Business Continuity Planning for Real
by Jo Salter
Most definitions of BCP focus on how to minimise loss after a disaster; I go further - BCP enables business to continue operating successfully after a catastrophic situation. This is the difference between Disaster Recovery and Business Continuity Planning.
IT is an important component of BCP, but only one element. BCP includes infrastructure, systems, premises, equipment and people, as well as issues around processes and 'business not as usual'.
There are many planning models available to use as a structure for BCP. If you are reading this, you probably know something of your plan; you may have drawn it up; or you may have easy access to the file. But think 'real world': how easy would it be to implement? How up to date is it? Are the people that wrote and tested it still in the same role?
This article aims to provide a particular slant on a logical process, with an emphasis on the reality of putting a BCP into practice, on preparing the people involved, and on attending to what happens afterwards. Figure 1 shows a typical cycle for developing a BCP. Generally, resources are put into the first 3 phases, and once the BCP has been typeset, produced and bound, pressures of time and money soon put closure to the project. Yet the true success of any BCP really lies with the Awareness and Maintenance Phase.
Figure 1 - The Four Phases of BCP before implementation
Awareness and Maintenance Phase
With the BCP complete and a sense of satisfaction and relief that at last it's all over, the real work starts … involving others and testing the plan.
Be organised! Make sure senior management are walked through the plan, even though that may be the last thing they want to spend time doing. Explain to key individuals the possible change to their roles and make sure they know what to do, that their role is valued and vital, and how to invoke the plan. Include key administrative and secretarial workers in this, as their competencies will be critical to your ongoing successful business operations.
Consider whether the day to day processes are in place to make sure that critical IT information is up-to-date. The more the processes are part and parcel of Business As Usual, the greater your organisational success is likely to be. For example, email is now a major part of internal and external communication, often containing valuable information about customers, services and products. As technology develops, so does the availability of secure organisational data resources. Informed decisions need to be based on a thorough understanding of what you need, the technology available and exactly what it does. Are you using the best that you can afford?
Focus on your customers. What service will you be able to provide at crisis time? If you are a service provider, try and include clauses within relevant Service Level Agreements to minimise financial penalties if, for reasons truly beyond your control, you cannot deliver the normal service. But whatever business you are in, if business continuity is a sensitive matter, why not advertise your readiness and rehearsals? Could you turn that additional cost into a Unique Selling Point?
Regular tests are required to check people readiness and procedures, incorporated in such a way that they are not over-costly in terms of resource. Expect changes to the plan each time as people 'step' through it. Simplify procedures so that they make sense when things are going wrong. Perhaps consider step by step 'flash cards' similar to those used by pilots in emergency situations. Media training for senior individuals will help them manage pre-prepared or ad-hoc media communication, and may benefit the day job too.
Finally, make sure you have formal change control processes in place, not just within the BCP document, but within other areas of the organisation. Changes to IT, personnel, premises and systems may well impact on your plan, which must be kept up-to-date to be of any use.
Distribute your updated BCP (and make sure the old ones are shredded/deleted). Obviously, it needs to be available in the event of a relevant incident, with mirror copies in more than one format/location. Don't archive it. I asked a senior local authority manager about their plan; she was confident: "Yes, of course we have one", could remember completing forms to inform the planning, but on inquiry could not recall (or never knew?) what her particular role would be or what priority was given to her department. On reflection, she wondered how emergency communication with staff at home might be effected; contact details were kept on the office computer!
So, it happened! The organisation is in chaos; lines of communication are poor; key individuals turn to the BCP.
Of course, incidents vary in their level of severity - what level of catastrophe is it? Does it affect all or part of your business? One system is to use traffic lights to indicate the severity. Let's assume this is a level red emergency; indeed key post-holders may be absent, adding to the confusion.
Staff need to be 'held'; they need clear messages quickly. But communication is difficult, so what impact may uncertainty be having? This is where pre-prepared messages and clear procedures come into action. Do you think of the media as friend or foe? You need to have thought this and your communication policy through in advance.
The behaviours you require in an emergency can be very different from those for BAU. Churchill made an excellent war-time leader due to his personal characteristics and leadership style; he may not have been as suited to a peace-time role. Characteristics required at times of chaos are similar to those in military leaders.
