Skills and Expertise of Business Continuity Expert
As the business continuity and disaster recovery professions progress through their fifth decade, they have slowly and steadily evolved. Today, formal standards and practices for BC/DR activities are in place, training programs exist to address all aspects of the professions, and a large variety of software and systems are available to provide assistance. In the early days, many business continuity managers and disaster recovery professionals had no formal training, mostly learning by doing. No specific education or knowledge was needed, although many of the early practitioners had IT backgrounds.
Today, it is possible to obtain certifications, undergraduate degrees and even graduate degrees in business continuity and disaster recovery. If you are considering a change in your profession and business continuity (BC) is on the radar, here are some skills you may already have that will make your transition into the profession easier:
Business function experience or technical IT experience
This is a must. Business Continuity is about business, and without basic business function knowledge and experience, guiding departments and interfacing with IT areas will be challenging.
Project management experience
You do not necessarily need a certified project manager, but you do need someone who is familiar with project management concepts and project organization. In the end, BCM is a program and requires organizational skills.
Effective BCM programs must work with multiple levels of an organization, so the ability to communicate across all levels, as well as to understand and address concerns and pushback are necessary for success.
Flexibility and adaptability
Organizational needs change over time, and a demonstrated ability to be flexible in both process and problem solving will help identify solutions to BCM issues surrounding implementation, documentation, and governance.
These skills are useful, in that auditors — especially IT auditors — focus on management and operational controls, as well as procedures that ensure the business functions are in alignment with recognized process controls and metrics. These skills are important when examining BC/DR plans, BC management systems, BC/DR exercises, BC/DR training and awareness programs, and other activities regarding compliance with standards and good practices.
This skill is useful for business continuity managers when performing a BIA, particularly when identifying the financial impact of specific disruptive events. It is also helpful when evaluating proposals from vendors.
Recognizing that a BC/DR event is probably also an emergency necessitating a coordinated response, emergency management skills can be very useful when formulating incident response plans and other activities for the early stages of an event.
Sell and motivate
Planning for disruption is important, but business continuity will quickly be considered a tier-two initiative if the professional lacks the ability to sell ideas and solutions without being perceived as a “the sky is falling” zealot. It’s important to note that the ability to sell includes both the message and the technique used to deliver the message.
Business Continuity Experience
Not every candidate will have all the following, but familiarity with the concepts is a minimum requirement:
- Performing or participating in Business Impact Analyses, both formal and informal.
- Performing or participating in Risk Assessments.
- Organization of Crisis Management Teams.
- Documentation development; the more the better, for example:
- Business continuity plans,
- IT technical recovery plans,
- BC (or any) policies,
- Crisis management plans, and
- Support documents such as vendor or team contact lists.
- Facilitation, development, or participation in mock exercises.
- Participation in IT recovery exercises.
Understanding of basic regulatory requirements. The person does not have to be an expert in ISO or OSHA, but must understand if there is a need to verify requirements related to regulatory needs.
Business Continuity Certifications
There are numerous certifications available for business continuity and disaster recovery professionals. These are valuable programs that demonstrate a certain level of subject matter expertise, but they do not guarantee practical knowledge, experience, or wisdom. In our opinion, broad experience often far outweighs certifications. The most well-known certifications are those offered by Disaster Recovery Institute International (DRII) and Business Continuity Institute (BCI), for example:
CBCP – Certified Business Continuity Professional. This is the most widely-held certification showing knowledge across business continuity and disaster recovery.
CFCP – Certified Functional Continuity Professional. This is a narrow-focused certification such as IT recovery, BIA, testing, etc.
MBCP – Master Business Continuity Professional. Higher level of experience and knowledge. Few individuals hold this certification.
CBCI – Certificate of the Business Continuity Institute (CBCI) is the entry-level certified membership of the BCI.