The Women in Business Continuity Management (WBCM) committee shines a spotlight on accomplished women in resilience. For the inaugural issue of the DRI Foundation e-newsletter, members of the WBCM committee conducted interviews with some of these women. WBCM’s Diane Doering interviewed AnneMarie Staley, CBCP, MBCI, and Chair of the Board for the DRI Foundation.
Thank you for taking the time to share your thoughts with me today. If we can jump right in, please tell me how you got into BCM. Did your background lead to BCM?
I fell into and in love with BCM at the same time! I was the Executive Assistant to the President of SIAC. He managed the data centers and asked me to take this on. My organizational skills really helped me be good at what I do.
Why did you pursue business continuity certification? How has this been beneficial to your career?
BCM is a new field. It was only recognized three years ago by the Department of Labor, you know. Certification helps with credibility, I believe, though it’s hard to quantify exactly how it translates to salary since these vary widely by industry and area. If you have it, it’s helpful, but it doesn’t necessarily get you more money – it gives you credibility and helps you grow your reputation. It shows you’re going in the right direction. Certification is a standalone, not like an MBA, though more companies list it as a preferred qualification these days.
What is the one characteristic you believe every leader in this field should possess?
Thick skin! And lots and lots of patience. You need to be serene – not easily upset or jostled. You need an agile mind, and McGuyver-like instincts! Things won’t go as expected, you need to adjust on the fly or with the resources available to you. I love when there’s an incident to be able to respond efficiently. I’m always amazed by the wants or needs during a crisis. Sometimes people forget that it’s business survival, not business as usual! During Hurricane Sandy I was at the NYSE. I had to shake my head that some wanted all the bells and whistles in an emergency. Like special coffee – some people requested an espresso machine!
When it’s calm, though, I take time to work on improvements to the data, plans, and look for ways to make it simple or easy to update plans.
You mentioned patience and diplomacy – what other characteristics are important for women, in particular, who manage and lead programs in this field?
Confidence. Being able to read people and situations, and empathy for what people want or what they’re going through. Put yourself in their place – how do they feel? You have to approach heads of departments with humor, or candid frank feedback – or a combination of the two. You have to let them know that you’re here to help, to hold their hand, if needed.
Embrace change! If you get into something and you don’t know it, you can learn. You’ll go crazy if you look at it from too high a level, so don’t stand still, instead adapt and become good at it. You never know what you can do until you try it! Prioritize pieces and get it done.
Multi-task. I can’t waste time. It’s what’s inherent in women that makes us good at BC planning. We do multiple things at the same time – we’re thinking about the meeting, and dinner, kid’s needs, always spinning the wheel. Men can be very linear, and they look to us to juggle things because we can do it.
Now for the thousand dollar question: how do you get others to perform requests for you if they don’t report to you?
You have to take a multi-tiered approach. First, I always try to connect with them face to face, use humor to build rapport. People like to talk about what they know well. Then I like to help make connections. We in business continuity get to look across the depth and breadth of the business to make connections. You might be able to help them with connecting to other parts of the organization.
I remind them that we’ve made a commitment to the company, and that we have a shared vision. If that doesn’t work then I remind them we both want to have a ‘satisfactory’ internal audit. Try not to use the internal audit “club” if you don’t have to. And I’m a facilitator, navigating the regulatory requirements.
Make it easy for them to complete their plans. And lastly, never let a crisis go to waste – there’s momentum and people are thinking about resources. If nothing happens it’s harder to get resources.
Tell us about a real-world situation or crisis that taught you important lessons – professionally or personally.
Do you remember the Northeast Blackout in 2003? I remember the exact time – it was 4:07 pm. Tree branches fell on power lines in Ohio and took down the power grid across the Northeast. We had generators which kicked in, but it impacted many people in the region. There are iconic pictures of people walking home over the Brooklyn Bridge. It was this incident that helped us get buy-in from senior management and we pushed for geographic diversity of our electrical grid.
What good advice did you get, professionally, that has helped you in the field?
Kathleen Kinney, an executive at the NYSE, talked about not being fearful because you’ll learn and get it. She told us not to be reckless, but to be fearless.
The other advice was don’t be afraid to admit when you have too much on your plate. Men can admit it, but we women usually say “sure” and then just get more stressed. Find your voice and don’t take on a new project if you can’t.
It seems as though some of us who were working in the 70’s-80’s-90’s said “this is my territory” and didn’t want to share which made us take on more even when we knew it was too much.
Yes. But that’ll change. It’s the younger women who will change. We’re forging a new business role: to act as a leader, we serve our staff. We need to share knowledge and get them what they need to do their job.
What advice do you wish you had gotten? What advice would you give a mentee, either what to do or what not to do?
To listen, and then listen more. Don’t get caught up in our own feelings of inadequacy. Always do the right thing, such as advocating for a colleague by standing with them or standing up when it’s hard. People gossip, and they know who does the right thing.
We balance on a high wire. We’re focused on the organization’s bottom line and connecting with corporate values of doing the right thing. We constantly have to weigh that. Your gut knows.
What career paths do you see people taking either into or out of BCP?
I see people coming with a degree or in the field of psychology – you need to understand what motivates a person to help lead people and be a good facilitator. This role allows people to have a high understanding of the organization and to build great relationships across the board and to translate that into program needs. Few folks have insight into each piece of the organization.
What groups do you work closely with, or overlap on mission or actions?
Risk management, governance, and compliance – the usual suspects. One thing I love about BCM is that it’s portable – resiliency is something we should always have. Bottom line: we have to continue operations.
Can you share with me what value do you think companies get out of doing annual tabletop BC/DR exercises?
Exercises are good for the executive team. It’s an important way to remind them of key processes. For this, it’s important how we manage the exercise. I like to bring in a subject matter expert who has the expertise to set the scenario and their frame of mind. We brought in Bill Evans, who’s a weatherman, to talk about hurricanes. We’ve also brought in FBI agents who are cyber security experts to talk about the dark web. They told us that our Amex cards are already on the dark web! That really gets people thinking about the scenario.
BCM should be embedded in the culture of IT and all that we do. Certain exercises are inadequately designed or performed but we are already testing them on a regular basis. Take remote working, for example. It’s a good test that we should be doing throughout the year. We don’t have to wait for an annual test to assess how it’s working. Recovery people already know what to do so these exercises are not adequate for them. For these exercises to work you really want to engage. We use ‘fake’ videos and news reports that provide additional information to make it real.
How important are business impact analyses to an organization to help them with resiliency planning?
BIAs can be used in so many ways. It’s a good snapshot of processes and interdependencies. They can really help in designing your resiliency strategy. It’s also a great tool to identify and understand gaps. It informs IT about recovery point objectives, etc. BIAs capture various functions. No one wants to feel like chopped liver! They want to know that they’re an important cog in the machine. A BIA is another tool in our tool shed.
There’s more than one way to do BIAs. They inform how you design your program and the types of questions you ask. BIAs are a tool to articulate what the business wants. They inform how to spend IT dollars – for example if you want to have an active-active environment, you’re going to have to spend money.