MYTH
#5
Best-in-class BCM
software exists
Five myths of business
continuity management
(BCM)
About the series
Why is business continuity management (BCM) such a struggle, and what prevents companies from building
sustainable programs?
As a BCM practitioner, I’ve spent my career pondering these questions. Trial and error, and years of experience in
re-energizing BCM initiatives have taught me the perpetuation of certain industry myths prevents us from building
successful programs.
The five myths of business continuity management (BCM) debunk the faulty beliefs that lead practitioners astray.
In this series, we dispel the biggest myths of BCM and explore their dangerous implications for programs, and the
businesses they aim to protect.
Changing behavior requires education. My hope is that through this series, more companies can move towards a more
holistic, proactive approach to managing operational risk.
Read, learn, and enjoy. And if you have any questions or comments, please feel free to reach out to me at
[email protected].
Cheers!
Sean Murphy
2
What are the 5 myths?
Myth #1
The plan is
the promised
land
Myth #2
You need a
business impact
analysis (BIA)
Myth #4
It gets cheaper
and easier
Myth #5
Best-in-class
software exists
Myth #3
A risk matrix
measures risk
Introduction
Will BCM software deliver on its promise of making your BCM program easier to run? Is it really possible for BCM
software to eliminate the difficulties in running your program?
Yes, it can—but there’s a catch. It won’t address challenges that are unique to your program. Essentially, your problems
need to be shared by every other customer of the software.
The issue with the BCM software in today’s market is that it’s designed to address broad and well-known problems. The
vendors provide answers to challenges based on their approach or consistent issues raised by the existing customer base.
The decision to implement new solutions (e.g. answers to your unique problems) needs to conform to the issues of the
widest user base. Otherwise implementation can be delayed or rejected – or worse, require additional fees for customization.
Whether you currently own vendor software, have developed internal software or just prefer the “old-school” method of
spreadsheets and word documents, a perfect solution has yet to exist.
So what should we expect of software, and how can we better approach the purchasing and implementation process? We
explore all that in this eBook.
4
About the author
Sean Murphy
Chief Executive Officer & President
Sean founded Lootok in 2006 with a vision: to
do business continuity management differently.
With more than 22 years of contingency
experience, Sean oversees Lootok’s quality
assurance and serves an advisory role in
program management, deliverable creativity
and innovation, and leadership coaching.
He is often seen at the helm of executivelevel meetings providing guidance on
brand reputation, system design, resiliency
engineering, and crisis management.
[email protected]
+1 646.961.3684, ext. 701
5
Content
Why is BCM software so disappointing?
Common pitfalls when evaluating software
Tips for purchasing software
Resources
6
Why is BCM software
so disappointing?
7
Computers make it easier to do a lot of
things, but most of the things they make it
easier to do don’t need to be done.
Andy Rooney
In my early days as a consultant, there were only a few options for BCM software. Then, with technology advancements and
massive layoffs, small software companies began popping up. With the market being too niche for software giants to invest
in, the competing players are many small companies with limited resources.
The innovative leaders of these companies were motivated by the vision of offering a better, more effective tool. The
conditions of the market, however, create a tough environment for these software companies to operate in. The survival
of a software company depends on creating its tool once and selling it a thousand times. The modest size of this industry
causes a desperate need to appeal to all customers; generally, their sales strategy is to throw the net as wide as possible. In
attempting to please all customers, the software becomes a jack-of-all-trades, and master of none.
As a consumer, we have many software options, but none are fully capable of eliminating our unique difficulties. In our
industry, best-in-class software simply does not exist. Here’s why:
8
It’s too onerous
BCM software is too complex and time-consuming for the value that we get from it, and for the job we need it to do.
Few tools offer more than data collection templates, and are so complicated that they require one or more individuals
who specialize in the tool. If you need to hire someone just to manage the software, walk away from it. Most tools and
technologies require manual data entry by the user. This becomes a heavy burden in today’s lean business environment—
often, too much to bear.
