Business Continuity Planning
Like Prince2 we breakdown everything into stages or “chunks” understanding what is required to be put in place before we do anything; which means we need to do the following:
Understand the business requirements, so weknow what we are required to deliver. This is our business case, where measure quality expectation, timescale, risk and cost.
Creating an impact analysis and risk assessment is a good place to start, and then we need to look at methods on how we could go about implementing an appropriate strategy and solutions to meet those business requirements.
It is important to ask the questions what if and so what? The business needs to understand the consequences of decisions or if a particular event occurs and whether the result is acceptable. Going through asking yourself these hypothetical questions allows for problems to be anticipated and risks to be identified and assessed, enabling solutions or containment actions to be planned before the event.
Below are some questions to ask yourself
- If a particular supplier is unable to deliver critical components for an extended period, what impact would that have on the business?
- If a major customer stops ordering for an extended period what impact would that have on the business?
- If impact shows that you would be significant affected you need to mitigate the risk including:
- Making contingency arrangements. Such as finding alternative suppliers or holding extra stock.
- Checking if the other party has their own contingency plans and risk management systems in place
- Checking whether your own insurance would provide some level of recompense
When making contingency plans there some things you should think about such as:
- AVAILABILITY: It is important to know your options and to know what is available to you at short notice
- LOCATION: It needs to be accessible so that personnel can get to it
- ACCESS: Key holders should be available and contactable
- FACILITIES: Including desks chairs telephones, computers connections meeting rooms’ whiteboards etc
- ALTERNATIVES: Consider nominating more than one location in case the primary location is unavailable
- Incident management teams when they are created should go through the process of worst case scenarios on a regular basis, just like a fire drill. It is important that people can quickly react and know what to do. This is your insurance policy.
As stated earlier it is essential to have key players on board to ensure that staff are educated to the level that everyone (particularly key players) knows roles and responsibilities well trained staff will mitigate that valuable time isn’t lost in the early stages of response and recovery. This means that pre-planning and preparation. They need to know who to contact, where to go, what to do, how to do it and when, so we need to implement training and awareness and familiarity with those plans, with an ongoing program of exercising and testing to ensure the recovery strategies work.
In the event of a worst case scenario it is important to ensure that the business can still function even though the building may have burned down.
I have wrote many “how to” documents and like everyone else had trouble reading poorly written instructions, therefore it is important that when you are documenting the plan that it is in a form that is actually usable, this is where going through testing and regular exercises come into play to make certain that everything actually works.
However when there is a crisis people love to talk, and rumour can harm your business, therefore the planning process should also include the following as communication is key:
- Identify the various audiences (staff, clients, business partners, suppliers etc)
- Ensure alternative means of communication – don’t rely on any one method
- Identify the crisis media manager and support teams
- Identify the spokespeople and training them
- Briefing other staff including front of house staff
- Agreeing lines of approval and clearance procedures for statements
- Planning to ensure consistent message, although the actual working may differ for your various audiences.
- Keeping stakeholder contact details, press lists etc are up to date
- Ensuring that 24 hour access to these contact details is available.
So we have looked at creating strategies for handling the crisis and now it is documentation is complete, well unfortunately it doesn’t stop there; once it is done it has to managed, plans need to be reviewed and the underlying strategy and solutions kept up to date, but it is also very important that the documentation is accessible, not locked away in a draw or in some folder on a hard drive on a server that has either just blown up or just plain lost in the millions of documents on its hard drive. My wife is a very tidy woman; however once she tidies something it is lost forever as she doesn’t know where she puts things. If the location is not documented then people will not be to use it, they may not even know it exists.
I cannot state this strongly enough. It is important to lay your hands on the vital records required to support your actions when you need them, invest in incorporating SKMS into your business.