Disaster Recovery Journal Spring 2023

programs reported into a CRO (a decrease from 14% in 2018) but respondents from this year’s survey reported 23% now report directly into the CRO. As many businesses rely on technology, the CIO and CISO wield power and influence which BC programs can benefit from, but the constant barrage of headlining risk events puts more pressure on risk to own business continuity. n The variety of reporting structures continues to fall . The “other” response into which department or office ahead of business continuity reports fell again this year to the sixth most common response from fourth in 2021 and second in 2018 and 2014. When we prompted respondents to specify other, we discovered “legal” was the most common response. Legal lingers as the home for risk programs overall with 4% of all respondents saying risk management reports into general counsel/legal when the organization does not have a chief risk officer. BCM Program Funding Remains the Same for A Majority of Firms BC budgets jumped in 2021 unsurprisingly, but now the major ity of firms expect their BC funding in the next 12 months to hold steady along with the number of full-time equivalents dedicated to BCM. More specifically, Forrester found: n Many respondents expect increased funding, but not quite the majority . According to our study, 47% of respondents expect funding for their BCM program to increase in the next 12 months. This is a decrease over the 52% who expected more funding in 2021, but an increase over 2018 numbers (36%) which was largely unchanged from 2014. Now, 52% expect their funding to stay the same versus 42% in 2021 and 50% from 2018. The good news is respondents who expected their funding to decrease has fallen to 2% which is below the 2021 level of 5% and the 2018 level of 11% (see Figure 3-1). When asked what prompted the increased funding, respondents unsurprisingly cited – by far – to mitigate increasing or evolving risk to the organization (9 out of 22 respondents). n Staffing varies by company size, but the median is three full-time staff equivalents . According to our study, the median number of full-time equivalents (FTEs) supporting the BCM program is three, which is the same as 2021 and 2018. The mean is 9 FTEs but the number from very large enterprises drags up the mean. Staffing always varies by size. In Forrester’s experience, companies with fewer than 1,000 employees typically have only one or two FTE(s) supporting BC (4.46 mean, 2 median from this study), while enterprises with 1,000 to 4,999 employees have between two and three FTEs (10.27 mean, 3 median from this study). Enterprises with 5,000 to 20,000 have three to five FTEs

(6.07 mean, 2 median from this study), and those with more than 20,000 employees often have distributed BCM programs with five to eight FTEs (21.13 mean, 8.5 median from this study) establishing standards and oversight at corporate headquarters and dozens of local BCM leads in region or by business unit responsible for local planning and execution. n Staffing continues to represent the largest portion of the BCM budget . So much of BC maturity and preparedness depends on planning, so it’s no surprise staffing represents 34% of the BCM budget – only slightly larger than the 30% from 2021 (see Figure 3-2).

10 DISASTER RECOVERY JOURNAL | SPRING 2023