When you're weighing up whether to do your business continuity management (BCM) yourself, or to outsource it, there are many things to take into account says Willem Olivier, GM: Africa. ContinuitySA

As we all know, the value of an effective BCM is becoming more widely appreciated as companies take sustainability more seriously. Nowhere is this more true than in Africa, where businesses are gearing up to take advantage of the continent's opportunities but find their ability to compete hampered by unreliable national infrastructures and a lack of BCM experience. Many are finding that a credible BCM capability is a requirement for entering into solid partnerships with global companies, and to building a loyal customer base.

To many companies, it initially seems as though insourcing BCM makes the best sense—they reason it will be cheaper, everything will be under their control and they do not risk compromising data confidentiality. But in many cases these initial assessments fail to take into account the hidden costs and pitfalls of insourcing. Before making a decision, companies should consider the following issues:

Are there hidden financial costs? Building and equipping a recovery facility requires both capital and operating budget. Organisations should also not forget the expense of maintaining the equipment and facilities, as well as renewing the technology. Companies often forget that existing budgets such as facilities maintenance, will not be able to absorb the extra expense. Alternatively, removing expensive BCM infrastructure from the balance sheet is likely to be desirable, and syndication via an outsourcer invariable reduces costs substantially.

Are there hidden personnel costs? It's unlikely your staff has the necessary specialist BCM expertise, so these skills will have to be acquired—at a cost. Almost certainly, extra staff will have to be hired as an effective BCM programme is complex and ongoing. And don't imagine that your existing management capabilities (such as facilities management) will be able to absorb the extra work without hiring extra staff.

What are the hidden complexities of BCM? Commissioning a failover data centre and work-area recovery facility is actually the easy part of BCM on the vendor's side — and it's not that easy! Harder by far is developing the right business continuity plan in line with the company's strategies and risk appetite, and putting in place the complex business processes needed to ensure that, in the event of a disaster, the business can recover. What happens if the only or one of your key BCM resources is ill or away when a disaster happens? And, most important of all, are you testing the BCM solution regularly, and feeding the results back into the plan to ensure continuous improvement? Chances are that you aren't, simply because the time is never right, and today's business is always the priority.

The answer for many companies is a combination of in- and outsourcing, a solution that hopefully gives them the best of both worlds. But when making the decision, remember that there is never a dress rehearsal for a disaster—it's always for real. When the chips are down, having an expert by your side usually makes sense!