Journal of Business Continuity & Emergency Planning Volume 12 Number 3

Why and how to employ the SIPOC model

Charlie Brown
Received (in revised form): 30th October, 2018
Primary Residential Mortgage, Inc., NMLS# 3094, 1480 North 2200 West, Salt Lake City,
UT 84116, USA
Tel: +1 800 255 2792 x1000120; E-mail: cbrown@primeres.com

Charlie Brown is Director of Enterprise Risk the issue, business continuity practitioners are
Management for Primary Residential Mortgage, increasingly expected to do more, and often with
Inc., where he is responsible for life safety, fewer resources and in condensed timeframes.
emergency response and business continuity. The SIPOC tool from Lean and Six Sigma,
He also chairs the company’s Risk Oversight which considers suppliers, inputs, process,
Committee and co-chairs the Information outputs and customers, gives business continuity
Security Committee. He has Associate Risk practitioners a practical alternative. By using
Management Professional certification from the experiences, expertise and tools of other
Charlie Brown the Disaster Recovery Institute International professions in a transdisciplinary approach, it
and instructor certifications from the is possible to accomplish the continuity impera-
American Red Cross and Federal Emergency tives of the business while adding value to the
Management Agency. He sits on the advisory organisation when resources available to the
board of Utah’s Be Ready Business Private practitioner are constantly being compressed.
Sector Preparedness Council and is a director
of sponsorships for the Northern Utah Chapter Keywords: SIPOC, BIA, business con-
of the Project Management Institute. He is also tinuity, business disruptions, Lean, Six
a member of the Utah Emergency Managers Sigma, continuity imperatives
Association and received the Private Sector
Volunteer Award for 2017.
INTRODUCTION
Abstract According to Rainer Hübert, ‘The business
Within the business continuity industry, the impact analysis [BIA] provides unreliable
debate regarding the business impact analysis and incomplete information, which needs
(BIA) shows no sign of being resolved. Fervent lots of time to be created, and is a compound
discussions online, at conferences and in busi- of workarounds to make up for strategic
nesses around the world continue to promote or faults in its basic concepts’.1 The SIPOC
dispute its value. This paper does not pretend tool — used for analysing suppliers, inputs,
to resolve that debate but offers a compelling process, outputs and customers — offers
alterna­
tive to achieve the outcomes entrusted a simple, nimble and rapidly developed
to the BIA and overcome the challenges in solution to these challenges. In process
obtaining them. Business disruptions, both from improvement the SIPOC is the ideal tool
Journal of Business Continuity natural occurrences and manmade, are occurring for identifying all relevent elements of a
& Emergency Planning
Vol. 12, No. 3, pp. 198–210 more frequently at the same time as business process improvement project before work
© Henry Stewart Publications,
1749–9216 continues to get more complex. To exacerbate begins. It helps define a complex project

Page 198
 Brown

that may not be well scoped and is typically Management (TQM) movement. TQM
employed at the measure phase of the Six evolved from Deming’s work in the
Sigma DMAIC (define, measure, analyse, 1940s around the concept of a manufac-
improve and control) methodology. It is turing process as a complete or integrated
similar and related to process mapping and system rather than a series of unrelated
‘in/out of scope’ tools but provides addi- processes. Work in an organisation can
tional detail.2 be explained by a collection of SIPOCs
In his book The Leader’s Handbook, — steps that precede and steps that
Peter R. Scholtes describes the SIPOC as follow; SIPOCs within larger SIPOCs
an elaboration of the systems diagram used within still larger SIPOCs.4 This concept
by Dr Edward Deming in his lectures to supports the easier identification of
Japanese industry leaders in the summer improvement opportunities by showing
of 1950.3 Scholtes is often credited with who supplies inputs to a process, what
developing the SIPOC, although the evi- they supply, what that process delivers
dence supporting this is mostly anecdotal. and to whom, and how the process
The SIPOC is an unpretentious and relates to the larger system. Using a
intuitive process diagramming tool for SIPOC within a SIPOC can provide
identifying suppliers, inputs, process, clarity to a process by describing in ever-
outcomes and customers. Figure 1 illus- increasing detail the relationship between
trates a SIPOC in its most basic form. a process and its dependencies to the
The SIPOC’s origins can be traced to processes preceding and succeeding it in
Edward Deming and the Total Quality the delivery chain.

