Tips for Building a Business Case

Today in Security: Tips for Building a Business Case

Bonnie Michelman, CPP, executive director of police and secure outside services at Massachusetts General Hospital, and Lynn de Vries, CPP, PCI, director and senior consultant at DutchRisk, presented a recent webinar on “Building a Business Case.” The webinar, available free on-demand for ASIS members, provided tips and strategies for justifying investments in security initiatives. The webinar was also part of ASIS International’s Content Series on Management and Leadership.

During the presentation, Michelman, a former ASIS International president, discussed the principles of the Balanced Scorecard approach in developing a security project strategy. When thinking about the outcomes of the initiative, security professionals should address the following:


“You want to have several different goals," Michelman said. "They don’t have to be equal, but they have to be in some relational proportion. You have to have some financial goals. You have to have some consumer goals, whoever your customers are whether its employees or stakeholders or staff or boards or customers.

“You have to have some process goals so that you’re ensuring your process… aligns with the overall mission of the organization. And people goals: Is your strategic plan, is your process, going to be what you need it to be for the people that are involved? Will it help leverage them? Will it help elevate them? Will it be part of their development?”

Michelman also discussed the importance of storytelling to getting buy-in for initiatives, including best practices on building an effective story that burnishes a business case:


“People who get their business case studies accepted are people who really know how to tell stories," Michelman said. "The first thing is they open with the outcome. It’s almost like watching Shark Tank--those people always start with what their products are going to be and what they’re going to do, not with a lot of detail around it first. They get to the detail after. Opening with the outcome and numbers gives credibility to the case study immediately; by saying something like if we put in place this technology, XYZ Corporation can achieve a 79 percent increase in 21 days or lower support calls to the GSOC by 47 percent in three months. Whatever those things are, they make a huge difference in being able to sell your story.

“We also want to capture the current situation, and you have to do that with context and challenges. Describe the business context and outline the challenges and issues and be honest about that and the risks that will face you in doing that. People want that. They want to know you’ve thought about that, you’re being completely transparent about that, and then if you still say 'This makes good sense,' they’re going to be much more inclined to support that.

Michelman also recommended describing the impact overcoming the challenge will have and its ultimate resolution.

“What will the impact be of what you want to do? The impact of the challenge, not necessarily a product," she explained. "What will the challenge be? What will the cost be? What will the lost cost be if you don’t do this? What will the missed business opportunities be?

“Show a resolution. Your story needs to show how you helped your customers or your constituencies overcome their obstacles or achieve their objectives that they would not be able to achieve without doing whatever it is your business case is suggesting you want to do. You want to qualify and quantify when you can your success. And you do that in terms of profit, productivity, efficiency, and a decrease in costs and certainly risks that your new product will help control or mitigate against.”