The individuals chosen within the BCP for key roles must be given authority commensurate with responsibility, and supported with all the information they need to run the business. Elements such as a BCP specific organisation chart are useful. A chart might show key decision makers, who can authorise spending when normal lines of command and structures are no longer in place, and how they can access resources if financial systems are knocked out.
Expect the unexpected - an internet financial institution covered its BCP by replicating itself in 3 data-centres in different geographical locations. Even with one data-centre down there would be redundancy. Then one day, workers outside the main office cut the communication cables to the building, resulting in a lack of visibility and control of the markets, an eventuality not covered in the BCP. The risk was unacceptable. The market shut down. Revenue was lost.
What happens next?
The BCP has been implemented. Let's say it was reasonably successful. The organisation is nevertheless likely to go through a grief cycle and experience numbness, anger and even despair. These are dangerous times for the welfare of your people, and for company profitability, perhaps survival. If people have been shocked, perhaps you will provide access to counselling - but don't be simplistic - let people talk to each other to make sense of what has happened. Give clear information. Truly traumatised people may need time and space before they are ready to integrate logical thought processes with deep-rooted, primitive feelings around danger and survival, but these are complex issues that merit advice from experts in this particular field.
Whilst BCP provides the processes to help support the immediate aftermath of any disaster, its role will be relatively short-lived. Feelings of underconfidence, stress, working in a different environment along with potential issues such as having to travel to a new location will impact on the organisation. How many workers will be required in this 'changed' organisation? Will normal service ever be resumed? How will the culture of your organisation impact recovery?
You will need to balance the needs of the organisation to maintain adequate and appropriate staffing levels. Expect levels of redundancy as money is retained for critical areas. The organisation may need to be slimmed down to become profitable, and at the same time retain its customer base. You have a duty of care to your employees and the work of managing their contract details, health and safety as well as monitoring who is coming to work will fall on your administrative function.
Now this red-alert may be about fire, flood and explosion, but don't under-estimate how it feels to lose something important. Loss of a data could mean loss of years of work and carefully garnered customer information.
BCP - Back to Reality
Of course, most of us are lucky enough not to have been involved in such situations, but with a growing technological base and globalisation alongside increased terrorism, the potential threat to business grows. Assessing and analysing a business to produce a BCP of value takes time and money, resources which are in demand across most organisations. The BCP must be tempered by affordability and a sense of how likely it is that it will ever be invoked. It will only be as good as the experience and knowledge of the people who wrote it and as useful as it is usable in the real world.
A level of satisficing is required, and where that line is drawn will depend on your risk analysis. Can you afford a comprehensive BCP? Can you afford not to have one?
Finally, how complicated is your BCP? It might be a wonderfully glossy document, but how easy is it to follow in high stress situations? If it isn't simple … go back and make it so!
Copyright Jo Salter. All Rights Reserved.
|© Copyright @ 2004 Keynote Resource Inc. All rights reserved. Permission is granted for linking to web pages within Keynote Resource
Keynote Resource speakers bureau can help you find the ideal keynote speakers for your next event. We represent inspirational speakers, motivational speakers, corporate entertainment and more.
Keynote Resource speakers bureau will find the perfect keynote speaker for your upcoming event, whether you are looking for inspirational speakers with a message, motivational speakers to set the tone of your conference or a facilitator for your annual retreat.
Keynote Resource speakers bureau works closely with executives, meeting planners and training directors to create events that result in highly productive learning or are just plain fun. We can identify business speakers, inspirational speakers or motivational speakers that are well suited to your event, send you videos and press kits to help you with your speaker selection and we’ll work closely with the keynote speakers you hire to ensure they customize their presentations to meet the specific needs of your audience.
We have speakers in all areas including Arizona, California, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Illinois, Indiana, Iowa, Kansas, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Nevada, New York, North Carolina, Ohio, Oregon, Pennsylvania, South Carolina, Tennessee, Texas, Utah, Virginia, Washington and Wisconsin.
We can book speakers for you worldwide, in Canada, New Zealand, Australia, Singapore, Hong Kong, China, Ireland, England, France, Italy, Switzerland, Denmark, Sweden, Brazil and The Bahamas. Click Here to Search A Speaker
Speaker fees are determined based on a number of factors and may change without notice. Fees may vary based on the speaker’s availability, supply and demand, program length and location of the event.
Each fee range listed on this website is intended to serve as a guideline only. In some cases, the actual price quote may be above or below the fee range stated. For the most current fee, please contact your representative directly.