At the end of the day, BCM software must do some basic things: help determine how your business is impacted by an
event, guide your team to make key decisions, and send notifications to users to help manage the incident. Most tools are
bogged down with bells and whistles that don’t support these key goals.
It does everything… except help us manage incidents
Another challenge is the value the software provides the company. Our industry hyper-focuses on documentation, the gap
analysis, risk assessments, and plans—which have limited value in an actual incident. This leads to software that functions
more like an asset management tool than supporting users to manage an incident.
The situation is compounded by regulations and standards, which create baseline requirements for the general business
market. This poses a difficult challenge. These standards are so vague and ambiguous that we are left to the subjectivity of
the auditor. Yet, the standards require us to gather so much documentation that our software turns into a mere repository
for massive data collection—today’s equivalent of the 300-page binder that sits untouched on a shelf.
9
Just as a physical plan is the by-product of a planning process, software will only be as useful as a handrail in an incident.
The environment we face in an incident is chaotic and unpredictable, filled with high stakes, inadequate information, and
time constraints.
BCM software doesn’t alert us of impending events, pull in threat intelligence feeds, or help us analyze our circumstances
in real-time—which is what we need. BCM software is structured to support the process of developing plans, but the real
planning starts at time of event.
It’s not designed the right way
Most BCM software tools resemble a TV remote control: everything gets its own button. Why does this happen? Typically,
software developers ask users what they want—and give it to them. The result is a costly and endless cycle of add-ons with
little consistency.
This problem isn’t unique to our industry; it’s a larger issue with most software design. In “Designing For Situation
Awareness: An Approach to User-Centered Design,” engineer Mica Endsley points to the key flaw of most software:
technology-centered design. While technology has enabled us to gather overwhelming amounts of data, users struggle with
data overload. This is especially challenging in a complex environment like an incident, when leaders need to integrate data
quickly for decision-making.
In user-centered design, technology is developed around the goals of the user and the way people think. Such design focuses
on the user’s cognitive processes as they integrate information from many sources, and weigh decisions and goals. A tool
built with a user-centered approach has various information displays, customized for the specific information needs of a
particular user.
10
The best design approach involves a collaboration of users, software engineers, and human factor engineers who
understand human performance capabilities and effective system design. In order for BCM software to be considered best
in class, it needs to be reimagined and developed with this collaborative approach.
It doesn’t let you love it or leave it
Take a minute to think about the last great purchase you made—chances are it wasn’t BCM software. Whatever this
purchase was, you loved it for its ability to exceed your needs.
For example, if you were going to buy a pair of shoes, you would visit a shoe store or browse online. During the buying
process, you would be prompted to clearly specify your buying criteria. You get to specify the type of shoe you want, the
size, a price range, a brand, and read some customer reviews.
The secret behind how you felt about the purchase is in the store or site’s ability to meet (and exceed) your specific request
by asking for many details, and consequently, narrowing down your needs.
Have you ever had a BCM software salesperson tell you, “Based on what I’m hearing you need, I think this other software or company
would be a better fit for you”? If you have, please send me his or her contact information! While the processes for buying shoes
versus BCM software are quite different, shouldn’t the same beliefs on buyer-based purchasing hold true?
Our industry software providers showcase features, interfaces, functionality and convenience (e.g. time savings with
automation) with the hook to negotiate longer-term subscriptions and subsequently, lock in customers. BCM software
purchase options are fairly limited, especially licensing deals.
11
To date, there has not been a provider I am aware of that offers a service application aka “app” model such as Netflix or
Spotify. Wouldn’t it be great if you could pay per month not because you’re locked in to the vendor, but because you value
the service and want to maintain your subscription? And if the vendor failed to satisfy your needs, you could simply cancel
your subscription the following month.
Instead, in the typical software application model, clients need to engage in formal vendor contracts in a wholesale fashion,
with a contract covering an annual period, and possibly having to pay per user. The benefits pitched by the software
providers are that you can realize larger savings and incentives by locking in a longer-term contract, e.g. two or three-years.
