Practical advice on business continuity training and awareness raising

Published: Wednesday, 30 September 2015 08:17

Mel Gosling, FBCI, sets out how business continuity managers should go about planning and executing a business continuity training and awareness campaign.

The objective of the business continuity management (BCM) process is to improve an organization’s business continuity capability over a period of time. The process is initially implemented using project management techniques, and as it matures over the years, this gives way to an annual programme of work.

In both the initial implementation and the ongoing programme, BCM involves undertaking a range of activities, and these activities are undertaken by people. If the BCM process is to be successful, these activities need to be undertaken by people who have the right level of knowledge and skills.

A common cause of failure to implement BCM successfully is a lack of people with the right level of knowledge and skills, and the purpose of planning and delivering a business continuity training and awareness campaign is to avoid that pitfall. The aim therefore, is ensure that everyone has the business continuity knowledge and skills required to undertake their role in the process.

In terms of identifying the business continuity knowledge and skills required, people can be divided into two broad groups:

All staff – who should have an awareness of the BCM programme and their role in it
Individuals with specific roles within the BCM programme – who should have the appropriate competence in the skills needed to undertake their assigned tasks.

Typical business continuity tasks

The place to start in planning a business continuity training and awareness campaign is to identify the business continuity tasks that need to be undertaken. The following ten tasks are fairly typical of those that most organizations will need to undertake when implementing BCM, but these will vary from one organization to another.

Monitor a BCM programme
Manage a BCM programme
Undertake a BIA
Design business continuity solutions
Develop business continuity plans
Respond to an incident
Use business continuity plans
Maintain business continuity plans
Exercise business continuity plans
Review the BCM programme.

Expertise

In attempting to define the level of knowledge and skills required by someone to undertake a business continuity task, I have found it useful to identify four categories:

None – no expertise is required
Awareness – being aware of the expertise
Understanding – having an understanding of the expertise
Skill – being able to use the expertise.

A simple analogy would be the game of cricket, where the four categories would be:

None – someone who knows nothing about cricket
Awareness – someone who is aware that cricket exists
Understanding – someone who understands how cricket is played
Skill – someone who is able to play cricket.

Of course, within each category there is a wide range of ability. Someone who understands how cricket is played wouldn’t necessarily know all the rules, and might not be able to keep score correctly. Similarly, someone who plays cricket for their local village team would not have the same skills as someone who plays cricket for England.

The training and awareness campaign process

The process of ensuring that everyone involved in the BCM process has the right level of knowledge and skills is, as with most business continuity processes, a simple one:

Identify requirements – identify the business continuity roles and expertise required for each role
Identify current situation – identify the existing business continuity expertise for those undertaking the roles
Design – design a campaign to raise expertise to that required
Delivery – plan and deliver the campaign
Review – monitor the effectiveness of the campaign.

The output from the final stage of the process, ‘review’, leads back into the first stage, ‘identify requirements’, to enable the process to begin again with the object of continuously improving business continuity knowledge and skills.

Roles

Roles and responsibilities for business continuity vary from one organization to another, but the following four roles can be found in many organizations:

Overall responsibility for BCM
- Usually someone from the top executive
Management of the BCM process
- Business continuity manager
Incident response: managing and undertaking recovery
- Members of response and recovery teams
- The people who use the business continuity plans
Local business continuity representatives
- Business continuity coordinators.

Requirements

In order to identify the requirements for a business continuity training and awareness campaign, the roles, tasks, and expertise need to be combined to show the expertise required to undertake the tasks for each role. An example of this is shown in the following table, using the levels of expertise, business continuity tasks, and roles identified above.

	Executive	BC Manager	Responder	BC Coordinator	All staff
Monitor BCM Programme	Skill	Understanding	None	Awareness	None
Manage BCM Programme	Understanding	Skill	None	Awareness	Awareness
Undertake BIA	Understanding	Skill	Understanding	Skill	None
Design BC solutions	Understanding	Skill	Understanding	Awareness	None
Develop BC plans	Understanding	Skill	Understanding	Understanding	None
Respond to incident	Skill	Skill	Skill	Understanding	Understanding
Use BC plans	Skill	Skill	Skill	Understanding	None
Maintain BC plans	Understanding	Skill	Understanding	Skill	None
Exercise BC plans	Understanding	Skill	Understanding	Understanding	None
Review BCM programme	Skill	Understanding	None	Awareness	None

These requirements will vary from one organization to another, but I’ve found that using a table similar to the above to be an essential starting point when planning a business continuity training and awareness campaign. It clearly shows the expertise that is required to undertake each business continuity role.

