measuring roi in bcm programs - mha consulting€¦ · reporting on roi •so, what does my bcm roi...

© 2017 MHA CONSULTING. ALL RIGHTS RESERVED.

Measuring ROI in BCM Programs

Business Continuity Management ROI Is the New BlackSponsored by BCMMetricsTM

March 8, 2017


MHA CONSULTING, INC.

• An 18-year proven track record of

applying industry standards and

best practices across a diverse

pedigree of clients.

• A simple mission: Ensure the

continuous operations of our

client’s critical processes.

• Services include Business

Continuity, Crisis Management,

Disaster Recovery, IT Best

Practices, and Physical Security.

• SaaS toolset: BCM Compliance,

Residual Risk & BIA On-Demand.

SENIOR LEADERSHIP

KEY FACTS

SAASCompliance

and risk tools.

CAPABLEComprehensive suite of services.

15Average years

industry experience.

Years inoperation.

GLOBALDiverse, global

client base.

18

Michael A. Herrera, CBCP Chief Executive OfficerPhoenix, Arizona www.mha-it.com

1


HEALTHCARE EDUCATION FINANCIAL INSTITUTIONS

CONSUMER PRODUCTS INSURANCE TRAVEL & ENTERTAINMENT GOVERNMENT/UTILITY

SERVICES

DIVERSE, GLOBAL CLIENT BASE

2


• Business Recovery Strategies

• Data Center Recovery Strategies

• Current State Assessment

• Business Impact Analysis

• Threat & Risk Assessment

• BCMMETRICSTM

Compliance Confidence (C2)

• BCMMETRICSTM

Residual Risk (R2)

• BCMMETRICSTM BIA On-Demand (BIAOD)

• Training & Awareness

• Mock Disaster Exercises

• Plan Functional Walkthroughs

• Alternate Worksite Exercises

• Crisis Management

• Business Recovery

• IT Disaster Recovery

• Update Recovery Plans

• Update Current State Assessment

• Update Business Impact Analysis & Threat Assessment

COMPREHENSIVE SOLUTIONS PRACTICES

EXERCISES MAINTAIN & IMPROVE

ASSESS THE CURRENT

ENVIRONMENT

RECOVERY STRATEGIES/ SOLUTIONS

RESPONSE & RECOVERY PLANS

3

© 2017 MHA CONSULTING. ALL RIGHTS RESERVED. 4

AGENDA

• What is Return on Investment (ROI)?

• Why you should know your ROI.

• How to measure ROI.

• Reporting on ROI.


THE BCM ENVIRONMENT

• Stringent legislation, regulations, and standards require business continuity measures be verifiable.

• Hyper-vigilant, focused regulators, auditors, and customers.

• Management is increasingly being held to higher levels of accountability for gaps in BCM.

• Non-regulated businesses in all industries are now being required to show evidence of BCM.


DEFINITION

• The amount of return on an investment relative to the investment’s cost.

•Why should I care about the ROI of my BCM program?

•A high ROI promotes management’s confidence in the foundation and recoverability of your program.

WHAT ISRETURN ON INVESTMENT?


THE VALUE OF ROI

It is an important metric to:• Defend your resources (money, people, time) and how

they are being used.

• Improve support for your existing programs.

• Create approval and funding decisions for new projects and programs to improve the program.

• Demonstrate the contributions of your team to the organization.


MEASURING ROI

• What factors are critical to determining BCM ROI?

• Common ROI benchmarks:–Savings in staffing, equipment, and insurance

–Potential savings in lost revenue, fines and penalties, and reputational damage

–Volume of work completed (BIAs, Plans, Exercises, etc.)


MEASURING ROI

• Traditional – evaluate and assess savings:–Compile costs of program elements

–Determine cost savings, potential savings

• The Future – develop a new methodology:–Assess and quantify compliance in your program

– Evaluate and quantify the residual risk

–Calculate your BCM program ROI


BCM ROI = ENTERPRISE COMPLIANCE & RESIDUAL RISK

THE ELUSIVE BCM ROI

10


Considerations

• Management Oversight• Policies and Standards• Methodology & Approach• Documentation

Assesses

• Program Dimensions (Program Admin, Crisis, DR, BRP, etc.)

Output

• Levels of Compliance/Alignment with Standards

• Does our Framework Provide a Foundation for Recoverability?

COMPLIANCEI S B E I N G I N A S TAT E O F A C C O R D A N C E

W I T H E S TA B L I S H E D S TA N D A R D S ,

G U I D E L I N E S A N D D I R E C T I V E S . T H I N K O F

I T A S T H E F I T N E S S R E G I M E F O R B C M .

COMPLIANCE

11

Fitness Level

• 0 to 60: Poor level of fitness.• 61 to 79: Moderate level of fitness.

• 80 to 100: Superior level of fitness.


RESIDUAL RISK

RESIDUAL RISKI S T H E R I S K T H AT R E M A I N S A F T E R A L L

E F F O R T S H AV E B E E N M A D E T O I D E N T I F Y

A N D E L I M I N AT E T H E R I S K S . T H I N K O F T H I S

A S G A M E T I M E E X E C U T I O N .

Considerations

• Inherent Risk • Risk Tolerance• Mitigating Controls• Residual Risk

Assesses

• Individual Business and IT Recovery Plans (Critical)

Output

• Level of Residual Risk (within or outside tolerance)

• Demonstrates Game Time Execution based on Risk Tolerance

12

Game Time Execution:

• Within Tolerance: Execution meets mgmt risk tolerance.

• Outside Tolerance: Execution does not meet mgmt risk tolerance.


ENTERPRISE BCM ROI SCORE = WEIGHTED ENTERPRISE COMPLIANCE

PERCENTAGE SCORE + WEIGHTED ENTERPRISE RESIDUAL RISK

PERCENTAGE SCORE

THE ELUSIVE BCM ROI

13


MEASURING ROI

•High Compliance/Low Residual Risk = High ROI– Solid foundation

– Recovery plans operating at optimal level

– Investment is being optimized

• Low Compliance/High Residual Risk = Low ROI– Poor foundation

– Recovery plans operating at minimal levels


REPORTING ON ROI

• So, what does my BCM ROI number tell me? It gives insight into these key areas:–Foundational Fitness –Use of Resources –Level of Execution–Risks and Gaps –Ability to Recover

BCM ROI

• 0 to 60: Poor ROI.

• 61 to 79: Moderate ROI.

• 80 to 100: Superior ROI.


SUMMARY

• What is Return on Investment (ROI)?

• Why you should know your ROI.

• How to measure ROI.

• Reporting on ROI.


UPCOMING WEBINARS

• Get the BS out of the Business Impact Analysis, Richard Long

– WEDNESDAY MAY 10, 2017 AT 11:00 A.M. Pacific Time


Michael A. Herrera, CEOMHA Consulting, Inc.

[email protected]

Office: (888) 689-2290 Mobile: (602) 708-1718

18

measuring roi in bcm programs - mha consulting€¦ · reporting on roi •so, what does my bcm roi...

Documents