It’s not based on user feedback
My biggest gripe about BCM software is that our industry’s grading and award entities are not based on user feedback. They
don’t have to implement it, get people to use it, or get it to do things. There is no industry website that compares BCM
software from the users perspective, such as Yelp or TripAdvisor, where potential buyers can access unsolicited reviews.
Note, the term user versus customer in the preceding suggestion implies an end-user as well, not just the purchaser of the
software. Wouldn’t that provide an unexplored sounding board? Without a mechanism for facilitating open criticism and
transparent feedback, users are completely left out.
With small companies comes a very intimate sales process. Everything is personal. The sale of BCM software is clouded
in emotion, friendships, and promises. Because everyone knows everyone, no one wants to severely critique or take a hard
look at the value of software. Unlike big software companies with a large footprint, technology benchmarks, and unbiased
feedback for the user base, small companies need to fake it until they make it.
12
Common pitfalls when
evaluating software
13
A computer lets you make more mistakes
faster than any other invention with the
possible exceptions of handguns and
tequila. Mitch Ratcliffe
Imagine you oversee BCM for a large organization and manage documentation using Microsoft Excel spreadsheets and
Word documents. You’re likely familiar with the painstaking manual process of updating plans, which took your company
no less than six months. Word or Excel may be the cheapest solution, but they’re not effective for managing a program
with numerous projects, tasks, users, data, and reporting requirements. Your desire to purchase software arises from this
challenge.
As you consider various software products, many questions surface. Will the software be hosted internally? Or by a third
party? If it’s hosted internally, what is your company’s disaster recovery plan? This can be overwhelming for a buyer,
especially when you consider security requirements.
I’ve seen many companies struggle with their BCM software, and repeat the same mistakes I’ve made. Some may have
jumped the gun on purchasing it, or may be experiencing the pains of implementation. In many cases, their struggle could
have been avoided if they had considered some key factors during the purchasing process.
These are the biggest mistakes I see clients make when considering software:
14
Believing in magic
When it comes to evaluating software, most companies don’t know where to start. The overwhelming number of options,
combined with limited time for proper due diligence, can lead people to take the path of least resistance. During the
process of assessing business continuity tools, the question eventually becomes, “Which is the easiest and least risky
decision I can make?”
Many of us turn to industry awards and consumer reports, like the Gartner Magic Quadrant. The Magic Quadrant is an
annual report that assesses technology providers by their “completeness of vision” and “ability to execute.” It is perhaps
the most well-known and commonly cited source by software vendors. Frankly, it’s easier to simply defer to the software
highlighted by the Magic Quadrant than to conduct your own research. No one gets fired for buying software that was
ranked #1 by an industry source.
But you have to be suspicious of anything with “magic” in its title. “Magic” pills and potions promise dramatic weight loss,
rapid hair growth, and wrinkle removal; there’s even magic cheese. They are sold under the guise of being a quick and easy
solution. The Magic Quadrant is often criticized for its simplicity and subjectivity. Gartner advises companies to use the
Magic Quadrant as “a first step to understanding the technology providers” you might consider. They warn “focusing on
the leaders’ quadrant isn’t always the best course of action.”
Yet I know many practitioners who relied too heavily on external specialists, or the Magic Quadrant, and bought highly
regarded software—and then struggled to use it for their specific goals. I made this mistake years ago, when I was helping a
client wade through various software options. So we turned to the Magic Quadrant, and selected software X—one that had
won awards for “best software,” multiple years in a row. This was a huge mistake. Software X was supposed to make our
lives easier. Instead, it became a massive headache. I’ll explain why in the next section, “Tips for purchasing software.”
15
Basing your purchase decision solely on the Magic Quadrant is not a good approach for finding a software tool that fits
your organization’s needs.
