Practical advice on business continuity training and awareness raising

Mel Gosling, FBCI, sets out how business continuity managers should go about planning and executing a business continuity training and awareness campaign.

The objective of the business continuity management (BCM) process is to improve an organization’s business continuity capability over a period of time. The process is initially implemented using project management techniques, and as it matures over the years, this gives way to an annual programme of work.

In both the initial implementation and the ongoing programme, BCM involves undertaking a range of activities, and these activities are undertaken by people. If the BCM process is to be successful, these activities need to be undertaken by people who have the right level of knowledge and skills.

A common cause of failure to implement BCM successfully is a lack of people with the right level of knowledge and skills, and the purpose of planning and delivering a business continuity training and awareness campaign is to avoid that pitfall. The aim therefore, is ensure that everyone has the business continuity knowledge and skills required to undertake their role in the process.

In terms of identifying the business continuity knowledge and skills required, people can be divided into two broad groups:

• All staff – who should have an awareness of the BCM programme and their role in it
• Individuals with specific roles within the BCM programme – who should have the appropriate competence in the skills needed to undertake their assigned tasks.

Typical business continuity tasks

The place to start in planning a business continuity training and awareness campaign is to identify the business continuity tasks that need to be undertaken. The following ten tasks are fairly typical of those that most organizations will need to undertake when implementing BCM, but these will vary from one organization to another.

• Monitor a BCM programme
• Manage a BCM programme
• Undertake a BIA
• Design business continuity solutions
• Develop business continuity plans
• Respond to an incident
• Use business continuity plans
• Maintain business continuity plans
• Exercise business continuity plans
• Review the BCM programme.

Expertise

In attempting to define the level of knowledge and skills required by someone to undertake a business continuity task, I have found it useful to identify four categories:

• None – no expertise is required
• Awareness  – being aware of the expertise
• Understanding – having an understanding of the expertise
• Skill – being able to use the expertise.

A simple analogy would be the game of cricket, where the four categories would be:

• None – someone who knows nothing about cricket
• Awareness  – someone who is aware that cricket exists
• Understanding – someone who understands how cricket is played
• Skill – someone who is able to play cricket.

Of course, within each category there is a wide range of ability. Someone who understands how cricket is played wouldn’t necessarily know all the rules, and might not be able to keep score correctly. Similarly, someone who plays cricket for their local village team would not have the same skills as someone who plays cricket for England.

The training and awareness campaign process

The process of ensuring that everyone involved in the BCM process has the right level of knowledge and skills is, as with most business continuity processes, a simple one:

• Identify requirements – identify the business continuity roles and expertise required for each role
• Identify current situation – identify the existing business continuity expertise for those undertaking the roles
• Design – design a campaign to raise expertise to that required
• Delivery – plan and deliver the campaign
• Review – monitor the effectiveness of the campaign.

The output from the final stage of the process, ‘review’, leads back into the first stage, ‘identify requirements’, to enable the process to begin again with the object of continuously improving business continuity knowledge and skills.

Roles

Roles and responsibilities for business continuity vary from one organization to another, but the following four roles can be found in many organizations:

• Overall responsibility for BCM
• Usually someone from the top executive
• Management of the BCM process
• Business continuity manager
• Incident response: managing and undertaking recovery
• Members of response and recovery teams
• The people who use the business continuity plans
• Local business continuity representatives
• Business continuity coordinators.

Requirements

In order to identify the requirements for a business continuity training and awareness campaign, the roles, tasks, and expertise need to be combined to show the expertise required to undertake the tasks for each role. An example of this is shown in the following table, using the levels of expertise, business continuity tasks, and roles identified above.

These requirements will vary from one organization to another, but I’ve found that using a table similar to the above to be an essential starting point when planning a business continuity training and awareness campaign. It clearly shows the expertise that is required to undertake each business continuity role.

