Developing Business Continuity Culture

Developing a "Business Continuity" culture within the Enterprise primarily consists of gradually changing attitudes, and for this, there are two strategies, raising awareness and training.

Developing the "Business Continuity" culture within the Enterprise:

- encourages the implementation of the BCM program (business continuity management),
- increases the responsiveness of staff if the Business Continuity Plan is activated,
- promotes the inclusion of Business Continuity in project studies where applicable,
- makes Business Continuity part of the criteria in the decision-making process at all levels,
- and therefore strengthens the resilience of the Enterprise.

Stage 1: Assessing the level of awareness

The level of awareness is difficult to assess, as it is constantly changing. An event, either internal or external to the entity, can reduce or increase the awareness level. "Business Continuity" culture and awareness develop gradually in line with the Enterprise's and individuals' increasingly mature approach.

1. Assessment of the level of awareness

Collecting information: To perform an assessment, information related to Business Continuity must be collected from the environment in question. This provides insight into the knowledge that staff can potentially gain concerning Business Continuity.

The existing Business Continuity documentation can give an overview of what is already available, demonstrating whether a dedicated process at least exists. The term "documentation" is understood in the broad sense (procedures, statements, leaflets, articles, etc.,) and this information may be from internal or external sources and may cover technical or regulatory aspects, etc.

Consideration of access to information: The assessment should cover access to information. Difficulty in accessing information may explain, in part, the reason for low awareness levels.

Consideration of lessons learned: Having to cope with an actual incident generally increases an individual's awareness of Business Continuity. He/she may be aware of the importance of the Business Continuity arrangements for the continuity or resumption of the activity.
On the other hand, he/she may have experienced difficulties due to a lack of appropriate support or training. Lessons learned during the day-to-day performance of the activity at different levels (department, entity managers, operational staff in charge of Business Continuity, and users of the Business Continuity arrangements) can also be used to assess the level of awareness.

2. Identification of requirements by target groups

Different personnel groups do not have the exact requirements and require different actions to be implemented.

Below are the initiatives to be carried out internally in order to raise awareness in the following target groups of internal stakeholders:

Senior management: governing committees and departmental management.

Entity managers: the operational management responsible for validating (1st level) the various stages of the process and responsible for the Business Continuity arrangements within its structure.

Staff responsible for implementing or controlling the Business Continuity Management (BCM) process (operational risks sector) or controlling it: These staff members participate in or control the implementation of all or part of the process. In particular, this includes operational risk staff and auditors responsible for overseeing the Business Continuity Management (BCM) process.

Staff using Business Continuity solutions: This target group includes staff who might use these solutions to resume their activities, either during tests or exercises or following an incident causing the actual activation of a Business Continuity Plan (BCP).

3. Definition of objectives

Based on the assessment's conclusions and the identified requirements, it is possible to set objectives (key subjects and priorities) to be attained in terms of increased awareness and training.

These are defined locally, at the level of a Core Business or Functional division, or overall, at the Enterprise level. When the objectives are determined locally, they must be coherent with global policies.

Stage 2: Raising awareness & training

This second stage aims to define the steps to be taken concerning each target and identify the most efficient methods.

Raising awareness can be increased through the provision of information. Examples of initiatives for improving access to information:

- - Reference external sites,
  - Reference publications,
  - Reference events,
  - Publish external articles,
  - Publish articles on initiatives or best practices used by certain entities.

Above and beyond the provision of information, staff awareness can also be increased through steps such as:

- - Including Business Continuity in the induction day courses for new arrivals and in "Welcome" packs.
  - Organizing staff visits to user's recovery sites.
  - Presenting trophies to promote Business Continuity oriented initiatives.
  - Organizing presentations during internal conferences.
  - Implementing a communication or poster campaign in strategic places.
  - Taking part in seminars dedicated to Business Continuity.

Training:

- - Have staff participate in internal training courses (The fundamentals of Business Continuity) as well as external courses, in forums or working groups with external Enterprises,
  - Follow an eLearning course,
  - And above all, take part in tests/exercises.

Key factors for success: An awareness campaign must communicate the Enterprise's priorities. The information communicated must include the Enterprise's Business Continuity policies or, more broadly, policies on operational risks.

The following points are considered factors for success:

- - ongoing, visible support of senior management, relayed by management at all levels,
  - allocation of the resources required to conduct the campaign,
  - consultation of some target personnel when developing the campaign,
  - consideration of other planned awareness-raising initiatives to avoid saturation,
  - maintenance of the training and awareness-raising effort over time (repetition principle).

Training courses must answer the needs of specific target groups, but some courses may be open to a broader audience.

The following points are considered factors for success:

- - training courses must be designed to take into account requirements identified at several levels;
  - aim must be defined;
  - training course, and the trainers must be assessed;
  - knowledge or abilities acquired during the course must be assessed;
  - training effort must be maintained over time.

Stage 3: Assessing cultural change

It is possible to assess the impact of an awareness campaign, but it is a challenging exercise because the rating can only be an approximation. Nevertheless, the assessment criteria must be defined in advance when the awareness campaign is designed. The assessment of the training course and the trainers is performed at the end of each session by each trainee.

Training campaigns can be assessed with indicators such as the ratio between the number of attendees to training and the number of targeted staff.

To determine the effects of an awareness campaign on the development of a "Business Continuity" culture, you can:

- - Request and collect feedback on the awareness-raising events and training courses (e.g., assessment questionnaire)
  - Ascertain the increase in traffic to a web page or website
  - Check the number of replies following the publication of an online quiz or questionnaire

Including objectives such as awareness initiatives and staff training in an entity's roadmap promotes improving the "Business Continuity" culture. Still, it is essential to consider that the success of the Business Continuity Management (BCM) process depends upon buy-in from management and each staff member.

Conclusion

It is essential to educate employees on the policies and procedures for Business Continuity to operate safely within the Enterprise. Awareness and training should consider the types of access and roles employees have. Without comprehensive education in the Business Continuity process, it will be a significant source of risk for the Enterprise. If the Business Continuity arrangements have been reviewed, it is necessary to revise the training supports and material as a consequence.

Developing Business Continuity Culture

Stage 1: Assessing the level of awareness

Stage 2: Raising awareness & training

Stage 3: Assessing cultural change

Conclusion

Comments (0)