Sub-prime BCM certification in Asia

What does it really mean for an individual to be "certified" in business continuity?

Like the euphemism "sub-prime", the word "certified" is losing its meaning in Asia as the number and variety of BCM certifications and their purveyors grow like vines in a jungle. Attend a course, get the certificate and poof! You're certified!

In Asia, for example, you can become certified by a company cleverly-named the BCM Institute (BCMI) as a Business Continuity Certified Professional (BCCP) with no prior BCM experience if you fork out US 840, spend one day in a class and another half day answering fifty questions on a test. You do not have to answer all of them correctly. That's a fast-track bargain by any standard. The BCMI offers plenty more certifications, too.

Or you can become certified by The International Consortium for Organizational Resilience (ICOR) in Asia as a Certified Crisis Team Leader in three days for US 2,200. Or you can become a Certified Media Spokesperson for 800 bucks in just nine hours (no examination required). I say, bring on the Exxon Valdez disaster: your spokesman is ready.

Long on ambition but short of time? You can be certified as both a Crisis Management AND Communications Professional (CMCP) in as few as four days. It costs US$3,700, but, hey, you only have to get a 'C' grade (75 percent) on the exam. You must also list two years of experience, but doing what?

I haven't taken any of these courses, and have no reason to think there is anything wrong with the companies, the courses or the instructors. I know many of the individuals professionally. I do not infer that students are wasting their money or time by taking these courses.

But it's silly and misleading to think of those who take the courses as being "certified" in anything.

Just how meaningless can the word "certified" be? Unrelated to BCM but nevertheless illustrative, in Singapore you can become a Certified Service Professional (CSP) in just five days for only US$430. A government program aimed at improving the interpersonal skills of fast food restaurant workers, retail clerks and hotel receptionists, it is advertised on the sides of public buses here. What can the exam questions be? 'Fill in the blank: "May I ____ you?"' It would be risible if it weren't so derisive to both service workers and to the concept of certification.

The Certified Business Continuity Planner (CBCP) designation awarded by the American DRI International (DRII) and the Member of the Business Continuity Institute (MBCI) awarded by the British Business Continuity Institute (BCI) are qualitatively different than certifications offered by private companies (BCMI) and associations of trainers (ICOR). Both DRII and the BCI:

•  are nationally-chartered non-profit organizations;
• use exam questions developed by panels of professionals, and create different combinations of 125 questions for each exam;
• administer exams on-line and score them by machine (and also require scores of 75 percent to pass);
• require applicants for certification to submit a written application of biblical proportions listing verifiable experience, with references. My BCI application was 3 inches thick and took months to complete. I never submitted a DRII application after I passed the test; it was too much work;
•  assign at least two professionals to review each application independently of each other; and
• offer certifications that have been recognized around the world for many years.

Certification inflation
There is an inherent conflict-of-interest in being both teacher and examiner of the same students. How many courses would a company sell if it routinely withheld the certificates from students paying them for courses? Not very many. It is, therefore, difficult to imagine them NOT giving certificates to most of their students. The commercial motivation to attract more students is greater than the educational motivation to uphold academic rigor. For that reason, the BCI and DRII license people and companies to teach their approved BCM curricula, while retaining independent control over the testing, scoring and application processes.

I figure the pass rate for people taking the DRII and BCI exams in Asia has been about 60 percent over the last two years, and I estimate fewer than 200 people have taken those exams in that time. I have no idea what the pass rate is for those taking BCMI or ICOR exams, but I'm sure it's not lower than that, and I imagine it's much higher. I guess (I do not know) that more than twice as many people have taken their exams during the same period than have taken the DRII or BCI exams. I've never met someone who didn't pass a BCMI or ICOR exam, but I've met lots of people who didn't pass the BCI and DRII exams. Unhappily, it is the ones who don't pass who create perceived value in the achievement of those who do.

The growth of companies offering BCM certification in Asia is a lamentable direct consequence of somnambulant marketing by both DRII and the BCI. Both are nearly asleep in Asia, despite having large numbers of members here and despite Asia's cultural predilection for education and training. Into the void left by DRII and the BCI, Singapore-based BCMI launched a tremendously-effective marketing juggernaut in 2007. A principal from ICOR is in Asia regularly, actively recruiting trainers; few weeks go by that I don't receive an ICOR email. Principals of both BCMI and ICOR were former leaders at DRII who know BCM, know training and know their competition. And they're much better marketers.

The multiplicity of affordable (read: "inexpensive") certifications in Asia is also the result of good, old-fashioned supply-and-demand. The DRII and BCI five-day certification courses cost over US$3,000, not including the cost of the examinations. That's a large tab for any middle manager, but in India, it's three months of salary for an IT employee, and in China, it's a year's salary. BCMI very astutely created wallet-sized slices of curricula and sells them separately at much lower prices, the same way Apple made it possible to buy just one song instead of the whole CD. And what happened to the market for CD's as a result of iTunes?

The basic difference between the competitors is their motivations: BCMI and ICOR do what they do to make a profit. DRI and BCI do what they do for...prestige? Pride? A higher purpose? The results in the commercial competition seem inevitable to me.

Why get certified?
The main benefit is to you, the individual, of course: you may get paid more than someone who doesn't have certification. That's a significant benefit, but only if you have certification and the other guys don't. If everyone has one, your certificate is just office wallpaper.

I guess that holding a major certification is worth about 10 percent more in salary, but that's folk wisdom, not fact. The 2006 Asia BCM compensation survey of recruiting company BC Management reported that professionals with certifications got paid more, and that almost 25 percent of those who reported that they got raises attributed them to getting certified. That report didn't specify which certifications earned more money, but stay tuned for BC Management's 2008 Asia compensation report, due out in March. My colleague Paul Kirvan wrote in January that some IT-related certifications are as valuable as ever. Here's a list of what I consider the major resilience certifications for individuals.