Figure 1 A SIPOC in its most basic form

Page 199
Why and how to employ the SIPOC model

A SIPOC’s value and benefit are efficiently as zooming in or out on a map,

widely known and embraced in quality as in Figure 2.
management disciplines for being able Considering the versatility, speed and
to deliver a quick, simple and easy-to- ease of making a SIPOC, its application
understand overview of a process and as an indispensable tool for the busi-
its dependent components. However, its ness continuity (BC) practitioner becomes
value for addressing the challenges faced obvious.
by business continuity professionals, par-
ticularly those of a BIA, appears to Time/cost savings
be almost completely obscured to the A common lamentation among BC pro-
profession. fessionals across sectors and geographies
is the lack of time and resources. BC
professionals are continually called on to
WHY A SIPOC? do more with less. In the most recent
survey conducted by Continuity Central,5
Simplicity respondents were asked to report on ‘the
Of all the tools utilised by Six Sigma and biggest challenge that may hold back busi-
lean practitioners, the SIPOC is argu- ness continuity developments within your
ably one of the most intuitive and easy to organisation during 2018’. The survey
use. Once the recipient understands the found lack of time to be the second
acronym, the SIPOC essentially requires highest ranked challenge, with 12.9 per
no further explanation. cent of respondents expecting this to be
From the highest-level overview of the the top challenge in 2018, a dramatic
delivery chain to the most minute pro- increase from just 2.5 per cent in 2017.
cesses, SIPOCs can provide macro views At the time of writing, there is no
of the operational structure down to a universal industry standard for measuring
micro-examination of individual tasks that the return on investment that business
support a process, team, department or continuity provides an organisation. In
business unit and take one anywhere up a recent white paper, however, David
and down through the delivery chain as Lindstedt Ph.D., PMP, CBCP6 proposed

Figure 2 Business process

Page 200
 Brown

using the recovery value unit (RVU) to BIA. This typically involves eliminating
measure business continuity value and those parts prescribed by traditional BIA
calculate time to value for business con- standards where the information to obtain
tinuity activities. The RVU proposed is a quantitative response is either unavail-
the estimate of the value an activity pro- able, inaccessible or the time required to
vides to increase an organisation’s actual obtain it is excessive compared with the
continuity and recoverability capabilities. value. Although this is not atypical for
Lindstedt’s paper compares the estimated the BC profession, as most all require-
time to complete a BIA as outlined in ments for business continuity are delivered
the Business Continuity Institute’s ‘Good in the context of guidelines and one size
Practice Guidelines’ versus utilising a does not fit all, it does make it difficult to
SIPOC in the same context. Although the know exactly what information the BIA
comparison is not done with empirical will ultimately include or how accurate
data, as none exist, it is a valuable exercise that information will be, given that certain
for providing insight into the effort it takes required information is often unattainable
to complete an industry-accepted BIA as or based on guesswork.
opposed to a SIPOC. In the hypothetical As an example, consider activity-based
comparison, the BIA and the SIPOC were cost accounting to determine the financial
both estimated to provide the same 198 impact of a process being unavailable for
RVUs of business continuity value, but the a given period. Although it is theoreti-
time to complete the BIA was conserva- cally possible to determine critical business
tively estimated to take 870 hours, while functions using a BIA (see Figure 3),
the SIPOC would have been completed very few businesses have activity-based
in 84 hours. The SIPOC, providing the cost accounting built into their day-to-day
most relevant and reasonably attainable processes or as a line item on the general
information obtained by completing a ledger. In an organisation where this does
BIA, scored a time to value (TTV) of 236 not exist, it would be virtually impos-
per cent, while the traditional BIA scored sible to determine, with an acceptable
only 23 per cent TTV (BIA: 198 / 870 degree of accuracy, the financial cost of a
= 23 per cent, SIPOC: 198 / 84 = 236 process being unavailable for any period
per cent). Even without empirical data of time. The extent to which the disrup-
to substantiate the hypothesis, there can tion affected the process would also need
be no doubt that the SIPOC delivers to be known. The specific time and day a
much greater efficiency in discovering disruption occurred would have to be fac-
critical processes, suppliers, customers and tored into the equation as well. A payroll
dependencies than a BIA. A SIPOC takes system being unavailable on the day it is
significantly less time to complete than a used to run payroll would undoubtedly
BIA, while providing the essential infor- incur much more cost for the organisation
mation promised from the BIA about a than if that system were to be rendered
process to determine its value for recovery. unavailable three days after payroll had
The debate over time and effort when been run. Financial impact would be a
completing a BIA compared with the rela- guess at best and often an uneducated one
tive value, as well as the relevance of the because the data needed to determine the
information obtained, is a strongly con- cost ramifications do not exist or are not
tested issue among BC professionals. In available to the BC practitioner; thus, the
an effort to strike a balance between time cost of the system being down for a spe-
and value, there are many variations of the cific period is excluded from the BIA.

