director of Forbes Calamity Prevention. •Date: 27th March 2014 • Asia / World •Type: Article • Topic: BC general
|
To submit news stories to Continuity Central, e-mail the editor. Want an RSS newsfeed for your website? Click here |
||||||||
WELCOME TO THE CONTINUITY CENTRAL ARCHIVE SITE Please note that this is a page from a previous version of Continuity Central and is no longer being updated. To see the latest business continuity news, jobs and information click here.
|
