Rothstein Associates Inc. Business Survival ™ Weblog

What’s the future career path for today’s Business Continuity Management professional? Singapore’s Nathaniel Forbes has plodded along a BCM career path for 14 years, and doesn’t see a light at the end of the tunnel. All he sees is more tunnel.

Here’s a simplified job description for a BCM Manager in a multinational company in Asia, and maybe where you live, too:

1. Get lukewarm to tepid management support
2. Struggle for modest funding in good times, grovel for derisory funding in bad times
3. Perform a risk assessment (optional in many companies)
4. Lead reluctant business units through a business impact analysis (BIA)
5. Develop continuity strategies that don’t cost anything to implement
6. Write plans in a template, removing any opportunity for creativity
7. Set up (and maintain) a recovery site
8. Exercise, often without any element of surprise
9. Repeat endlessly.

Did I miss anything?

I’m not making a judgment about the value of BCM or BCM professionals. I am one. I’m making a judgment about the long-term prospects in our profession for the vast majority of practitioners today.

I know several regional, national or international BCM directors who get to travel, manage the work of others, make presentations at industry conferences, give interviews to reporters. But I hope they’ll be happy doing the same thing in 2020, because I just can’t see many of them moving up the corporate org chart. There may be exceptions, but I think they only prove the rule.

The future of a BCM career is cloudy from Day One. When I’m recruiting a BCM person, for example, I usually ask that old HR interview chestnut, ‘where do you see yourself in 5 years?’ The candidate never waxes rhapsodic about her vision of an upwardly-mobile future in the profession. She nearly always reacts like a deer caught in the headlights.

Your average BCM professional isn’t asked to contribute to strategic business decisions at the executive level or in the board room, at least not here in Asia. She is not involved in product development. She doesn’t generate any revenue. She doesn’t manage lots of people. She doesn’t sell anything to customers, or deliver after-sale support. She doesn’t produce financial statements or brief stock market analysts. She spends her time and the company’s money planning for possibilities that everyone agrees probably won’t happen. She’s a cost center, not a profit center. She’s part of the income statement, not part of the Vision Statement. Her closest friends are…internal auditors.

That simply cannot be a strategy for career longevity. If the choices are ‘up or out’…well, you know where the door is.

It’s just difficult to chart an upward career path for a guy whose job is to plan for The Apocalypse if asteroids never smash into the planet. He’ll never get to put on his cape and dash to the rescue. At least other departments get to crank up the lights-and-sirens now and again. A burglar breaks into the office: Security gets to hunt him down. An employee steals a purse, smokes dope, assaults a colleague or has a mental breakdown: Human Resources has procedures for all that. Caustic liquid spills on the warehouse floor? EH&S mops it up. The electricity fails, the lights go out, the HVAC shuts down, the toilet backs up: quick, get Facilities down here. Your computer crashes: ring up the Help Desk. The world economy melts down? Hey, that’s why CEO’s get those Big Bucks.

But a BCM manager? Inconspicuously hoping the world ends so he can justify his existence.

A soldier, a fireman, a cop and an ambulance driver have jobs that are often described as hours of boredom punctuated by moments of sheer terror. A BCM manager’s job can be characterized as months – no, years – of pushing wet spaghetti uphill, punctuated by infrequent moments of testing.

In my experience, a lot of BCM professionals simply get bored after a while. Business impact analysis (BIA) may be the foundation of all BCM programs, and doing it properly can take weeks or months. But it eventually boils down to filling in colored squares on a table to illustrate the impact of an interruption on business processes. Filling in colored squares on tables is unrewarding at best, mind-numbing at worst. The only thing more frustrating is trying to get management to pay attention to the chart with the colored squares.

Last year, H1N1 influenza seemed sure to be the stimulus package we needed for the disaster planning profession, particularly for those in North America who hadn’t had the excitement with SARS and bird flu we had in Asia in 2003 and 2005. Lots of masks, gloves and anhydrous liquid disinfectant were acquired and stockpiled. Tamiflu was in plentiful supply. (Companies weren’t allowed to buy it during bird flu because it was in short supply.) My mailbox overflowed like a runny nose with announcements for disease-related conferences and training sessions.

But in the end, this particular pandemic threat turned out to be no worse than the sniffles. Oh, well. Maybe next time.

The kind of people who like BCM like thinking about the unthinkable. We dig that momentary frisson when the alarm goes off. We get an adrenaline rush running to the EOC. We bathe in the testosterone high of after-action satisfaction. And we feel just a teeny bit smug to have been proven right after all. Oh, go ahead. Admit it.

But has this happened to you, too? I go to a party. I spot an attractive prospect. Unexpectedly, my pickup line works. The conversation burbles along. Then I tell her that I’m ‘in business continuity’. Her brow knits, her eyes lose just a bit of their sparkle. ‘Oh, you mean like computer crashes an’ stuff?’ ‘No, no,’ I say, ‘all kinds of disasters, like 9/11’. ‘Oh’, she says, hesitant. The corners of her mouth droop. She glances over my shoulder, smiles vaguely at someone. The moment goes limp. It’s over.

And this is when? Maybe 25 years after the first BCP was written?! And we haven’t come up with a better story line in all that time.

I hear the DRJ conference in the U.S. draws as many attendees as ever, so there must be new people coming into the business. The Continuity Insights conference in New Orleans reliably draws about 350 people every year, mostly senior BCM practitioners. The BCI says it got “almost 350” to its conference in the U.K. last November. BCP Asia’s conference and the BCM Institute’s ‘World Continuity Conference’ were both postponed last year for lack of enthusiasm; those events have each drawn about 100 people in the last couple of years. The number of people at BCM conferences is definitely not growing, and I think it’s declining. I think we’re mostly talking to ourselves at those conferences.