A BCM credential is not the only way--not even the preferred way--for an employer to know that an individual is competent in BCM, however. Whether hiring an employee or a consultant, an employer relies far more on the recommendations of past employers and professional references, focusing specifically on what a person has done, what he or she has accomplished. A certification just helps a candidate clear the first screen of applicants.

Are there benefits to a company, then, of an employee's certification? Sure, if the certification has credibility. But I can name at least a dozen people in Asia who don't have certifications who are successfully leading BCM programs at large companies. It seems to me that certification of a company's BCM program is more valuable to a company than certification of its BCM managers. Organizational certification is, in fact, the focus of the British Standard 25999, the new Singapore Standard 540, and the nascent U.S. Private Sector Preparedness (PS Prep) program.

Certification devaluation
I'm not ready to say that BCM certification for an individual is not valuable--yet. But there's a sense that those who can (do BCM), do, and that those who can't, get certifications.

Oh, I can hear an entire industry howling already. Stop. I'm just winding you up. Training is essential, in BCM as in any profession. I hand out certificates of attendance for the courses I teach, too. In Asia, educational credentials are highly valued and their holders highly regarded.

But you can't go to high school for a week and get a diploma. You can't go to trade school for a month and get a certificate to be a plumber. You can't go to university for a semester and get a business degree. You can't get a license in any profession that affects human health or safety--doctor, nurse, airplane pilot, bridge inspector--without years of practice. But you can be certified in a week as a business continuity or crisis management professional.

I know plenty of people who are great BC managers who are not certified, and even more who are certified who are not great BC managers. You probably do, too. And proliferation of less rigorous, less credible certifications will lead to inflation in the latter category. The more sub-prime certifications there are, the less any of them is worth.

What should "certified" mean?
I think "certified" should mean not only that an individual knows what to do and how to do it, but that he or she has demonstrated that he or she has actually done it in practice.

A Certified Public Accountant has passed the Uniform Certified Public Accountant Examination developed and maintained by the 350,000-member AICPA. A CPA not only knows the rules but can apply them to your financial records. You trust a CPA to do your books according to internationally-accepted standards. You assume you probably won't go to jail if you hire a CPA. (There have been some high-profile exceptions to that statement that prove the rule.)

A Certified Emergency Manager (CEM) has demonstrated real-world experience managing an emergency or a full-scale simulation, has had at least 200 hours of documented training, passed a 125-question exam, written an essay on emergency management (EM), made written or oral contributions to the EM profession and had all his or her credentials reviewed by at least two volunteer peers. The certification is awarded by the International Association of Emergency Managers (IAEM), a non-profit, independent professional association of 4,000 dues-paying members. You think yourself more likely to live through an emergency if a CEM is managing it.

A Microsoft Certified Professional has passed that company's extensive training in its ubiquitous operating system and passed its test. True, Microsoft sells the software, then sells the training and then awards its own certifications. But they're not pretending their certification is somehow independent or non-commercial, and I wouldn't trust any other organization to do a better job of certifying competence in its Byzantine software. You assume a guy certified by Microsoft will be able to fix your computer when it crashes.

The same business that hires that CPA, CEM or MCP should be able to assume that a certified BC professional can keep the business going, can keep the employees alive and can keep the boss out of Senator Sarbanes and Congressman Oxley's jail cell, because she's demonstrated both knowledge and experience managing the continuity of someone else's business.

As some bankers gave sub-prime (read: "bad") mortgages to some people who couldn't afford them, some trainers in Asia are giving BCM certifications to some people who aren't yet ready for them. It isn't a crisis yet, but you can sure see a bubble forming .

Disclosures
I have a commercial and professional interest in BCM certification for individuals because:

• I have MBCI certification. I also passed the CBCP exam in 1997;
  
• I practised BCP full-time as a consultant for 11 years without a certification;
  
• I am a trainer for a company that offers the BCI certification course in Asia. That company competes with BCMI, ICOR and DRII in Asia;
  
• I am a member and officer of the IAEM that awards the CEM certification; and
  
• I am a business associate of recruiting firm BC Management, Inc.
  

• Talkback (6)
• Print
• E-mail
• Share
• Alerts

• Sample influenza business continuity plan
• No blood test for influenza
• Getting tested for H1N1 flu in Singapore
• Is Tamiflu 'better' than Relenza?
• BCM standard discovered in Malaysia

• Internationally-recognized BCM certifications for BCP professionals
• Sub-prime BCM certification in Asia
• Transportation Silliness at Airports
• Getting credit for having a BCP
• Tuning out supply chain risk

2009

2008

2007

2006

• What Y2K can teach us about 2012
• In remembrance: DRMs
• My favourite new features of Windows 7
• Learning to embrace Net without fear
• Changing of the IT guards

Nathaniel Forbes

Nathaniel Forbes is the director of Forbes Calamity Prevention, a Singapore-based consulting firm providing business continuity, crisis management and emergency response advice and training to multinational companies, with a focus on companies with offices in Asia. The firm is 10 years old. FCP's current and past clients include Singapore Exchange Ltd, OCBC Bank, AXA Insurance, The Gillette Company, Siemens and ABN Amro Bank. A former President of the Singapore Computer Society’s Business Continuity Group, Nathaniel passed the DRII’s Certified Business Continuity Planner (CBCP) examination in 1997. He has lived, traveled or worked in Asia since 1973.