By Ashley Goosman, MBCP, MBCI, MPA, Disaster Empire:

Why measure at all? Often, I’m asked if I have a template for a scorecard or a dashboard for program measurement. To date, my answer is that metrics should organically evolve to suit your company. Rather than a generic outline, my goal is to provide insights and considerations for creating the most effective evaluation and reporting tools. However, one of the Road to Resilience series entries is on metrics and measurements. There, I discuss common pitfalls with program data, its definition, and a six-step method for program evaluation. Peter Drucker’s classic business quote, “If you can’t measure it, you can’t improve it,” resonates more than ever today.

This blog provides insights into understanding what resiliency success measures look like. Earlier this summer, Kenton Friesen gave us a measuring program maturity masterclass. It’s worth reading his articles, Measuring The Maturity Of Your Business Continuity Management (BCM) Program, Parts I and II. My Road to Resilience series outlines how to design, implement, and execute a new program. In this blog, I share how to create success measures for your organization.

Value, funding, and (self)awareness
Following the news, it’s clear that we are in a global economic downturn. Understandably, this knowledge will impact business profitability. Companies are trimming the fat from their budgets and focusing on maximizing profits. As a seasoned professional, you likely experienced multiple similar cycles. However, the current climate is especially challenging after three years of the pandemic and various global pressures.

In this environment, businesses tighten their belts. So, when a company’s goal is to spend less and adopt frugality, it is timely to provide data supporting your program’s value. Now is the perfect time to share The Value Of Business Continuity or related discipline. For any resilience practitioner, there are several considerations to boost maximum results by leveraging data.

First, you want to articulate the value clearly. Then, describe existing gaps with a remediation plan. Not only does this approach highlight how resilience safeguards the company from future shocks, but it also articulates the need for ongoing improvement.

It’s an on-going cycle, not a project. Show that.
One of the frequent challenges I’ve encountered is when managers view resilience, business continuity, and crisis management as short-term efforts. And yes, aspects of the work are project-oriented. However, companies or managers that persist in this mindset exhibit short-sightedness. They often fail to grasp the continuous utility of an embedded program. Like risk management efforts to identify and seek to limit exposure, resilience exhibits next-level mitigation.

Use the 5 W’s and H questions as a base
So, for ease of use, you can share the Five W’s and H questions. Giving leadership insight into who, what, when, where, and how is always a good place to start. Your resilience program measurements should address the following:

• What is the program’s current state? Describe the situation within the organization that provides insight into aligned people, policies, processes, and technologies.
• Who is involved in the work? Provide management with a clear understanding of what personnel is engaged in the work. Doing sets the stage for any future asks or visibility into fluctuations.
• What are the accomplishments? Provide leaders and partners with a refresher on the vision, mission, and operational goals. Then, update them on progress with clarifying data.
• How is the work developed? Sharing insights into program design and development gives external partners a transparent view of the program. Taking this approach sets a baseline for future credibility.
• Where is the work? With this, you share how things are going. Here, the use of maturity modeling is helpful because it not only displays you know the “state of the state” of the program but a clear vision of where it’s headed.

So, there’s a baseline for communicating resiliency success measures. Then you should provide a progress report. Next, I’ll share examples of resilience program success measures. They document outcomes, measure impact, and inform change for any program.

Success measure examples for organizational resiliency
Now, here’s the rub. What resiliency success measures look like for your program will be tailored for your company. However, most organizations will gauge similar things. In general, report on outcomes, measure impact, and inform management of changes.

Some measures of organizational resiliency are:

• High-level preparedness and mitigation metrics
• Number of employees engaged in resiliency efforts
• Resilience scoring of business units
• Customer satisfaction scoring – ex. Employee rating of the company’s level of preparedness and ability to bounce back from events.
• Program governance ranking – ex. Share the level of satisfaction with meeting goals,=.
• Time allocation – ex. Describe activities the program engages in and demonstrate alignment with goals.

In my experience, companies see value in a qualitative understanding of their investment rather than quantitative plan counts, etc. Success measures include self-assessment (i.e., program transparency), demonstrating employee engagement, and updating managers on actions. Tell the resiliency story of where the company was, what it is, and where the program is going.

Measures for operational resilency
Another tip is to consider existing regulations or standards. Leadership generally wants to know if their company is on par with others, even if there is no compliance obligation. For example, the FCA, the PRA, and the Bank of England consider operational resilience as important as financial resilience. Use their guidelines as an example.

The list below is not exhaustive but demonstrates how organizational and operational resiliency measures differ. Operational resiliency is a crucial sub-set of overall business resiliency. It focuses on a company’s technological capabilities to continue delivering vital customer service. Keeping a self-assessment showing how the business meets or aligns with operational resilience requirements is a roll-up of applicable measures.

Operational resiliency assessment
Armed with this knowledge, propose alignment with regulatory expectations. Here, the areas to measure are:

• Identification of critical services – It can be helpful to share how criticality is defined. Provide a map of the identified services.
• Describe impact tolerances – Share the process and its impact on critical services and customers.
• To achieve resiliency, provide transparency by reporting on the people, processes, technology, facilities, and related information. Note any gaps or improvement strategies.
• Show how the most crucial business service and impact tolerances are linked.
• Exercise or testing schedule – Outline how this work is accomplished and provide outcome data.
• Catalog the severe but plausible disruption that could impact company operations. Have a process to report internal and external failures (may be governed by local regulation).

Tell the story and don’t stop updating it
Finally, just as we established that a resiliency program is not a project, success measures are best refined over time. Useful metrics help you to describe resiliency overall. It includes a view of the company’s health to achieve resiliency goals, program updates, and opportunities for improvement.

Resiliency is a lofty goal but one that is a survival imperative in the minds of top leadership. Companies must shift strategies to absorb better, bounce back from, and anticipate shocks than ever before. It is our privilege to assist in this endeavor. However, you can’t sit on your laurels in today’s workplace. Measures assess a resilience program’s extent, quality, value, or effect.

This blog originally appeared on Disaster Empire and is reprinted here with permission.

Learn more at Disaster Empire.