Do You Need to Rescope Your Business Continuity Program? Using COVID-19 as a Driver to Re-engage Program Leadership
For a business continuity program to effectively protect your organization’s most important products and services, your program’s scope must align to organizational priorities. Often, programs are not scoped effectively, which leads to a host of program issues. This article discusses how and when to review and update your program’s scope, so you can focus on reducing organizational risk. Additionally, it will share ideas about how you can leverage COVID-19 to engage your organization’s leadership team and reassess your program’s scope.
Challenges From a Poorly Scoped Program
One of the biggest challenges I see working with organizations’ business continuity programs is they get “stuck in the status quo” – maintaining an outdated program scope despite significant changes within the organization.
An outdated program scope is a huge problem for your organization and it can lead to:
- Misalignment with your organization’s key priorities and strategy
- Too many or too few in-scope departments and plans
- Unrealistic recovery strategies
- Lack of program engagement
Does this sound like your organization?
In each of these cases, if the program is not set up to succeed you will likely experience challenges during business disruptions. Although these challenges can be painful during a live event (as many organizations have experienced recently with the COVID-19 pandemic), the event provides an opportunity to effectively rescope your program, including generating buy-in for rescoping efforts and identifying what should be included in your program scope.
Recently, I worked with a leading financial services organization that experienced scope-related issues during COVID-19. The overabundance of program-related documentation made it challenging to manage the program, which did not accurately reflect the organization. The organization had recently shrunk by 30%, and it was clear that several of its in-scope departments were not truly a priority during its COVID-19 response.
Because of these challenges, it was time to rescope the organization’s business continuity program. I worked with them to leverage the COVID-19 event and the recent restructuring to determine the right scope.
After rescoping, the organization quickly gained much needed buy-in from program participants. The organization aligned its program documentation to the updated scope, which significantly reduced the number of documents maintained and led to increased time devoted on the remaining, focused documentation.
If your business continuity program scope is outdated, here are a few tips to help you identify and maintain the right program scope to drive program engagement, strategic alignment, and ultimately, increase organizational resiliency.
Is Your Program Scope Outdated?
So how do you know if your program is poorly scoped? An outdated program scope typically has one of four indicators:
- Scope Review Not Included in Program Activities: This first indicator is a no-brainer. If you set your program scope a while back and have not came back to review it, chances are, your program scope is out of date.
- Lack of Executive Engagement: If executive leadership is not presently involved in your program, it may not be scoped appropriately. Without leadership input, business priorities and key products and services are often not kept in mind while developing and maintaining program documentation. When this occurs, departments that don’t need involvement are involved, and worse, departments that need involvement are not. This can lead to substantial issues when responding to a disruption.
- Departments Are Unaware of How Activities Support Program Scope: Department leaders need to understand how their department coincides with the rest of your organization’s recovery. Along with organizational leadership’s understanding of how the program aligns with strategic objectives, department leaders need to understand this, too. Without this knowledge, individuals don’t often see how department recovery activities fit into the overall organizational recovery. If program participants cannot effectively articulate how recovery works, your program may not be scoped appropriately.
- Lack of Focus (Boiling the Ocean): One of my peers likes to say that a program should not attempt to “boil the ocean.” By that, she means that trying to include everything in-scope. Often, this leads to complications with devoting needed time and resources to areas that truly matter – an issue of quantity over quality. If your program has an overabundance of documentation with little focus, or you find yourself frustrated with endless BIA reports and plans, your program may be over-scoped.
Identifying and Maintaining the Right Program Scope
At Avalution, we provide the following guidance for our current and potential clients looking to adjust the scope of their business continuity program. My colleagues and I have found that this guidance is well received and helps direct our clients forward. We offer it here for you as well.
During an annual review meeting or after significant organizational changes, ensure that leadership is aligned on the most important products and services, along with associated departments.
To lead this conversation effectively, discuss your program from a “top-down” perspective by first identifying key products and services before determining in-scope departments. From there, during the business impact analysis, your business continuity team should work with department leaders to tie department activities and required dependencies back to your organization’s key products and services.
Next, your organizational leadership team should be able to answer the following questions to help re-evaluate and determine your program scope:
1. Identify In-Scope Products and Services
During a rescoping meeting, your leadership team should review your organization’s key products and services, in-scope departments, and program participants.
Ask the leadership team:
- From an executive level, what are they key priorities for our organization? What products and services are essential to meeting these priorities?
- What is the impact if any of these products or services are unavailable?
- How long do you believe we could go without completing any of these products or services?
2. Map Departments to Products and Services
After reviewing and determining your key products and services — and maximum tolerable downtimes for each — determine which departments need to be considered in-scope for program to be successful. In-scope departments should align with your products and services. You will also need to establish business continuity strategies and plans to respond to disruptions.
