So you are embarking on building a comprehensive business continuity plan, or looking to significantly improve your fledgling plan. Your first question should be: "Can we do it ourselves or should we hire some help?" From my talks with companies, I have found that about half utilize consultants and the other half go it alone.
There are standard steps you should take to determine if a consultancy firm will be worth the money, and a follow-up check list to use for gauging the firms worthy of consideration.
Finding an internal BCP leader
Before you hire a business continuity planning (BCP) firm, you must evaluate your internal skills and resource availability. It may be possible to get the job done without a hired gun. As you evaluate your internal staff, be aware that a BCP or disaster recovery industry certification alone is not a sufficient assessment technique for proper internal skills and experience. My tip from June 2008 discusses the value of professional certifications. You should follow those guidelines in determining internal suitability of your staff.
Determining if you have internal staff that is sufficiently experienced in BCP is not that easy. Here are some things you should look for:
- Have they led at least two BCP exercises in their career?
- How successful were those exercises?
- Were the companies where these BCP exercises held of similar size to your organization?
- Were the companies where these BCP exercises held in a similar business vertical market to your organization? BCP for an internet service company is quite different from that of a manufacturing firm.
If you do not have anyone on staff that is sufficiently experienced in BCP, hiring a consultancy firm is the path for you. If you do have skilled and experienced business continuity planners on your staff, you still need to exercise caution. What are those people currently responsible for within the company? Their current responsibilities could be more important to the daily operation of the business than a long term assignment in leading a BCP exercise.
If you determine that your internal staff is sufficiently experienced to conduct a BCP, then go ahead and get started. Otherwise it's time to begin vetting BCP consultancy firms.
Finding the right BCP consultancy firm
I've talked to a number of businesses that have used consultants for BCP. Most have had positive experiences, but a few have not been as happy with their first choice. I've made a list of items I've found in common in those that have had favorable experiences. These are traits you should look for when vetting your list of BCP consultancy firms.
You will want to get down to a short list of no more than three candidates and ensure they are going to deliver what you need:
- Can they produce a reference list of their prior clients? They should be able to produce a list of nearly all their clients and most should be listed as references you can contact. Understand, however, that some businesses do have policies that prevent them from being used as references. This tends to be the case with government and financial institutions. But, the potential BCP firm should be able to supply at least five good references. Any hesitancy or excuses in responding to this request should be a red-flag.
- Does the BCP firm clearly state their prices and billing structure? When a contract is signed, it should be clear that the price includes everything they will deliver and not more. Many clients (and BCP consultancy firms for that matter) have been disappointed to find that various expectations and deliverables are "extra charge." Do not try to low ball the price -- the BCP firm may be forced to cut back and deliver substandard consulting. I talked to more than one organization that has focused on the low price and not the deliverables and regretted this mistake later. Your better BCP firms will refuse to drop prices in exchange for giving up part of the process as this becomes a risk to their reputation of delivering complete and quality services in the BCP market.
- Can the BCP firm service all of your major business locations? The BCP process will involve all your major business locations and the key business leaders located in each. The firm you select should have presence near each of your major locations. This may restrict your list to BCP consultants with international presence in the same locales as your business.
- Does the BCP firm have experience in your type of business? Smaller BCP firms may have only focused on one type of vertical market business such as durable goods manufacturing. They should have experience in your industry vertical.
- Does the BCP firm provide training, mentoring and tools? The BCP firm's goal for your organization should be to train and guide the process as your firm performs the work. The best model empowers your staff to continue forward and break the "umbilical cord" to the BCP consultants. The BCP firm should supply you with tools to enable the BCP process to continue internally. Additionally, they should follow-up to ensure that your organization is carrying on the BCP annual updates. It is imperative that your expectations are that your organization will take over control of the BCP process from the consultancy firm. Otherwise, your business is not being run completely within your control, but rather in the control of the BCP firm.
All businesses that I have spoken to that have had good experiences with a BCP consultancy firm have indicated that it was well worth the expense. The keys to success were a concerted effort in finding the right firm to fit their needs and a firm that follows up to ensure the business is continuing the process forward on their own.
