With the increase in climate change impacts, such as flooding and power outages, no one wants to be “closed,” losing clients, reputation and revenue. Many organizations understand that it’s important to be prepared for unforeseen business disruptions, yet are unsure how to develop a plan that will carry them through until normal operations are fully restored.
Tenants expect their facilities manager to have plans in place to protect their assets and to continue critical services at the time of the disruptive incident. Once the emergency management phase is over, and people, the environment, and property are made safe, the business continuity process kicks in with a focus on the most critical and time-sensitive processes and services.
There are three key supports to any business continuity plan (BCP): facilities, technology, and people. Consider the loss of these services and supports at all stages of plan development. Here are seven steps that contribute to the establishment an effective BCP:
1. Assign responsibility
Issue a policy statement that clearly assigns governance of the Business Continuity Management Program at a senior level. The statement should also clearly assign the responsibilities for planning to assure that critical processes and services are maintained. If the job descriptions don’t exist, the work won’t get done.
2. Communicate in advance
With only nine per cent of small business reporting that they have continuity plans, if a tenant population is largely small and medium-sized businesses, the facilities manager can expect a lot of confusion at the time of the incident and should be well-prepared with a leadership-focused communications plan. Talk to tenants in advance about the scope of the plan, how and when communications with them will take place, and their responsibility to develop their own plans. This can go a long way towards shortening recovery times.
3. Create clear instructions
It’s critical to right-size the effort and keep the plans simple enough to be understood by those responsible for carrying them out without creating a maintenance nightmare. Include basic step-by-step checklists, standardized damage-assessment forms, clear instructions for communications protocols and associated timing. Maintain contact lists separately so the plan doesn’t become a phone book.
4. Assess internal and external risks
Perform both and internal and external risk assessments to determine what the plan should cover. This is not to suggest that a plan should be developed for every risk scenario identified, but to ensure that one all-hazards checklist is sufficient in scope to address various sizes and shapes of business interruption.
Make sure that the executives responsible are aware of the risks, potential mitigation strategies, or that they chose to accept the risk. Tenants may not understand that their computer room does not have fail-over emergency generator power, for example. They know the building has a generator and may assume that means they will have power in an outage.
5. Conduct business impact analysis
Prioritize business processes and services through business impact analysis to generate an order of recovery. Those priorities and timelines are also key to development of the information technology recovery plan (IT DRP) that supports the BCP.
The BCP documents how the processes and services will be recovered using alternate space, other supporting resources, or manual workarounds. The IT DRP documents the procedures for recovering the technical infrastructure and environment.
6. Establish criteria for activating plan
Requirements for activating the plan are difficult to clearly define as incidents will vary in size and scope. Pre-activation of plans may take place in advance of severe weather, for example, so work can be transferred to alternate locations before an anticipated disruption occurs. Instead of trying to grade the level of disaster, consider using simple decision trees.
7. Document and test plans
Document and test plans, and update them on a regular basis. Avoid testing the plan at the time of an incident, as that is not the time anyone wants to learn it has unaddressed gaps. It’s important for organizations to ensure they have comprehensive plans with parts that work together to avoid the potential consequences of business disruptions.
These seven steps are key to successful BCP development. For organizations seeking further guidance, help is out there to get the plan done, in the form of online tools and templates, courses and workshops, and business continuity consultants.
Though established approaches and methodologies can be adjusted to a particular set of circumstances, it’s important to account for the fact that every environment and organization is totally unique. And if a business hires a consultant, the most important result should be knowledge transfer because, at the end of the day, the plan belongs to the organization that will be using it.
As more frequent extreme weather events become the norm, clients are increasingly likely to ask about BCPs. Organizations should be ready to say theirs is in place.
Ann Wyganowski is a Master Business Continuity Professional (MBCP), and Certified Business Resilience Manager (CBRM) and Member of the Business Continuity Institute (MBCI). Ann is the treasurer of the Disaster Recovery Institute Canada. She is a recognized senior consultant in the industry. Reach her at ann@bcphelp.com or visit www.bcphelp.com.