Questions to consider:
- Which departments are critical to identified products and services success?
- Which departments are co-dependent on one another? In other words, if a department contributes to the success of the identified products and services, are there any other departments to consider as in-scope for the first department to operate?
- Which supporting departments (e.g. human resources, finance) should be included in-scope to support your organization’s people and processes?
3. Identify the Right People
Lastly, after identifying in-scope products and services and required departments, identify correct participants for each department. This will ensure you provide the correct level of detail for program documentation. Participants should be able to see the entire program picture, while also speaking to in-scope department specifics. Some questions to determine if individuals may be successful in a particular program role are (at Avalution, we call these the GWC questions!):
- Does the individual get what the program is meant to do?
- Does the individual want to be involved with the program?
- Does the individual have the capacity to be involved?
4. Align Program Documentation and Activities to Scope
At this point, your program should be appropriately scoped. From here, summarize results for leadership and begin to review and update your program documentation, starting with the business impact analysis.
During this process of working with newly scoped departments and department leadership, it is critical to keep in mind determined products and services. As a business continuity team member, be sure to tie activities and required resources for each department back to products and services.
To understand the relationship between resource dependencies, activities, and products and services, assign metrics to your program related to these products and services to ensure appropriate alignment. This will ensure that you successfully prioritize activities and dependencies and give them appropriate resources to recover in a timely manner to meet the timeframes set by leadership during the scoping discussion.
5. Re-Evaluate Program Scope (Ongoing)
There are three key times you should review your program and, potentially, rescope it:
- During an Annual Review: Business continuity best practices, namely ISO 22301, recommend organizations review program scope annually (and more often if your organization frequently changes). This ensures program reassessment on a regular interval.
- After Major Organizational Changes: If your organization has significant changes – whether an acquisition occurs, the organization downsizes, or a new product or service is introduced –re-evaluate your program. This will ensure your program is the right size and is focused on key priorities.
- After a Business Disruption: After a disruption occurs (coronavirus!), executives and program participants are typically highly engaged in response and can articulate what went well and what went poorly during recovery. At this time, engaging executive leadership to review the program’s scope – particularly which plans and strategies were effective, and which weren’t– is usually highly effective and leads to an engaged, detailed, and productive conversation.
Re-evaluating your program and scope after a disruption offers some unique benefits: executive leadership buy-in, a clear understanding of how well your program responded, and a list of activities prioritized during recovery. To evaluate program scope after a disruption, leadership should be able to answer these questions:
- During the disruption, what were our key priorities?
- Were there areas that had to be prioritized we had not been planned for in the past? If so, what were they?
- Which recovery strategies worked well, and which did not?
- Which departments were best equipped to recover and which had issues during recovery?
- Was it clear who needed to lead recovery at both an organization-wide and department level? Were these individuals documented within program documentation?
These questions help ensure that you can add or remove key areas – products and services, departments, activities, and dependencies that may have been overlooked or over planned for in the past — from scope. Additionally, these questions help leadership align on key priorities for your organization.
After reviewing the scope with leadership, share conversation outcomes: key products and services, in-scope departments, and program participants, and update program documentation and activities to align to your revised program scope.
A well-scoped business continuity program ensures your participants are engaged, your organization can recover key activities within required timeframes, and that you can mitigate organizational risk.
Unfortunately, if your organization sets a scope for their program and fails to reassess it, your program may:
- Become either too small or too large for your organization
- Lose focus and engagement
- Become outdated and unusable.
Where there are multiple indicators and times that should drive your organization to re-evaluate your business continuity program’s scope, there is no better time than right now.
Most organizations worldwide have dealt with significant organizational changes during the past months, while responding to a variety of impacts caused by COVID-19. Organizations had to change business models, update policies and procedures, shift to new suppliers, leverage new applications, and send employees home to work. There has never been a time where this much change occurred so rapidly and at such a large scale.
As such, you are missing out if you don’t take time to complete an after/mid-action review to understand COVID-19 impacts on your business continuity program and to appropriately update your programs’ scope.
To do this, here are three simple steps:
- Schedule a meeting with your organization’s leadership team.
- Leverage an after-action review agenda template and guide (Avalution Consulting has one for free on its website) to determine key products and services, in-scope departments, and areas that went well during response.
- Begin to update your program’s documentation (namely, its business impact analysis and plans) based on revised scope.
By taking he time to re-evaluate your scope, you will be much better prepared to respond to future disruptions that impact your organization.
About the author
Consultant, Avalution ConsultingPatrick has consulted for both small and large organizations throughout a variety of industries. Patrick specializes in developing effective and efficient solutions based on an organization’s unique needs. Patrick has supported the development, implementation, and maintenance of business continuity, crisis management, and IT disaster recovery programs. Patrick has a proven record of assessing program effectiveness and organizational issues in order to help determine strategic recommendations.