Best Practice – Business Continuity Planning

Like many firms we have recently been focused on tuning up our Disaster Response / Business Continuity Plan (BCP). We are now better organized, trained and provisioned to deal with disruption, regardless of the cause. While not perfect we are far better off than we were just a few short months ago.

Incidents that might disrupt business operations come in all forms and sizes. Long term power outages, natural disasters, workplace violence, extreme weather, terrorist actions, pandemics, concerted cyber attacks and a host of others have the potential to cause disruption and economic harm and displacement.

Naturally there is no “one size fits all” plan to protect against the ill effects of any of these. Corporate goals, culture and client demands are just some of the factors that influence and contribute to a good BCP. When developing a BCP it is best that it be done as a collaborative effort with all business units working as a team. Plans that are developed independently by separate business units will tend to have gaps, overlaps, poor coordination, different assumptions, and even different languages.

Once the cross functional team has been formed they need to be given particulars about planning assumptions and expectations, and it is best if they have a reporting relationship direct to the C-Suite. This helps moderate organizational rivalries. Executive sponsorship and oversight is therefore critical. CEO’s and CFO’s must establish parameters they can both support (such as cost of plan development, provisioning, and training) and be intimately familiar with the resulting plan so they can lead the corporation in an emergency.

Remember, even the best planning is useless if the plan is not well communicated, understood, and followed. The best way to ingrain the plan into the culture is to exercise it. In fact, exercises can be used to inform plan development. Tabletop exercises are especially valuable because they bring the full leadership team together for the purpose of experiencing the dynamics of an event. First exercises may be little more than a walk through of the plan outline. Later exercises should introduce conditions that stress plan assumptions, incident command team leadership, and the decision making system. This has the significant advantage of exposing gaps and incorrect assumptions in the plan, and in “normalizing” emotions, stress and speed of action.

One issue that every organization must deal with is how to equip staff. Using the assumption that the normal office space is uninhabitable or unreachable, alternate plans must be in place to accommodate staff. How this is done will vary greatly depending upon the type of business, product, and employee demographics. Recently I heard of one company which has established a model that I think could work well for many. Basically, each staff member is evaluated on the basis of a number of criteria, including home location, job function, etc. They are then assigned a category number. The organization has a plan to provide office space during a major event using this category system. For example, Category 1 staff are provided fully functional office space in an alternate location. Category 2 staff are provided a fully equipped home office, and Category 3 staff are provided mobile technology only. Obviously, this model does not work for all, but it can work for many. Companies that utilize Alternative Workplace strategies will be able to leverage their strategies as a BCP asset.

Regardless of what the “right” BCP model is for your organization, what is most critical is that it be current, exercised, and that there is a corporate commitment to keeping it that way. Let’s face it, this is one of those things we all hope we never need. That is no reason not to do the work to have it in place and ready if needed. You certainly don’t want to be heard muttering “I shoulda have” on this one.