Page 201
Why and how to employ the SIPOC model

Figure 3 The formula to determine critical business functions using a BIA

Source: Asanar, Y. and Giorgini, P. (2008) ‘Analyzing business continuity through a multi-layers model’, available
at: https://pdfs.semanticscholar.org/6e26/4c79dfe3ec446fa1ebd9539189f373229086.pdf

Determining a priority for restoration operational structure, what processes it sup-

is problematic as well. The day and time ports and facilities, what subprocesses it has,
of a process being unavailable would most which processes it receives outputs from
probably change the priority of restoring and which processes receive its outputs, is
it. For an independent mortgage bank, all invaluable in determining disruption-
a document preparation system being specific restoration priority.
unavailable at 2.00 in the afternoon on It is becoming increasingly more
the first few days of the month is expo- common to find BIAs adapted to meet
nentially less critical than on the last the resources of the business or skill of the
few days — especially if it were the last practitioner rather than to satisfy the orig-
day to close refinance transactions with inal objectives of the analysis as prescribed
a three-day rescission period that must in any given industry standard, further
expire before funds may be disbursed. An diluting the BIA’s value for determining
outage at this time of the month would priority.
require all hands on deck to minimise the
impact to everyone down the delivery Business acumen
chain from the closing department, or The BC programme is unlike any other
— in the language of the SIPOC — the in the business. It is one of the few
customers. activities to span the entire organisation,
Although a SIPOC does not specifi- reaching across all business units, depart-
cally address the prioritisation of processes ments and processes. It reaches from the
for restoration after a disruption, it can front line all the way up to the executive
be very useful in understanding the rela- suite. It stretches from the suppliers of raw
tionships and dependencies between materials all the way to the end user. To
processes, suppliers and customers, and plan effectively for disruptions, the BC
thus providing insight into what makes practitioner must understand the entire
sense to prioritise based on immediate business operation.
needs (Figure 4). By looking at organisa- By combining SIPOCs in an organo-
tions in a larger systemic context, aligning gram (Figure 5), anyone, including
processes hierarchically, SIPOCs aid in vali- employees, management, executives and
dating or debunking assumptions regarding regulators, can see and easily understand
the criticality of a process by shedding the interdependencies and relationships
an unbiased light on their relationships. between processes within the business,
Knowing where a process lives within the from top to bottom and front to back.

Page 202
 Brown

Figure 4 Using the SIPOC to understand the relationships between processes, suppliers and
customers
Source: https://d2slcw3kip6qmk.cloudfront.net/marketing/pages/chart/examples/sipocdiagram.svg

BC practitioners can provide signif- participants engaged through the interac-

icant, immediate value throughout the tive nature of the process and the benefits
entire organisation by building and using they derive from it. Preferences for what is
SIPOCs. No other tool is as easy to use used to create a SIPOC are both personal
and generates better visuals of organis­ and situational. Almost anything works
ational processes. The BC practitioner is in — large coloured adhesive notes attached
a unique position to grow their influence to walls (Figure 6), whiteboard markers
and build business acumen by working on windows, tables in a word-processing
with process owners, teams, departments document or a spreadsheet displayed on
and business units to develop SIPOCs for paper or screen. Whatever encourages
their processes, providing much greater participation with the process owner,
benefit to the process owner than a BIA, team, department or whoever needs to be
with the potential to be used in a greatly involved to capture the information about
expanded extent within the business. the process is the right way to do it.
Another distinct advantage of the
SIPOC is its flexibility. There are several
DESIGNING A SIPOC DIAGRAM typical variations for how SIPOCs are
One of the appeals of the SIPOC is the arranged and the order in which each
ease with which one can get and keep component is completed. The acronym

