Development and implementation of a business continuity management risk index

Abstract

This paper introduces the concept of a business continuity management (BCM) risk index — a comprehensive metric that measures and reports the status of the primary ‘intended outcome’ of the BCM programme to top management. In addition to measuring the primary programme output, the BCM risk index can be used to demonstrate the overall value of the BCM programme to executive management. This is accomplished because the BCM risk index allows quantitative measurement of current risk levels and their comparison with established risk tolerances. The BCM Risk Index can provide executive management with reports on the risk level of individual business units, departments, subsidiaries or the enterprise in a way that drives both risk management and BCM initiatives. The name ‘risk index’ can be misleading, however. The BCM risk index concept can also be used to measure preparedness levels. In fact, implementation at DTE Energy has resulted in calling it the ‘preparedness index’, which is used to measure and report preparedness levels rather than risk levels. This paper will present the building blocks for developing and implementing the BCM risk index; whether it is used as a comprehensive metric for risk or preparedness.