For a business continuity plan to be truly effective at the time of interruption or disaster, everyone within the company needs to pull together to make the plan work and turn interruption into continuation.
This means that when a continuity manager is developing the plan, every type of audience – senior management, middle management, supervisors and operatives – needs to understand the plan and what part they have to play in it.
But how does one get their attention?
Once a continuity manager has developed a plan he or she is happy with, the first step to introduce it to the company should be a desktop walkthrough. This is a useful exercise to undertake with individuals or small groups, as the interactivity enables additional data to be gathered. For example, you may have planned to use a workplace recovery center 20 miles to the west of your office, which on paper looks like an acceptable distance for your staff to get to. But when talking through the plan with other people, you may find insider knowledge such as information on poor traffic flow that side of town, and you may be able to readjust your plans to fit the requirements of your staff.
The walkthrough will introduce everyone to the plan and give you an opportunity to explain the underlying strategy behind it. Many people do not see the point of a business continuity plan, assuming that interruption will never happen and seeing it as a waste of money. For middle management especially, a walkthrough gives an opportunity for the business continuity manager to explain why continuity planning is vital to the secure continuance of the business, and answer any questions they may have.
A final advantage to the walkthrough is that the plan is sanity-checked by many people. Sometimes, you can just get too close to what you’re working on and others can spot obvious mistakes.
A business continuity manager can also embed the plan into the minds of employees through scenario exercises, or ‘pretend’ disasters. These are undertaken in groups – although we do advise they involve no more than eight people for logistical reasons. Equally, it is often useful to undertake tests away from the office.
These exercises are devised to show realism but involve no risk, as they test the ability of senior managers and middle management to deal with a typical invocation and follow the plan. Test exercises also identify any gaps in planning.
The scenarios have to be credible (to be honest, terrorist attack is perceived as so unlikely for most companies that tests should be planned around more mundane events such as a server going down or a power failure) and should have varying degrees of difficulty for different members of staff.
Continuity managers can present two different types of scenario: the ‘fait accompli’ or the ‘dripping tap.’ In a ‘real’ disaster, either you have one incident to deal with such as a flood (fait accompli), or several through progressive failures (dripping tap). Companies need to prepare for both. It’s often a good idea to think about involving third parties in the test exercise to add realism.
Any exercise should be followed up with a report that demonstrates the good use or otherwise of the plan, and details the abilities of the participants to manage the situation. Exercises will also show gaps in current arrangements, which can then be addressed through appropriate plan alterations.
Reaching senior management is the biggest hurdle, as they have to be the sponsors of the plan, and often their thinking needs to be challenged. It is hard for a business continuity manager to ask whether they have thought about the consequences any decisions will have on the continuity of a company, but disaster exercises demand their proactive involvement and help to cement the idea in their minds. Often, the most vehement supporters of a business continuity plan are those who have experienced interruption in the past and understand the practical benefits of a plan.
The disaster exercises for senior management should cover crisis management, public relations during a disaster and people problems, as well as the more everyday systems and site problems. You are not just testing the plan, but the decision-making ability of business leaders during a crisis.
Middle managers are, as the name might suggest, stuck in the middle. A proliferation of tasks and responsibilities means that knowledge of the business continuity plan can often slip to the bottom of the pile. Scenario exercises can increase this knowledge and also reinforce the requirement for up-to-date information – as well as showing up gaps in the plan.
The majority of members of staff need only know that that there is a business continuity plan firmly in place, and that they do have a part to play in this plan. They should know where they must go, what they must do, and when they do it in the event of an invocation.
Business continuity needs to be built into staff induction processes and staff should be regularly reminded of the plan’s existence. Continuity managers could consider using the intranet, staff notice boards, email and/or regular presentations to increase awareness. In short, business continuity should be embedded into your culture.
The business continuity cycle is a constant process of developing plans, implementing them, updating and testing. The business continuity plan is never finished. It is no longer an option to regard it as a ‘tick in the box’ issue. Unfortunately, plans are only good if they immediately progress into action.
Robin Gaddum is managing consultant for SunGard Availability Services (www.sungard.com).