Page 203
Why and how to employ the SIPOC model

Figure 5 The organisational structure for total quality management

Source: https://www.conceptdraw.com/examples/a-comprehensive-organogram

and diagram are commonly reversed, as in first step in the process). The # represents
a COPIS, COPIS placing customers first. the number of inputs for that specific
Another structure is PISOC, which puts step listed sequentially. The supplier of
the process at the beginning.7 The struc- those inputs for step 1 would be labelled
ture of the diagram and the inclusion of as SIP1.# (supplier of the first input of
additional information are guided by the the first step in the process). Again, a
situation, application and experience. sequential # represents each supplier for
Integrated SIPOCs (as in Figure 7) that input. There can be multiple sup-
are another variation that include codes pliers, inputs, outputs and customers of
to connect inputs, suppliers, outputs and any given process step. OP1.# (output
customers to the specific steps of the of the first step in the process), the #
process the SIPOC is illustrating, directly again represents the number of outputs
linking all components of the SIPOC. for that process step. COP1.# (customer
This type of SIPOC often positions sup- of the first output of the first step in the
pliers in blocks directly above inputs and process) would designate any customer of
customers directly above outputs on the the output of the first step. Each customer
diagram, with the process steps in a centre would be given a different sequential
block. The first step in the process would number, which would come immediately
be designated as P1, and anything that after the dot. The next step in the process
linked to that step would have 1 as part would be labelled P2, and so forth, until
of its code. Any input of P1 would be all relationships have been established.8
labelled as IP1.# (the first input of the Integrated SIPOCs attest to the flexibility

Page 204
 Brown

Figure 6 Integrated SIPOCs

Source: https://www.stratexhub.com/stratex-hub/how-to-use-sipoc-for-better-results/

of the tool but provide a greater level of COMPLETING A SIPOC

detail and precision than is generally nec- When creating a SIPOC, it is typical
essary for understanding the relationship to start with the process, regardless of
between processes for the business conti- where it is positioned on the diagram.
nuity professional. The process is the centre point of the
Layout for a SIPOC diagram is gener- SIPOC and the component to which
ally, but not required to be, in a columnar all other information is associated. The
arrangement, as in Figure 8, with five steps of the process the SIPOC is defining
vertical columns, each listing one word should be sequential in flow and gener-
from the SIPOC acronym. There is no ally not exceed six, with a definitive
prescribed width or length to the columns start and end point. An additional step
other than to be sized adequately to or two may be included for clarity, but if
capture all the information in the appro- more than six steps are needed to define
priate column. a process, this suggests that the process
There are abundant resources to guide would be better represented by breaking
the creation of a SIPOC. A quick internet it into more detailed subprocesses. Once
search for the acronym will produce the process has been defined, it makes no
an extensive list of guides, images and difference which section of the SIPOC is
templates. completed next. Working on one section