In Asia, the number of people wanting to get into BCM is growing much faster than the number of available jobs. I must get three inquiries a week just from India, where they’re turning out future BCM professionals, but where companies have not yet gotten that ol’ time BCM religion.

The future of BCM

So where is the BCM profession going? More importantly, where is your career going? Let me try to shine a light toward the end of the tunnel.

The notion of BCM as an organizational silo simply will not survive another decade at most western multinational companies, in my opinion. The urge to merge responsibilities will be irresistible. A CEO, a Board of Directors, a regulator all want just one person, one phone number to call when the business runs off the rails.

BCM intersects with so many other corporate disciplines that also contribute to corporate resilience – security, emergency response, environmental health & safety, risk management, disaster recovery, crisis management, to say nothing of human resources, facilities and corporate communications – that it just doesn’t make sense to build another, separate department. I expect that several organizational models that combine two or more resilience disciplines will be tried, and a few will become accepted management wisdom.

Whether those will result from friendly functional mergers or from hostile departmental takeovers is not yet clear to me. Probably both.

Some companies – Deutsche Bank in Germany, for example, and OCBC Bank in Singapore – have mooshed their BCM and Security functions together. It doesn’t always go smoothly; maybe BCM people are from Mercury and Security people are from Mars. And a head of Security is as unlikely to move up a corporate ladder as is a head of BCM.

The most likely combination in banks and service businesses is BCM with operational risk management (ORM), one of the many dialects of enterprise risk management.

My view of that approach is informed by a fateful chicken-and-the-egg question that I apparently answered incorrectly several years ago. SPRING Singapore had recently endorsed British Publicly Available Standard (PAS) 56 and was promoting it to Singapore BCM professionals, as a precursor to a future BCM standard. A guy from SPRING asked me over coffee whether I thought BCM was part of risk management, or risk management a part of BCM.

It was a pop quiz, and I flunked it. I said BCM was part of risk management. He said the correct answer was that risk management is a part of BCM. That’s still The Business Continuity Institute’s official view, too; check this slide from their BCM certification course, which I teach. I’ve never heard from SPRING since that day.

But BCM is considered subordinate to risk management in every board room I’ve ever been in. I think your answer to the question is quite relevant to any discussion about the future of BCM, and your future in it.

Your BCM future

So, what about you? What color is your BCM parachute?

A select few will climb the org chart by managing BCM for more territory or more headcount or both. Over a period of years, a local BCM coordinator could become a national BCM manager, then regional a BCM manager, eventually perhaps the global BCM manager. The number of positions available at the top of that staircase is miniscule, so that path won’t be accessible to most BCM professionals.

The rest of us are going to have to make some choices. They won’t be simple or easy. To advance professionally, we will either become responsible for more kinds of causes, or for more kinds of consequences.

By “causes”, I mean “risks”, and particularly those risks that executives, directors and shareholders think of as crises, emergencies or disasters: product liability (milk and lead poisoning in China), product recall (Sony laptop batteries), fraud (Bernie Madoff in the U.S., Satyam in India), hostage-taking (Caterpillar, 3M and Hewlett-Packard – in France!), kidnap & ransom (Somalia), identity theft, emerging infectious diseases (Africa and Asia), civil unrest (pretty well anywhere except Singapore), climate change (in Australia, to pick just one place), food security or bankruptcy (General Motors). My own favorite is water shortage (Australia, Asia, Africa).

None of those is considered a business continuity responsibility in any company I know of. All are a lot more likely than the end of civilization (despite last year’s movie 2012). All require sustained coordination among multiple departments, and across time zones. All require skills that most BCM professionals don’t have; no one else does, either, and that’s the big career opportunity, in my view.

By “consequences”, I mean those that result from destructive events (2004 Indian Ocean tsunami, 2008 Sichuan earthquake, Jakarta Marriott hotel bombings) that require First Aid, emergency response, incident command, environmental health & safety, shelter & feeding operations, volunteer management, EOC operations, crisis communications, psychological counseling, group or individual crisis intervention, even disaster relief. That will mean building bridges between professions, and making an effort to develop new skills. Visiting new web sites, reading new blogs, taking training courses on professional tangents, seeking new certifications, going to other organizations’ annual conferences.

We must offer something to hiring managers, recruiters and executive committees that merits promotion, that provides value, that addresses everyday risks, impact and consequences, that earns and deserves respect. To do that, the scope of our responsibilities and our skills at fulfilling them must grow. We must develop executive gravitas.

May I make just one suggestion? Do something completely different this year: go to a conference outside – but related to – the BCM profession. Exchange business cards. Visit the booths, pick up the literature. Take a few notes. Shake a few hands. Have a few drinks at the bar; go nuts and buy a round. Most of all, pay attention.

We’re in a bull market for disasters, but a bear market for resources to respond to them. Those trends look to be very, very long-term. The need for contingency planning for companies and communities – and for ourselves and our loved ones – is greater than ever. The value of a Department of Extraordinarily Unlikely Events, however, is lower than ever, and headed south.

By Nathaniel Forbes, Forbes Calamity Prevention Pte Ltd, Singapore.

©Copyright 2010 Forbes Calamity Prevention Pte Ltd, Singapore. Used with permission.