184.108.40.206 Exercise 3: Devise Metrics (Both Qualitative and Quantitative) for Each of the Mapped Continuity Program Components Finally, the groups were asked to brainstorm the possible metrics for the linked components. Best accomplished in a workshop setting, brainstorming and documenting qualitative and quantitative metrics is a valuable process. The groups developed a draft set of likely metrics, both quantitative and qualitative. In actual practice, this working model should be drafted by the metrics project team. Several of the workshop groups set up matrices similar to Exhibit 113.4 that illustrated the connection between components of the program that support value drivers and an associated metric. Developing Realistic Continuity Planning Process Metrics 1519
At the conclusion of the exercise, each workshop group executive presented examples of qualitative and quantitative metrics for as many of the individual continuity planning program components as possible, time permitting. 220.127.116.11 Workshop Wrap-Up Following the conclusion of the discussion, but in most cases because we simply ran out of time, the results of each group’s work were collected and consolidated. Exhibit 113.5 presents a high-level consolidation of the most significant output of the group sessions. 18.104.22.168 Workshop Conclusions The bottom line regarding metrics for continuity program performance was that, unfortunately, there are no predefined lists or readily accessible menus of metrics available on the Internet or elsewhere. Using another organization’s metrics will help to ensure that your program meets the needs of their stakeholders, not yours. Metrics must be customized and focused on the particular organizational entity. They must also be facilitated in-house, and use of the metrics development process recommended EXHIBIT 113.3 Mapping Value Drivers to Continuity Program Components Continuity Program Components Value Driver Mapping Continuity program component: Assess Current state assessment Value driver 3a, 3b (as an example only) Business impact assessment (BIA report) Etc. Business driver(s) analysis Etc. Risk appetite analysis Etc. Risk assessment/risk management review (emergency response procedures, mitigating control implementation) Etc. Benchmarking/peer review Etc. Recovery alternative rough order of magnitude overview Etc. Continuity planning process assessment Etc. Continuity planning business capability analysis Etc. Continuity program component: Design/Develop Etc. Continuity strategy development Etc. Facilitated continuity strategy process Etc. Cost-benefit analysis Etc. Strategy development (crisis management approach vs. plan-centric approach) Etc. Action plan and schedule Etc. Business management review and approval Etc. Design testing, maintenance, awareness, education, measurement strategies Etc.
You've reached the end of your free preview.
Want to read all 514 pages?