Fixating on features, instead of requirements
“Our tools don’t work” is one of the biggest complaints I hear from clients. That’s because they don’t go through a process
to discover their entire set of requirements. Often, they just want “the plan,” but they’re not really clear on what that means.
For example, a common ask of BCM software is to write a plan that can export to PDF. This allows business units to
print a copy of a document, but maintain control over who can edit it. The challenge arises when you try to convert
the overwhelming amount of manually captured data (in Word documents and Excel spreadsheets) into a document
that’s digestible for an average user. There’s often so much data we want to capture in a plan—everything from the risk
assessment, business impact analysis, recovery tasks, and vendor lists—that each data point has many additional data points
associated with it. Including a vendor’s contact information means listing your contact’s name, mobile number, and an
alternate contact. Similarly, a list of locations can expand into the building’s square footage, number of floors, and other
property details.
When every data point has 50 additional data points, what ends up happening is the creation of different plans. There’s the
one-page plan that’s practical for people to use; and the more detailed, auditable plan to print out once a year and show as
evidence that you’ve gone through the planning process.
This can be easily avoided if you first take the time to understand your minimum requirements. But it’s equally important
that you stick to them. So, get specific about what you need to achieve. Is it having all of the data centralized? If so, your
best option might be to use a document collaboration tool with simple forms, such as SharePoint, and forgo software.
16
It’s critical that you define your initial requirements before you start researching software options. Otherwise, you’ll find
your initial ideas start to morph. Without a defined idea of the functions you need your software to perform, you’re far
more susceptible to being distracted by flashy features and ending up with a piece of software that’s too complicated for
your needs.
Wishing and hoping one size fits all
Buyers are always pressured by internal expectations and time constraints. When this happens, it’s tempting to select
the cheapest tool out there. This isn’t necessarily a problem, as long as the tool’s features align with your requirements.
Unfortunately, this is rarely the case. Every company’s structure is too unique to fit off-the-shelf BCM software products,
which are designed as a generic broad stroke across multiple industries and sectors.
It’s hard to truly know the complexity of a tool until after you’ve purchased it. Software providers are interested in getting
you to sign a contract, not aligning your requirements with theirs. Despite what some vendors may claim, expect the time
needed from installation to normal daily operations to be several weeks or even months. In my 18 years in the industry, I’ve
yet to hear anyone say they’ve used the tool off the shelf. Software that’s meant to be effective cannot be ready to go from
day one.
Most tools, ranging in price, require some degree of customization to be effective for your business. In the worst situations,
customization can require six-figure consulting engagements and years of development to fully integrate and implement.
Factor this into your price comparisons.
17
Underestimating the pain of customization
Over the years, clients have shared their experiences collaborating with software vendors, and the significant costs and labor
involved in customization. Until they were in knee deep, few realized how cumbersome the process would be.
One client had just purchased a highly rated industry tool. The client soon realized they hadn’t factored in the labor required
to customize the software to accommodate the various languages and unique processes of their diverse, global sites. They
also discovered the functionalities of the software were also too complex for their immediate need, which was to guide
users through the process of writing a plan. So, in order to meet this minimum requirement, they needed to simplify the
software’s interface for users.
Customization also depends on how much in-house expertise you can devote to implementation. In the case of this client,
no one at the company was familiar with the tool. At the time of purchase, they were told customization would take six
months. Now, nearly 18 months later, the tool still has yet to be rolled out to sites and the client is still 100% reliant on the
vendor.
Imagine, for example, you want to customize the menu for RTOs. Perhaps your business doesn’t need to be up and running
in the pre-defined windows (e.g., 6 hours, 12 hours, etc.), so you’d like to change the dropdown options. What seems like
a simple fix can involve putting through a work order, working with a consultant, reviewing the layout, changing the user
manual, updating plans, and reeducating users on how to update information.
Making the smallest tweaks to a tool can lead to a long and painful process. As a result, companies end up compromising
what they want out of a tool to make it fit.
