According to top responses in a recent poll of 600 financial executives accross the United States, the UK and Europe:
33% - Insufficient Time
23% - Inadequate Personnel
19% - Insufficient Budget
13% - Not Viewed as a priority
Does this mean that the Board of Directors has transfered risks using vehicles like insurance? The same study asked what percentage of risk management budgets are allocated to "Risk Control" vs. "Risk Transfer":
Risk Control - 56%
Risk Transfer - 44%
While there are new and innovative new insurance policies being marketed these days, these typically can not cover many of the losses from damaged corporate reputation, a drop in market share or lost sales. As Board of Directors raise the priority above a 13% response, this should cascade to impact the insufficient budget. Now the question remains on how to deal with the "Inadequate Personnel" and "Insufficient Time".
You can hire dedicated people, add additional responsibilities to existing personnel or you can even Insource. In every case, you will need to find more time for planning and training to make sure that new risk controls are implementated and monitored. Without a systematic program that is culturally institutionalized, even these new initiatives will fail.
To quote one of the leading global business continuity membership organizations Survive:
Business Continuity Management is about not making excuses. It's about being wise before the event. It is a state of mind that understands great organizations never moan they didn't do well because of the state of the economy, a fire at the warehouse, an internal fraud, or a strike by a key group of workers. Great organizations do well anyway.