Five years ago, I wrote a 30-page Management Accounting Guideline on business continuity management (BCM) best practices for CMA (this article is pulled from the longer report).

Since then, I’ve always remained alert to BCM news, trends, and developments, such as pandemic planning.

Since I hadn’t seen any major BCM news or breakthroughs in several weeks, I checked in with Brian Kinman, a PricewaterhouseCoopers partner who leads his firm’s enterprise risk management (ERM) practice.

Eric Krell: What’s the most frequently overlooked area of a business continuity program?

Brian Kinman: Crisis management.

Most companies focused first on technology and then on critical business processes, often leaving the crisis management — command, control and communication aspects of their program to the end. In reality, it’s the cornerstone to any good program and is key to making sure all the other elements of the program work well together in a crisis. We often find that while management thinks they can handle this aspect without a plan or without testing the reality is that leads to confusion on who is in charge, and it delays the response as everyone tries to build consensus on what to do.

During a crisis, leadership needs to be clear on who is in charge, give them the authority to make rapid decisions and get the crisis management team to quick decisions rather than consensus. This takes planning and lots of practice.

Eric Krell: Are there any important changes taking place in the way companies are thinking about and managing business continuity management?

Brian Kinman: Companies are focusing on how to make their programs pragmatic and streamlined so as to make them easier to sustain and embed in the business. They are also focusing on continued integration of all elements.

Additionally, they are improving their crisis management program, which in the past tended to focus on worst case scenarios. Now they are starting to think about how to handle medium-sized crises as well as how they define crisis — moving away from the traditional natural and technological disasters to include other issues (e.g., reputational crisis like product recalls, protests, investigations).

Eric Krell: How and where does BCM sit with relation to an ERM program?

Brian Kinman: BCM is a mitigation to a risk that could be identified through ERM. Typically, the ERM program would not own the mitigation of this or other risk — the ERM program should help identify the need to implement elements of BCM and then monitor that the risk mitigation is being implemented and is sustainable.

Eric Krell: BCM attention and investment seems to occur in waves; BCM activities often surge following a major natural disaster or another event that painfully demonstrates the value of BCM capabilities. What are the downsides of this approach?

Brian Kinman: Actually, in our experience, while companies may want to talk more about BCM after a major disaster, most of them do not suddenly start a program. They may move up funding for it but funding doesn’t suddenly appear.

Some companies do reinvigorate their already existing or lagging programs after a crisis. For these companies, they almost have to start from scratch all the time — leading to extra cost and a lack of focus — starting and stopping a BCM program multiple times makes it extremely difficult to get the business people to support the efforts and commit to them since they see it as a waste of their time that will just go away if they wait long enough. These companies also have a hard time moving beyond the lowest level of program maturity, therefore, not getting the most out of the program.

For companies that have BCM in place and continuously support it and the importance of it, they are able to move more rapidly up the maturity scale, build support and have better responses to crisis. Some leading practice companies have managed to turn disaster into opportunities and steal customers away from competitors because they were able to show their resiliency during a crisis.