Current situation

Identifying the existing business continuity expertise for those undertaking the business continuity roles is notoriously difficult, and many organizations take the easy way out when they first plan a business continuity training and awareness campaign. This is to assume that nobody has any expertise.
However, if you don’t want to take this easy way out, there are a number of things that can be done to identify existing business continuity expertise, which can assist in designing a more focussed campaign. These include:

Examining staff training records
Looking at previous business continuity training and awareness campaigns and who was involved (be careful though, because these previous campaigns may be quite old and have delivered out of date training and awareness)
Surveys
Observation.

Design

By comparing the existing business continuity expertise to that required, gaps that need to be bridged by the business continuity training and awareness campaign can be identified. The campaign can then be designed by:

Identifying the most appropriate approach to bridge the gaps
- Awareness
- Education (understanding)
- Training (skills)
- Mentoring (skills – practical)
Identifying the audiences
- Choosing the most appropriate means for each audience
Designing or selecting the events, materials, and messages

Examples of these approaches include:

Awareness
- Posters
- Videos
- Quizzes
- Business continuity Intranet site
- Visits to recovery sites
Education
- Documents
- Presentations
- Reports
Training
- Business continuity courses (in-house or public)
- E-learning
- Exercises
Mentoring
- Use an expert to show staff how to undertake a business continuity task.

Whatever approach is chosen, though, you need to make sure that the method of delivery suits the audience. Get this wrong, and people will switch off, making whatever you doing a waste of time. For example, if your audience is made up of predominantly young people who left school early and had little or no higher education, then don’t choose to deliver your message in a long and detailed document that has all the complexity of a leader article in The Times.

Planning the campaign

The success of the campaign will be dependent on how well it’s planned. If people aren’t available to attend the events that you’ve planned for them, they won’t attend. And if they don’t attend, their level of expertise will not be raised to that required for them to undertake their role.
When planning your campaign, you need to remember:

People need time to attend events and learn
- They usually have a ‘day job’
Your campaign needs to fit in with business priorities
- Not BCM priorities
Be aware of other campaigns (Health & Safety, Security, etc.)
- Coordination is essential
- Don’t overload people.

Also, when planning the business continuity work that needs to be undertaken when implementing BCM, remember that people need the expertise before they undertake the role. In other words, training and awareness comes first, not as an afterthought.

Delivering the campaign

Delivering the business continuity training and awareness campaign should be relatively straightforward if it’s been well designed and planned, but to achieve success you should:

Hold the events as planned
- Unless other business priorities intervene
Record and monitor attendance
- Keep training records
Obtain feedback from participants
- Were the aims and objectives achieved?
- Could it be improved in any way?

Monitoring the effectiveness of the campaign

The final stage of the process is to monitor the effectiveness of the campaign. This will involve asking the following questions:

Have the required levels of expertise been achieved?
- For every role?
Has anyone been missed out?
Have the requirements changed?

The results should then be used to re-start the process, so implementing a cycle of continuous improvement for business continuity training and awareness.

Theory and practice

The theory is quite straightforward, but in practice things rarely turn out as well as you hoped they would.

The first thing to understand is that business continuity is not everybody’s immediate priority, except perhaps, for the business continuity manager. Other people have day to day business priorities, and with the best will in the world these will end up by taking precedence over business continuity awareness and training. As a result, you’ll find that people cancel their attendance at events at short notice, or even leave part way through.

When combined with the fact that people and roles will keep changing, you’ll find that you’ll never be able to get to the point where everyone has the right level of knowledge and skills to undertake the business continuity work required of them – something will always stop this happening. It is therefore a continuous process that you need to keep implementing to try and get closer to your goal without ever managing to reach it.

You also need to be careful about using the term ‘campaign’ publicly. The idea of a campaign is that it is a once off event, which gives entirely the wrong impression. BCM is a continuous process, and so is business continuity awareness and training.
Campaign is a misnomer, it’s really an annual training and awareness plan that you’re planning and delivering. It should be an integral part of your BCM plan for the coming year.

The author

Mel Gosling is the founder and managing director of Merrycon Ltd, which has been providing Business Continuity services for14 years, and is a Fellow of the BCI. www.merrycon.com Contact Mel at merrycon@gmail.com