What are the three most important things to consider for business continuity planning?
- Business continuity planning (BCP) is a business project that requires the full commitment (and appropriate resource) from all business units to be effective. Too often BCP is lumped in with Disaster Recovery Planning (DRP) and left for the IT department to deliver.
- Ensure there is an underlying /existing DRP to integrate with. Often business continuity and disaster recovery are used interchangeably, and though there are many overlapping elements, they are not one in the same. However, the two plans must be aligned, e.g. where a business operation cannot tolerate any downtime, the DRP must provide fully redundant systems in support.
- Training, testing, and updating (maintenance) [repeat]. These three processes are bound together; testing the plan trains staff and maintains the plan, training staff tests and maintains the plan. As staff are trained and the plan tested, it is likely that areas are found that require updating/modifying that will keep the plan current.
What's the most overlooked element of business continuity planning?
Not having a clear Chain of Command and/or not delegating enough authority for it to be effective.
Every disaster or disruptive event is different and while some events naturally force business continuity plans to invoke, others are not so clear, e.g. if an organisation suffers a major power outage at its head office but is told, “power will be restored in 30 minutes”. The business has no zero-hour services and so their BCP is for disruptions from one hour. After 45 minutes, the update is that “power will be restored in 15 minutes”. At the hour mark, the update is, “power will be restored in 10 minutes”. At what point should the plan be invoked and who makes that decision?
It is also likely that invoking a BCP/DRP will incur costs outside of normal business operations, so the roles and responsibilities within the plan must include the authority (and process) to invoke the plan and incur costs as and when required. This responsibility normally falls to the Emergency Management Team (EMT) or equivalent where decisions can be made by committee but plans often omit a process for decisions if the EMT is not available.
Has COVID-19 changed the way you would approach business continuity planning?
Yes. For months and possibly longer, after the COVID-19 pandemic has petered out, businesses will continue to be adversely affected by:
- Global manufacturing and supply chain disruption.
With China being affected by COVID-19 first, the disruption to manufacturing was impacting organisations in other parts of the world before the virus had. China is therefore likely to be the first to journey back to reality and the new-normal, but the full supply chain will take much longer. Business continuity planning should now consider different ways to provision new equipment that may be needed. The global forced lockdown put a huge demand on remote working equipment which could not be met.
- Supply companies unable to meet demand or don’t survive.
Even with the government’s aide, many companies will not survive the lockdown. Their demise will have a knock-on effect, which may not be felt by partner organisations until after the initial return to work. BCPs should factor in multiple means of sourcing the essentials needed to support all critical business operations during and beyond the return to the Business as Usual (BAU) phase.
- The Human Element.
The widespread and high level of mortality will impact many businesses and could leave key positions exposed. Succession planning and key man insurance are typically covered to mitigate the individual’s risk at a corporate level but the BCP should go further and identify the roles, responsibilities, skills, and knowledge needed to be executed and how these can be provided through different scenarios.
Beyond replacing needed skills and positions it is important to keep in mind everyone responds to disasters differently. Some will report back to work when required, while others may be unable to due to emotional or physical trauma or may need to deal with family problems. Insisting people return to work is a false economy; given the choice between work and family, between work and health, people will usually choose family and health first.
Factoring in this reality with appropriate alternatives to address the lack of key staff will help both the employees unable to return immediately and the company recover in the most efficient manner.