Quality control and measurement of business continuity management systems: final survey results
- Published: Friday, 02 January 2015 15:36
In 2013 Continuity Central conducted a survey to explore quality control methods that are being used within business continuity management systems. This survey has now been repeated to see how the trends in this area have changed.
The 2014 Quality control and measurement of business continuity management systems survey was conducted online using SurveyMonkey and received 142 responses in total. 84.5 percent of respondents were from large organizations (those with more than 250 employees). Respondents came from around the world, with the most coming from the US (34 percent), the UK (25 percent) and Australia (6 percent).
The survey initially asked “Does your organization have clear processes or methods for the quality control of business continuity plans and systems?” 66.9 percent of respondents said that, yes, their organization did have clear processes or methods; while 29.6 percent said no their organization didn’t. This was a very similar result to the 2013 survey, where 64.9 percent answered ‘yes’ and 30.2 percent answered ‘no.’
Of those who said that their organization did not have clear processes or methods for the quality control of business continuity plans and systems the top reasons given were:
- We are still developing our first business continuity plan: 29.3 percent (30 percent)
- It is not required or necessary: 22 percent (18.6 percent)
- It is too complex to carry out: 22 percent (20 percent)
- It is too expensive to carry out: 22 percent (7.1 percent)
The results from the same question in the 2013 survey are in brackets. The only significant difference is that the number of respondents stating that it is the expense of the process which is holding them back from using business continuity quality control methods was much higher in 2014: more than three times as many people gave this as a reason in the 2014 survey compared to the 2013 survey.
Respondents whose organization did undertake business continuity quality control were asked to list the quality processes and methods that are in place. The responses were as follows, again with 2013 responses in brackets:
- Auditing by an internal audit process: 81.5 percent (82.8 percent)
- Align to a business continuity standard: 77.2 percent (75.8 percent)
- Defined Key Performance Indicators which we monitor and measure: 54.3 percent (57.8 percent)
- Auditing by an external audit process: 44.6 percent (47.7 percent)
- Benchmark against a Maturity Model: 27.2 percent (25.8 percent)
- Benchmark against industry peers (e.g other companies in the same industry sector): 25.0 percent (25.0 percent)
- Formal certification to a business continuity standard: 19.6 percent (19.5 percent.)
The 2014 and 2013 responses were remarkably similar, indicating that there has been very little change in the way organizations carry out business continuity quality control.
New questions asked in the 2014 survey but not in the 2013 one were:
Have you a method of measuring improvements / changes in your BCMS over time?
57.56 percent of respondents said that ‘yes’ they did have a method of measuring improvements / changes in your BCMS over time. 41.52 percent said ‘no’, they did not.
What do you regularly measure and report on in BCM:
The responses in order of popularity were:
- Completion and success of tests and exercises: 68.0 percent
- Incident response performance: 55.3 percent
- Completion and currency of maintenance tasks: 48.5 percent
- Coverage against scope and objectives: 46.6 percent
- Completion and success of awareness activities: 46.6 percent
- Operational performance and readiness: 43.7 percent
- Delivery and implementation programmes: 42.7 percent
- Organizational resilience: 25.2 percent
- Improvement performance: 23.3 percent
- Leadership performance: 19.4 percent
- People performance: 17.5 percent
- Management system performance: 15.5 percent
- Financial performance: 10.7 percent
What kinds of measurement system does the organization use for BCM activities?
- Mostly quantified: 12.5 percent
- Mostly qualitative: 26.0 percent
- An about-equal mix of the two: 47.1 percent
- None: 11.54 percent
How many key performance indicators are there for BCM?
- Less than five: 49.0 percent
- More than five: 26.9 percent
- None: 21.2 percent
Given the means, how would you change measurement of BCM in your organization?
- It’s fine, leave it as it is: 15.24 percent
- Measure more so we know where to focus: 30.5 percent
- Measure less, it’s a burden for us: 2.9 percent
- Measure differently so we get more value from it: 44.76 percent.