Say Hello to VOI: The Best Way to Assess the Value of Your BCM Program

There’s a good reason business loves the concept of return on investment (ROI); it expresses the worth of an activity in terms everyone understands: dollars. However, in evaluating intangible assets such as a business continuity program, it’s more helpful to look at VOI, or value on investment.

In this post, we’ll review BCM VOI and why it’s the most accurate assessment when demonstrating the value of your BCM program to management.

Related on BCMMETRICS: How to Manage Management: 8 Tips to Help You Bring Your Bosses on Board

The Limits of ROI

In business, the concept of ROI has the status of royalty. It measures the performance of an investment in the clearest, most fundamental terms: how many dollars the investment brought in (or lost). Whether the story it tells is good or bad, everyone respects ROI as a piece of data.

Unfortunately, business people’s enthusiasm for ROI is so great, they sometimes think everything should be measured in ROI. And if something can’t be measured in ROI, they tend to think it’s not important. This has tended to put business continuity at a disadvantage during budgeting discussions.

Some aspects of business continuity management (BCM) do bring a measurable financial return. But the greatest benefit of a BCM program, by far, is its ability to bring the organization through a disruption with minimal impact to the company. This can be the difference between prosperity and bankruptcy for the organization; however, it is not something that can be readily measured in dollars.

As a result, BCM often finds itself at the back of the line come budgeting time.

The Emergence of VOI

Anyone who is not dazzled by ROI can see that, even in a for-profit business, there are many important activities that cannot be measured in terms of the financial return they bring.

In recent years, the concept of value on investment (VOI) has emerged to try to convey the contributions of intangible assets and programs. VOI is often used, for example, to express the benefits of employee wellness programs.

VOI can also be used to communicate the value of investments in business continuity.

Comparing ROI and VOI will always be like comparing apples and oranges. Even though the terms are similar, they are not expressed in the same units. ROI is expressed in dollars. VOI does not have a unit of measure.

Still, advocates who introduce the concept of VOI—and then describe the intangible benefits their program brings the organization—may find that using this idea might improve the reception they get from ROI-minded executives.

VOI and Business Continuity

Let’s look more specifically at VOI as it relates to business continuity programs.

At MHA Consulting, we have developed a way to express the VOI of BCM programs that we think conveys important information about their value to the organization. Our method uses scores derived from our proprietary BCM software suite, BCMMETRICS, specifically, our Compliance Confidence (C2) and Residual Risk (R2) tools.

In using these tools, information about the client’s business continuity program is put into the system. Each tool then returns (along with a great deal of other valuable information) a numerical score that shows the client’s enterprise degree of compliance with their chosen BCM standard or the amount of enterprise residual risk they are carrying. (Residual risk is the amount of risk remaining after any efforts that have been made to identify risk and eliminate it; it is dependent on management’s risk tolerance)

We then divide the compliance score by the residual risk score to arrive at a figure we use for VOI. This figure is tidy and compact. It also happens to give a very solid idea of the value of the program.

A program with a high VOI is highly compliant and has low risk, meaning it is likely extremely robust and very recoverable. A program with a low VOI will have minimal alignment with a standard and high remaining risk; this will tend to make it highly vulnerable to disruptions.

Let’s explain a bit further. A program with a high level of compliance and low residual risk indicates the program has been solidly built and aligned with industry standards (e.g., FFIEC, ISO22301, NFPA 1600) and the risks that remain in its recovery plans meet/exceed management’s risk tolerance indicating critical controls (Recovery Strategies, Recovery Exercises, etc.) are being executed at a level commensurate with management’s expectations.

This is how we at MHA give teeth to the concept of VOI—a concept that can help advocates for intangible programs persuasively express their value to ROI-minded executives.

Leveraging VOI to Defend Your BCM Program

The concept of ROI is rightfully embraced by business people for its ability to convey the value of profit-oriented activities. However, ROI is blind to the value of activities such as BCM whose contributions cannot be measured in dollars. Business continuity professionals should consider leveraging the concept of VOI in explaining the value of their programs to senior management.

Further Reading

For more information on demonstrating the value of your BCM program to management and other hot topics in BCM and IT/disaster recovery, check out these recent posts from BCMMETRICS and MHA Consulting:

• Standard Time: The Best Time to Choose a Business Continuity Standard Is Right Now 
• The Big Three of Residual Risk 
• Enter the Matrix: Why You Should Employ a Risk Management Matrix