Page 205
Why and how to employ the SIPOC model

Figure 7 An Integrated SIPOC

Source: http://blogs.mtu.edu/improvement/files/2015/04/SIPOc.png

Figure 8 Mechanisms of a SIPOC

Source: http://sipoc.info/wp-content/uploads/2014/08/Columns-in-a-SIPOC.png

Page 206
 Brown

of the SIPOC will trigger information unmanageable or ineffective part of the

that will be needed to complete another. process.
Move horizontally and vertically through
the SIPOC until all pertinent information Suppliers
for the process has been captured. A supplier in a SIPOC is any company,
person or system that supplies the inputs
Capturing data necessary to complete the steps outlined
The key to completing a SIPOC is having in the process section. Completing this
the right participants involved. If a SIPOC section can require additional questioning
is being completed for a frontline process, to uncover all the suppliers. For example,
it is more beneficial to consult with a in an automated system when there is
team member who performs the process a hard stop before a product or service
than a manager or executive. Even when can move to the next step, the process
completing a higher-level SIPOC that owner may not immediately know who
encompasses multiple processes, it makes is responsible for clearing that stop, just
sense to involve someone who is inti- that their process cannot move forward
mately familiar with the subprocesses to until it is cleared. Keep questioning until
avoid material omissions or inaccuracies. it is not only known what must be done
It often takes someone who performs the but who must do it. Even in higher-level
day-to-day process to reveal the landmines, processes, it is not always evident who
skunks and funny things. The purpose at triggers an action or where it is triggered
this stage is to capture the information for the next step. Even ubiquitous sources
about how, who and what. such as e-mail and telecommunications
Everyone in the room will have some- should be included as suppliers if any of
thing to contribute to the SIPOC and it the inputs to the process come through
is the BC practitioner’s job to cultivate these sources.
that collaboration. Encourage discussion
until there is agreement that process steps Inputs
are complete, accurate and in the correct Inputs are everything a process requires
order, with clear beginning and end to complete all the steps. This would
points, and everything has been captured. include materials, notifications, stops
Ask questions regarding how, who and cleared, documentation, verifications, etc.
what to facilitate this process. It is possible If not having it can prevent the process
that not all information will be captured at from being completed, it is an input.
the initial meeting and the creation of the Even when there is a workaround in the
first SIPOC; with persistent questioning, event of disruption, if it is required in
however, any omissions will usually be normal operation, then it is included as
very minor in nature. At this point, it an input.
is important to ensure the SIPOC is
an actual representation of the current Process
process rather than a procedural rendi- The process is the step-by-step progression
tion. When creating a SIPOC, it is not of actions necessary to deliver the outputs
uncommon for participants to describe to the customer. Generally, a process is
what is in their procedural manual instead described in six steps, but not more than
of what they actually do. This can exist, eight. If it takes more than eight steps
for example, when a workaround has to outline the process, it is advisable to
been developed for a system issue or an move up a level to create a SIPOC that

Page 207
Why and how to employ the SIPOC model

represents an overview of those steps, information in resolving any confusion

then create SIPOCs for each step of that might exist regarding who the actual
the SIPOC that requires more detail. customer of a process is. Requirements
It is only necessary to create SIPOCs are typically recorded in the same ver-
for those process steps where additional tical column where customers are listed
detail is useful. Not every process step in because it is the customers’ requirements
a SIPOC warrants a sub-SIPOC — only that are being captured. Requirements
those where the additional clarity pro- often obtained when completing a SIPOC
vides value. for process improvement include the cus-
The steps should be written in a verb- tomer’s expectation of timing and scope.
object format with contextually meaningful It could be delivery in a certain way, at
modifiers such as adjectives, adverbs or a precise time or within a specific amount
indirect objects. It is also important to of time. Ordering premium coffee from a
establish the process boundaries at this drive-up could have a customer expecta-
stage in terms of which event triggers the tion of a environmentally friendly coffee
process and which event marks the end of cup and sleeve with the lid on tight, sugar
the process.9 and creamer in a bag with two napkins, a
stir straw and within two minutes for no
Outputs more than $5.
Outputs are anything that is produced by Time and scope are constraints in
completing the actions of the process. As disruption response just as with project
with inputs, this could include materials, management. Constraints in a project
notifications, stops cleared, documenta- are illustrated by a triangle with costs/
tion, verifications, etc. resources, time and scope each on different
sides (Figure 9). If any of the three con-
Customers straints are adjusted, one or both remaining
Customers are both internal and external. constraints must be adjusted (restricted or
Anyone in the delivery chain that is a expanded) to compensate. Likewise, when
recipient of the output is a customer. planning for recovery after a disruption,
knowing how much of the process must
Good practices be recovered and by when or within what
• Process names define the how with a timeframe is essential information when
verb and noun — do not use past tense; developing recovery strategies. Following
• Process names should not describe per- a disruption, a process may not immedi-
formance requirements or improvement ately require 100 per cent of its capabilities
objectives; to get by or need them immediately. One
• Outputs describe what a process person may be able to run payroll, or it
delivers, not what it achieves; may not be critical to be able to run it
• Inputs are worked on by the process and until a week from Tuesday. BC practi-
should trigger an action.10 tioners would be well served to record
time and scope constraints on a SIPOC
Time and scope constraints when creating it.
Often added to a SIPOC diagram, and Recovery time objectives is another area
sometimes the acronym, is the letter ‘R’ of intense deliberation and disagreement.
for ‘requirements’. Knowing customer Instead of looking at the number of hours
requirements is critical when looking at in which a process must be recovered as a
process improvement and can be essential target to hit, use a SIPOC to understand