Current situation

Identifying the existing business continuity expertise for those undertaking the business continuity roles is notoriously difficult, and many organizations take the easy way out when they first plan a business continuity training and awareness campaign. This is to assume that nobody has any expertise.
However, if you don’t want to take this easy way out, there are a number of things that can be done to identify existing business continuity expertise, which can assist in designing a more focussed campaign. These include:

• Examining staff training records
• Looking at previous business continuity training and awareness campaigns and who was involved (be careful though, because these previous campaigns may be quite old and have delivered out of date training and awareness)
• Surveys
• Observation.

Design

By comparing the existing business continuity expertise to that required, gaps that need to be bridged by the business continuity training and awareness campaign can be identified. The campaign can then be designed by:

• Identifying the most appropriate approach to bridge the gaps
• Awareness
• Education (understanding)
• Training (skills)
• Mentoring (skills - practical)
• Identifying the audiences
• Choosing the most appropriate means for each audience
• Designing or selecting the events, materials, and messages

Examples of these approaches include:

• Awareness
• Posters
• Videos
• Quizzes
• Business continuity Intranet site
• Visits to recovery sites
• Education
• Documents
• Presentations
• Reports
• Training
• Business continuity courses (in-house or public)
• E-learning
• Exercises
• Mentoring
• Use an expert to show staff how to undertake a business continuity task.

Whatever approach is chosen, though, you need to make sure that the method of delivery suits the audience. Get this wrong, and people will switch off, making whatever you doing a waste of time. For example, if your audience is made up of predominantly young people who left school early and had little or no higher education, then don’t choose to deliver your message in a long and detailed document that has all the complexity of a leader article in The Times.

Planning the campaign

The success of the campaign will be dependent on how well it’s planned. If people aren’t available to attend the events that you’ve planned for them, they won’t attend. And if they don’t attend, their level of expertise will not be raised to that required for them to undertake their role.
When planning your campaign, you need to remember:

• People need time to attend events and learn
• They usually have a ‘day job’
• Your campaign needs to fit in with business priorities
• Not BCM priorities
• Be aware of other campaigns (Health & Safety, Security, etc.)
• Coordination is essential
• Don’t overload people.

Also, when planning the business continuity work that needs to be undertaken when implementing BCM, remember that people need the expertise before they undertake the role. In other words, training and awareness comes first, not as an afterthought.

Delivering the campaign

Delivering the business continuity training and awareness campaign should be relatively straightforward if it’s been well designed and planned, but to achieve success you should:

• Hold the events as planned
• Unless other business priorities intervene
• Record and monitor attendance
• Keep training records
• Obtain feedback from participants
• Were the aims and objectives achieved?
• Could it be improved in any way?

Monitoring the effectiveness of the campaign

The final stage of the process is to monitor the effectiveness of the campaign. This will involve asking the following questions:

• Have the required levels of expertise been achieved?
• For every role?
• Has anyone been missed out?
• Have the requirements changed?

The results should then be used to re-start the process, so implementing a cycle of continuous improvement for business continuity training and awareness.

Theory and practice

The theory is quite straightforward, but in practice things rarely turn out as well as you hoped they would.

The first thing to understand is that business continuity is not everybody’s immediate priority, except perhaps, for the business continuity manager. Other people have day to day business priorities, and with the best will in the world these will end up by taking precedence over business continuity awareness and training. As a result, you’ll find that people cancel their attendance at events at short notice, or even leave part way through.

When combined with the fact that people and roles will keep changing, you’ll find that you’ll never be able to get to the point where everyone has the right level of knowledge and skills to undertake the business continuity work required of them – something will always stop this happening. It is therefore a continuous process that you need to keep implementing to try and get closer to your goal without ever managing to reach it.

You also need to be careful about using the term ‘campaign’ publicly. The idea of a campaign is that it is a once off event, which gives entirely the wrong impression. BCM is a continuous process, and so is business continuity awareness and training.
Campaign is a misnomer, it’s really an annual training and awareness plan that you’re planning and delivering. It should be an integral part of your BCM plan for the coming year.

The author

Mel Gosling is the founder and managing director of Merrycon Ltd, which has been providing Business Continuity services for14 years, and is a Fellow of the BCI. www.merrycon.com Contact Mel at merrycon@gmail.com