18
Tips for purchasing
software
19
The nice thing about standards is that there
are so many to choose from.
Andrew S. Tannenbaum
So what happened with software X, the tool we bought using the Gartner Magic Quadrant?
Of course, like most new buyers, we had unrealistic expectations about software X solving all of our problems. But the
other issue was that software X didn’t work as the vendor promised or demonstrated. For example, it did have a crisis
management module, but required users to input everything in prior to the event, which didn’t add value in an actual crisis.
Crises are simply too dynamic, with too many unknowns. We were promised software X could do supply chain modeling
such as tracking disruptions and setting geographic parameters in a map. Only until after the purchase did we realize that
this would only be feasible if we had a dedicated staff of 12 people to manage software X on a full-time basis.
At a company site, we ran a pilot test to introduce the software among a user group of employees. They weren’t happy: “I
have 10 things to do, I can maybe do six of those in a day, and now, I need to learn how to use software X?” We sat down with each of
them individually, but the tool looked so overwhelming—a monster of endless windows. The backbone of the client’s BCM
program was relying on this significant financial investment, but no one wanted to touch it.
20
This was a huge problem. Because companies with global operations often use a decentralized model to manage incidents
and crises, it was essential for these thousands of employees to feel comfortable using tool X.
But we were stuck. Once the vendor closed the deal, our relationship became devoid of any mutuality. They didn’t want
to hear about how software X didn’t meet our needs, or help us figure out a solution. What could we do? We tried to fix
the tool on our own dime—developing software X user guides, facilitating user training sessions and webinars, creating
eLearning videos, and even going back to Excel to manually import data into the system since it was unclear when
users would ever learn and embrace the software. An enormous amount of resources was spent trying to cover up the
shortcomings of software X, and it was never rolled out. Finally, we accepted our last resort: just wait for our five-year
contract to end.
The experience I described, regrettably, is a common one among practitioners. So when a client is starting to think about
software options and eager to hear my pick, I ask them to take a step back. Here’s the advice I give.
Slow down to speed up
Companies often purchase BCM software with a great sense of urgency. This may fill an immediate need, but what they
don’t see is the greater need to select a tool that’s a good fit for the maturity of their program. As a result, they run into
frustration as they encounter the complexities of maintaining a piece of technology.
I always advise companies to first know what their program structure looks like, before considering software. Think of it
this way: if you were building a house, you wouldn’t do anything until you had a general plan for each room and how it fit
into the overall house. Similarly, spend time on critical program activities before making a purchase. First, establish program
governance. Next, create adoption and awareness of BCM among your stakeholders. By this point, you’ll have a deeper
21
understanding of the breadth of your requirements and the factors that influence your program’s success. This will position
you to enter into the sales process as an informed customer.
Get crystal clear on your needs
What will BCM software help you achieve? Describe your objective in detail. If you want a way to visualize your business
processes using sophisticated charts, a tool can certainly help with that. Sophisticated features, data repository – most
companies probably won’t use those because the level of detail is too granular, and not user-friendly.
Remember, the tools aren’t actually all that different; each is essentially a little warehouse where we can pump in
information. It may be able to create an RTO timeline with the push of a button—but what use will that feature provide to
you? How will having that feature help you solve your problem?
Less is more, especially in the case of BCM software. Focus on the core competency you need, and then find a basic tool
that does that core function extremely well.
Remember, it’s just a tool
Tools can make it easier for us to go online and sort through data, but our premise in business continuity should be larger
than that. If your sole objective is just to get people in front of a screen to input information, you’re missing the big picture.
Many people think BCM tools will help them get something done, like finally finishing an incomplete business impact
analysis. With all the application interfacing and importing capabilities software tools employ, it’s easy to think you’ll be able
to import everything and have half of the work done. But no matter what, you and your team still have to do the work. No
tool will put together a BIA, call list, or plan for you.
