Metrics are everywhere. Think about it: Every doctor’s visit includes standard measurements designed to provide important information about the state of your physical self, like a blood pressure check and confirmation of your height and weight. In the car, your dashboard measures speed and fuel supply. Quarterly report cards measure your kids’ progress in school. And periodic portfolio reports measure the state of your financial investments. Without these and a mountain of other measurements, or metrics, you’d have no clear way of knowing how things are going in your life and, as a result, no real way to positively impact your future.
CFOs are usually analytical, hence their preoccupation with corporate spending and measuring the impact of billions of dollars spent (and rightly so). But as critical as business continuity (BC) and disaster recovery (DR) programs are to a company—along with the steep budgets sometimes accompanying them—there’s often little-to-no required measurement of these programs by management.
Among the usual reasons we hear for a lack of business continuity management (BCM) metrics and disaster recovery metrics are:
In other cases, there are BCM or disaster recovery metrics at work, but more often than not they’re meaningless. Such metrics usually focus on volume of work (the number of exercises conducted, plans updated, analyses completed, etc.) rather than on the reality of whether a program will work in a true crisis.
Why is the lack of real business continuity program metrics a problem? Because if you can’t measure it, you can’t manage it.
Without the metrics to tell if your BC process is functioning, you have no idea how your business would actually fare in the case of a disruption, and you have no basis for identifying what aspects of the program are working and which need improvements.
Metrics serve three very important functions:
To truly measure the effectiveness of your BC process, you need a combination of metrics that focus on two key areas: the foundation of the program and the execution of the program. Evaluating both of these areas together gives insight into how a program will perform when it’s needed. It also clearly illustrates the program’s return on investment. High numbers in both areas indicate that money has been well spent.
This area measures how aligned your program is with industry standards, such as ISO 22301 or NFPA 1600. On a scale of 0-100, how does it measure up to those standards in terms of:
In other words, are you building your program on sand or solid rock? If your process lines up with accepted industry standards, you can rest assured that your program’s foundation is solid, which promotes stronger execution of the process.
This area measures the level of risk that remains after you have considered management’s risk tolerance, the inherent risk of your recovery plans, and the state of mitigating controls. You then take steps to mitigate that risk, lowering it to an acceptable level.
Here are some business continuity KPI examples you should measure, among other things:
A lower level of risk indicates you have a program that has a high level of execution and capability; a higher level of risk indicates your program is weaker and needs to be strengthened to raise its level of execution.
If all of your mitigating controls are operating at the highest levels, you’ve successfully reduced your level of risk and increased your level of execution.
Business Continuity Management metrics are just one piece of a successful continuity program. With our online business continuity software suite, BCMMetrics™, you can easily and effectively assess your organization’s levels of compliance and risk and access tools that can help you build a better BC program from the ground up. It’s simple to use (there’s no software to install) and secure—your data is protected with military-grade encryption and backed up to multiple off-site locations. And the tool updates automatically with the most current industry standards, so your program will always be up to date.
We believe that, with the right tools, an effective BC program is within reach of every organization. Schedule a free demo of the tool in action to get a sense of what it can do for your business, or contact us with questions—we’re happy to help.