Presenter: John R Robinson FBCI, Managing Director, INONI Limited Improving BCM The importance of measuring business continuity systems has never been greater, driven by the need for business continuity managers to demonstrate ROI and by the ISO 22301 emphasis on performance monitoring According to the Business Continuity Institute the requirement to produce and monitor business continuity metrics has resulted in a ‘flurry of confusion’ It need not be the case

1. Continuity and Resilience (CORE)
ISO 22301 BCM Consulting Firm
Presentations by our partners and
extended team of industry experts
Our Contact Details:
INDIA UAE
Continuity and Resilience
Level 15,Eros Corporate Tower
Nehru Place ,New Delhi-110019
Tel: +91 11 41055534/ +91 11 41613033
Fax: ++91 11 41055535
Email: neha@continuityandresilience.com
Continuity and Resilience
P. O. Box 127557
Abu Dhabi, United Arab Emirates
Mobile:+971 50 8460530
Tel: +971 2 8152831
Fax: +971 2 8152888
Email: info@continuityandresilience.com

2. Improving BCM through
Measurement and Benchmarking
John R Robinson FBCI
Managing Director, INONI Limited

3. Improving BCM
The importance of measuring business continuity systems has never
been greater, driven by the need for business continuity managers to
demonstrate ROI and by the ISO 22301 emphasis on performance
monitoring
According to the Business Continuity Institute the requirement to
produce and monitor business continuity metrics has resulted in a
‘flurry of confusion’
It need not be the case

4. About INONI
2002 Company founded
2004 Creating a Resilient Culture benchmark study
2005 Resilience Benchmarking Project
2006 Market-Wide Exercises
2008 INONI BCM software developed
2009 RES simulation tool
2011 Aon collaboration
2012 ISO 22301 clients
2013 INONI Lite and Lite Multi
2014 Co-operation with CORE and CS&A
2015 Total Business Metrics

5. 14/03/2015 Copyright ©2015 INONI Limited
ONE-QUARTER of ISO 22301 is MEASUREMENT

6. 14/03/2015 Copyright ©2015 INONI Limited
“ Measurement is the first step that leads to control and
eventually to improvement
If you can’t measure something, you can’t understand it
If you can’t understand it, you can’t control it
If you can’t control it, you can’t improve it ”
H. James Harrington, Quality Expert and author

7. Why we measure
• To ensure we meet organisational objectives
ISO is totally predicated on this
• Have we understood the context well enough to do this
• Are we being well-led
• Have we planned adequately
• Do we have resources to deliver it
• Are we operationally capable of doing it
• Are we improving

8. What we measure
• Completion and success of tests and exercises: 68.0%
• Incident response performance: 55.3%
• Completion and currency of maintenance tasks: 48.5%
• Coverage against scope and objectives: 46.6%
• Completion and success of awareness activities: 46.6%
• Operational performance and readiness: 43.7%
• Delivery and implementation programs: 42.7%
• Organisational resilience: 25.2%
• Improvement performance: 23.3%
• Leadership performance: 19.4%
• People performance: 17.5%
• Management system performance: 15.5%
• Financial performance: 10.7 percent
Data supplied by ContinuityCentral

9. What’s missing
• Consistency, localisation, drill-down and roll-up
• Universal best-practice KPI
• Numbers, quantities and evidence
• Management and operational coverage
• Alignment and maturity assessments

10. Capability Maturity

11. ISO Maturity Map
Summary Findings
Analysis
ABC’s aggregate score for this assessment is 1.86, positioning it at Level 1. This suggests it
is ‘at an Initial Stage and the starting point for a new or embryonic capability’. The profile
shows strength in leadership and improvement reflecting recent focus.
The BCMS Assessment has been developed by INONI
to measure organisations’ maturity and alignment with
the ISO 22301 : 2012 Standard for Business Continuity.
Maturity is ranked from level 0 (Absent) to 5
(Optimising) on the 7 key areas identified by ISO,
allowing organisations to track progress from level to
level in each sub-discipline and as a whole.
All Users
ABC Depot
Target

12. Operational Benchmark
Summary Findings
LB BM ABC Score
Combined Score 3.34 6.50 3.21
1 Policy 3.60 7.20 3.85
2 Programme 3.60 7.20 2.99
3 Understanding 3.30 6.56 1.96
4 Strategies 3.50 6.91 2.24
5 Planning 3.60 7.09 3.55
6 Exercising 3.18 6.36 2.71
7 Maintenance 3.27 6.54 1.71
8 Awareness 2.78 5.55 1.89
Analysis
A set of 180 checkpoints were applied based on the Interview and the BCP. The assessment
results show ABC’s combined score (2.21) to be below the LB lower red/amber boundary
(3.34) and well below the BM benchmark (6.50). All areas require attention with particular
focus on 3 (Understanding) then 6, 7 and 8 (Realisation)
INONI was commissioned to produce the
Benchmark for the BCI and it is used by
organisations to assess the practical
adequacy of clients’ BC provisions. It
aligns with the BCI Good Practice Guide
2013. INONI now operates the
benchmark independently
BM is the benchmark, based on average
scores by participants. LB is the lower
acceptable boundary. The values were
set with agreement by the BCI in 2010

13. Insights
• ISO 22301 implies, but does not specify how or what we measure
• We need enough quantised soft and hard KPI to drive all key BC decisions
• Fast changing and complex entities need more, need automation
• Measurement underpins value
• Maturity is a post-ISO aspirational concept, capable of maximizing ROI

14. protecting your business