22
Don’t fall into the trap of substituting software for the actual planning process. Software can be a backbone to help support
planning, but it should not replace key conversations about priorities and decision-making that are crucial to the planning
process. Most often, time required for administration, troubleshooting, and training around software tools makes up for the
time saved in any automated functionality. The difference lies in being able to do more with information collected using the
software’s reporting or communication capabilities.
On their own, software tools are like Band-Aids for organizational health. They cover up a lack of organizational
preparedness without getting to the root of the infection. If your challenge is that no one knows what BCM is (much less,
that a program exists), an industry-recognized software that spits out reports won’t help. Instead, build adoption and senior
management support first.
Make the experience a good one
When evaluating and scoping software, see and experience the tool as the end-user. A piece of software will live or die by
how intuitive and user-friendly it is. If the store clerk can use it, you have a good tool. Your average users won’t be tech
geeks; they will be busy people without the time or patience to read a user manual and figure things out.
Once you start gaining traction, invest in the quality of your products. Is your program’s intranet site, or software, user-friendly?
Or is it complicated and confusing? Is your plan template clean and intuitive? Or is it an overwhelming eyesore of data? Keep updating and
refining them so they become easier to use. All of this will help contribute to the overall positive or negative experience
your people will have with BCM.
Some practitioners completely dismiss the importance of design, but aesthetics have an important function. Attractive
things work better. This isn’t about super flashy visuals; it’s about making things easier to use, so people feel less frustrated.
23
Consider the emotions of your average program participant, during and after each interaction with your program—
participating in an annual exercise, filling in a plan template, clicking through an eLearning module, or navigating a piece of
clunky software. Are they trying to finish their task as fast as they can, while thinking as little as possible about it? Invest in usability, as
well as BCM subject matter expertise.
Encourage user training and feedback
Once you’re ready to roll your software out, don’t overlook the need to provide continual education and training. These are
crucial in supporting users’ adoption of the tool. Whether you’re unleashing it to the masses or rolling it out in stages with
groups at a time, your tool will never work if you don’t teach people how to use it.
In lieu of in-person training sessions that suck up time, provide various resources such as eLearning modules, quick
reference guides, and a helpdesk where users can send questions and request support. If you don’t have the resources to
produce video tutorials, build a basic “how-to” deck with screenshots of the tool in PowerPoint. You should also recruit
individuals in each business unit to be on call for others, and to champion the tool internally. This prevents you from
becoming a bottleneck for basic questions or requests.
Equally important is staying committed to receiving feedback on how the tool is working. Even after customization, your
software won’t be perfect. Remember, you are not your end user. Your bias prevents you from being able to fully anticipate
how a tool will be received. If people are frustrated using the tool, you want to be among the first to know so you can
solve any issues. Encouraging open feedback will empower users to help shape your tool for the better and increases the
likelihood your tool will be successful.
24
Get the truth from others
Talk to your peers in the business continuity world who have implemented, or are in the process of implementing software
tools. You’re much more likely to get insights from someone who has actually gone through a six-month process of vetting
software than you would from any external specialist.
Get input on the pros and cons of different tools, and learn about what’s worked and what hasn’t. If you end up buying the
tool, attend the user conferences organized by the vendor to learn best practices and tips from other companies.
Don’t push the panic button
Finally, what can you do if you purchased software and think you made a huge mistake? Devise a plan for transitioning
away from legacy software, without impacting your career. Think long term, and consider the benchmarks and metrics
you’ll use for measuring the success of the program (not of the software) in three to five years. Then, think about how to
transition and refine your existing platform to meet those metrics.
25
Resources
26
Resources
Want to learn more?
Check out a few of our popular posts:
• Fight the BCM shopping addiction
• Business continuity professionals faced with increasing technology challenges
• Fresh perspectives: uncertainty metaphors
27
MYTH
#1
EXPLORE
MORE
MYTHS
228 Park Avenue South #25440
New York, NY 10003
lootok.com
[email protected]
+1 646.961.3684
28