When Business Meets Disaster - Keys to Business Continuity Planning
by Sharon Flemings

Many organizations have disaster plans in place to address such issues as civil unrest, disease outbreaks, and certain natural disasters. Information Technology departments normally have plans in place to backup and protect critical business data, and procedures in place to reestablish data processing capabilities in the event of power outages, fire or other disasters. What many organizations are lacking, however, are plans, procedures and tools to be used during such disasters and automated systems outages to ensure the business continues to operate and serve customers. How will you run your business (make products, service customers, market your products and services, collect payments, etc.) without power, technology or other critical infrastructure? Or, will you just be out of business for a while?

Your IT department has likely identified the business critical data processing needs for your organization, and has strategies in place to protect your company data. Plans and procedures are probably in place to designate an alternate data processing center, recover critical automated systems and restore data. These are all components of a well designed disaster recovery plan. Notice the operative word – “recovery”. These procedures outline the steps necessary to reestablish a normal working environment after a disruption.

What is generally missing from an organization’s strategy planning, however, is a Business Continuity Plan (BCP). This is a plan including appropriate procedures, templates, worksheets and other tools, used to direct business operations from the point of a disaster through the reestablishment of a normal work environment.

Most organizations lack well-thought-out plans for how to operate the business should circumstances arise which threaten, or otherwise make unavailable, automated systems or other “modern” infrastructure. How will you produce your product or service without the necessary infrastructure? How will your employees know what to do in the event of any type of outage? How to you transition back to infrastructure support when it becomes available again? (This last point is as critical as the recovery plans.)

Below is a list of “keys to success” when developing your Business Continuity Plan:

Master Plan
Create a master plan for the entire organization. Each department should be responsible for their portion of the plan, but have at least one consolidated copy available for business leaders to use as a reference. Be sure to detail the following considerations:

  • Who has the authority to declare the emergency?

  • What are the decision criteria to be used to determine if an emergency exists?

  • Who are the backup decision makers in the event the primary is unavailable?

  • What criteria are used to determine when the disaster has passed, and normal operations may resume?

  • Do you need a team to handle various aspects of the plan? If so, who are the members?

  • Do you need to consider alternate sites for business operations? If so, how are those made available? Is there a specific notification period required, or are facilities always available?

Each department should detail the specific steps to take when an unplanned event occurs. During a crisis, you may opt to forego less important business process steps in favor of focusing on those operations critical for continuing business operations. For example, you may waive the need for certain reporting processes in favor of "spending" those resources on manual quality assurance processes. The important thing is to document the business processes to be executed, and the steps needed to complete the process (remember, these are manual processes now. The steps should be different than when automated systems or other infrastructure is being used.) Don’t rely on your standard operating procedures in times of crisis.

One additional point – don’t store your manual business process procedures in an automated system which will be unavailable in an emergency! Develop the procedures using an electronic tool, but print the procedures and any other necessary documentation and store them in a binder. Remember, you probably won’t have access to this information in an emergency unless it is on paper!

Employee Communication
During an emergency, there will be a lot of confusion and questions about what is happening, what happens next, and so forth. Clear, concise communications between leadership and employees is critical at this time to minimize confusion, initiate plans and stabilize the situation. Consider the following:

  • Develop specific procedures for how communications will be handled (will employees call a toll free number for the latest information?)

  • Who has the authority to initiate communications?

  • Who is the authority to answer questions from employees, media, vendors and others?

  • What are the first steps to be accomplished in any situation, and who is responsible for each?

Roles & Responsibilities
Clear definition of everyone’s roles and responsibilities during a crisis is critical for senior management; however, do not forget that roles and responsibilities for staff are important, too. Employees focused on continuing business operations and adapting to the new circumstances will be more productive and helpful, than those left to gather in the halls and speculate on what is happening. For example, if all customer services representatives are not needed because telecommunications are unavailable, reassign them to another role during the event. This gives people a sense of purpose and contribution in an emergency. Give everyone a job to do – especially until manual business processes are functioning and stabilized.

Manual Systems
Without the use of automated systems, manual (paper-based) systems will have to be in place for the duration of the event. In addition to manual business processes, additional tools, templates, forms or other items may be required to collect data, make notes or manage your business processes. Consider what tools are used now (they are often developed right into your automated system) and adapt those for manual use. Consider also whether/how multiple automated data management tools could be combined for manual business processes. The more paper you have in a manual environment, the easier it will be to lose information. Consolidate for easier management.

Recovery Transition
Once the disaster situation is resolved, and automated systems are back online, each department will need to determine how to transition back to automated, normal processes. In some instances, it might be easy. In other situations, there may be data missing which needs to be entered into transactional information systems, and/or information from executing the manual business processes may need to be transcribed. Be sure to describe and document the specific steps and decision points needed in order transition back to normal operations. Define what happens to the paper records after processes are back to normal – are these documents required for any regulatory reason?

Disaster Exercises
While nobody like to think about disasters, it is critical to practice the plans and procedures periodically (at least once per year). Manual business processes should be checked for any updates/changes needed since they were written or last tested. (This often happens when process improvement initiatives and been recently implemented.) Supporting tools and templates should be reviewed to ensure all critical information will be collected and/or documented. Communication plans should be updated as needed with new phone numbers, vendor names or other information which has changed. Employees who may not participate in limited scope exercises should receive periodic training on the procedures and actions to be performed immediately after a disaster strikes.

Disaster planning is often overlooked, but can be one of the most crucial planning exercises you go through every year. You perform your strategic planning every year in order to grow your business. Why wouldn’t you plan for disaster in order to protect your business?

Related articles:
Identifying the Strategic Processes
Creating an Agile Organization
Departments Are Not unto Themselves