The road to hell is paved with good intentions. Sure, people in an organisation want business to go on successfully. Their jobs, families and futures depend on it. If you ask them what would happen if systems suddenly crashed, if access to their workspace was blocked, they’ll probably agree it would be a disaster.
But you have business continuity management plans, right? Of course you do – except that if everything continues to work, it becomes harder and harder to get people’s attention if all you have is the same fear factor tactic. The more such a message is repeated without disaster happening, the more it loses its effectiveness. Little by little, Business Continuity plans can slip out of alignment with reality, because resources start to be assigned elsewhere to “real” or “urgent” problems. However, whereas you can neglect other situations and still get away with it if problems arise, business discontinuities (disasters) are not so forgiving, especially as server failures and natural catastrophes often happen without warning.
Is there an alternative to scare-mongering? Business continuity management may still be more aligned to using the stick rather than the carrot. One tactic is to point out the real financial impacts of any shortfall in sufficiently good business continuity. This might for example be the loss of a contract with a major client who no longer wants to do business with an organisation that cannot demonstrably meet a certain standard of BCM. Another one is to use a process like the “Chaos Monkey” created by Netflix. The Chaos Monkey moves around the network of Netflix’s computing systems and randomly halts servers or applications to see if overall performance still remains acceptable. It’s a concept that also could be extended to the other things that business continuity management covers – as long as you make sure that all your BCM plans are up to date and implemented first.