Page 208
 Brown

CONCLUSION
SIPOCs are an emerging practice in busi-
ness continuity but have been a staple
of process improvement professionals
for decades. Using the experience and
expertise of other disciplines in a trans-
disciplinary approach will accelerate the
business continuity profession and trans-
form the value the BC practitioner can
bring to the organisation. SIPOC is just
one of many tools that can be brought
over to make the work of a BC practi-
tioner more effective and value-driven.
Developed by Taiichi Ohon when he
was an executive at Toyota, lean manu-
Figure 9 Project Constraint Triangle
facturing peels away everything that does
Source: https://www.pmi.org/learning/library/
not add value to the customer. Applying
managing-challenges-triple-constraints-6884 lean thinking to business continuity would
seek to eliminate all those activities that
organis­ations should be unwilling to pay
how time and scope constrain the recovery for because they provide no tangible
process in relation to its interdependencies benefit to disruption response or recovery.
and customers’ expectations. No one typi- In the words of Buckminster Fuller:
cally knows the nuances of this better than
the individual(s) who owns or executes ‘in order to change an existing para-
the process. Whether the constraint is digm you do not struggle to try and
being controlled by dependent processes, change the problematic model. You
expectations, contractual agreements or create a new model and make the old
regulatory mandates, the process owner one obsolete. That, in essence is the
and their team generally have the best higher service to which we are all being
feel for when and what their process called’.11
must be able to complete to meet cus-
tomer requirements and stakeholder
expectations. References
Priority for restoration and speed of (1) Hübert, R. (2012) ‘MBCI: Why the
recovery will almost always depend on business impact analysis does not work’,
when the disruption occurs and its actual Business Continuity and Resiliency Journal,
impact. As in the payroll and loan closing Vol. 1, No. 2, pp. 31–39.
examples discussed previously, 10:00 am (2) Simon, K. (n.d.) ‘SIPOC Diagram’,
Tuesday the week payroll is run or the last available at: https://www.isixsigma.
com/tools-templates/sipoc-copis/sipoc-
day of the month for refinances to close
diagram (accessed 13th December, 2018).
and still allow funding forces significant
(3) Scholtes, P. R. (1998) ‘Systems
time constraints that would not be experi- Thinking: The Heart of Twenty-First-
enced otherwise. Century Leadership’ in Scholtes, P. R.,
Be sure to document the constraint The Leaders Handbook, McGraw-Hill,
where it is visible to anyone viewing the New York.
SIPOC. (4) Ibid.

Page 209
Why and how to employ the SIPOC model

(5) Continuity Central (2018) ‘Business (8) Ibid.

Continuity Trends and Challenges (9) Discover 6 Sigma (2007) ‘SIPOC’,
2018’, available at: https://www. available at http://www.discover6sigma.
continuitycentral.com/index.php/news/ org/post/2007/06/sipoc/ (accessed 14th
business-continuity-news/2563-business- December, 2018).
continuity-trends-and-challenges-2018 (10) Seath, I. (2008) ‘Defining a process
(accessed 14th December, 2018). with SIPOC’, available at: https://
(6) Lindstedt, D. (2018) ‘11x Time to ianjseath.files.wordpress.com/2009/04/
Value: Adaptive v. Traditional Business sipoc.pdf (accessed 14th December,
Continuity Approaches’, pp. 13–14, 2018).
available at: https://www.adaptivebcs. (11) Van Zyl, W. (2014) ‘Introduction’,
com/docs/TimeToValue_2018_ in ‘Education and Development
Final_Submitted_r2.pdf (accessed 12th Alternatives to Neoliberalism — A New
December, 2018). Paradigm Exploring Radical Openness
(7) Loyer, C. (2018) ‘How to Use SIPOC and the Role of the Commons and
for Better Results’, available at: https:// P2P Foundation as an Alternative
www.stratexhub.com/stratex-hub/how- Discourse to Creative and Innovative
to-use-sipoc-for-better-results/ (accessed Modernisation’, Academic Paper, Five
14th December, 2018). House Publishing, p. 1.

Page 210