First of all, what is a Key Performance Indicator (KPI)? It is a management and development tool used by companies to help them make decisions, obtain a picture of the situation and manage risks. These indicators can be applied in various contexts, but in this article, we will focus specifically on everything related to the resilience of an organization: business continuity, emergency measures, IT recovery, etc. Since the objective of this article is to raise your awareness, we will limit ourselves to a few brief explanations.
Some examples of Key Performance Indicator
- Percentage of emergency operations centers in compliance;
- Compliance between available headroom compared to acceptable operating thresholds for the organization;
- Degree of reliance on external resources for critical operations;
- Status of progress on risk analyses;
- Business continuity plan scenarios;
- Latest dates for updates to business continuity plans;
- Number and types of exercises conducted in the past year;
- Proportion of role holder alternates who participated in an exercise
- Proportion of recommendations completed as a result of exercise reviews;
- Proportion of critical providers that have a maintained and tested business continuity plan;
- Proportion of critical technologies hosted on cloud;
- Proportion of outdated or obsolete technologies supporting critical activities/operations;
- Degree of dependency on external technologies;
- Progress of work to implement a backup solution for critical technologies;
Role of Key Performance Indicator within resilience
The primary function of resilience Key Performance Iindicators is to obtain a snapshot of the situation and clearly measure gaps to obtain an assessment of resilience risk posture and readiness. They offer the ability to compare results periodically and determine the achievement of performance thresholds (e.g., on internal comparables or via external benchmarking).
Evaluated during the implementation process, during updates, training sessions, during or after an incident, or following an exercise, performance indicators are defined as soon as a resiliency plan (e.g.: business continuity) is designed by asking questions about the following aspects:
- What do we want to measure?
- What exactly do we want to know?
- What trend/evolution do we want to observe?
- What gaps require adjustments?
- What are our resilience capabilities?
- What are the gaps in resilience?
- What is the posture of our resilience risks and vulnerabilities?
- Are our resilience goals being met?
There is a wide variety of performance indicators available through the scientific literature and recognized good practices in resilience. In addition, it may also be appropriate to design and use internally developed indicators to consider certain specificities. It is therefore important to leave yourself some latitude to define those that are unique to your organization. However, it is also mandatary to find the right balance between the number of indicators used and the quality of the resulting information.
To determine which ones are most appropriate, it is possible to obtain information from reliable sources, some of which are free, as well as from various recognized organizations and universities. It is also possible to participate in industry surveys to find out which indicators are most used by companies in the same sector.
How to report Key Performance Indicator?
The Key Performance Indicator shall be consolidated in a dashboard to simplify their understanding and to compare their evolution. Ultimately, the dashboard must be given to management, who can then judge the results, determine if the company is in a good position and make the necessary decisions.
At Benoit Racette Services-conseils inc. we can help you develop the different plans your company needs: business continuity plan, crisis management plan, emergency preparedness plan, disaster recovery plan (IT), etc. We can then guide you in determining the performance indicators that are most relevant to your organization. Contact us now: [email protected].