I am a big believer in planning. Planning to me is a relatively quick process that is intensive. It requires you to think of What if? scenarios. What if we grow 10x faster than imagined? What happens if we lose our best customer? What happens if a major customer encounters serious financial problems? What happens if we get hit by an act of God or man? This particular post by guest poster By Erik Kopp discusses the latter. The need to prepare a business continuity plan – then implement it! – in case of a disaster. The preparation process also helps to strengthen your business operations by documenting processes and systems. Enjoy! – TCW
Will Your Business Continuity Plan Really Keep Your Business Running After a Disaster? (Part 1)
Preparation and planning are critical to achieving positive cost-effective outcomes in business. This is especially true when setting up a Business Continuity Plan (BCP).
A BCP can drain needed money from your budget if not properly targeted to return real value. It may not be reality to expect that you can restore all business operations after a disaster just like nothing happened. This may cost more than you can afford to have backups and contingencies for all business operations to be back online right away. The fact is that some operations are more valuable than others. Some are critical to the survival of the business, some are important but can wait to come back online and others can operate using lower cost alternatives and temporary work-arounds. Think about it, the best most absolute way to ensure no interruptions to a business is to operate 2 mirrored operations; 2 buildings and staffs of people performing identical functions. When one goes down, switch to the other. This may be possible for large organizations, but extremely costly. And it is certainly not reality to expect that both facilities are working on exactly the same projects. This is just not economic reality.
Like most important projects in life, to do this right takes careful and thorough planning to come up with the appropriate scope which provides for needed contingencies to keep the business viable but at the same time does not waste money on non-critical functions. How is this determined? For a BCP, the most critical part of scoping out the plan is to perform a Business Impact Analysis (BIA). A BIA is a tool for objectively evaluating the potential consequences of losing a business function. The result of the BIA is that company management can make informed decisions on which operations and functions require resources (people and money) to provide contingencies in the event of a disaster and to be able to determine to what extent this is needed (how much money and resources). These decisions are based on the criticality of the operation or function.
A BIA documents key criteria for evaluation of each business function or operation including:
- Impact to the business if the function/operation is lost (profits lost, cost, etc.)
- How long after the operation goes down will the impact be felt by the business (what will happen after 1 day without this? After 2 days? 5 days? 10 days? Etc.)
- Available work-arounds (temporary fixes)
- Risk mitigation (things that can be done now before a disaster happens. For example: Data files are in the basement and subject to flooding. Can they be moved to a higher floor? Copies made and stored offsite?)
- Resources needed to recover the function operation (people, materials, time, money)
This BIA process is repeated for each business function / operation considered important to the business.
From this documented information, the functions / operations are assigned a ranking of importance. Some are critical to the survival of the business (ex. Order processing, customer service, reporting to regulatory agencies, etc.) Others may be less important or can be delayed (ex. Landscaping the facility, developing new marketing campaigns, updating the website). And some may be low priority because of successful risk mitigation (ex. Data files are out of the food zone and backup copies are available, so risk of loss is low).
The next piece of this puzzle is to determine the target recovery time for each of the
high ticket items identified; how long after a disaster do these need to be back online? Can the business survive 2 days without ‘taking orders?, can it survive 3 days? Etc.
Looking at the risk of not having these functions online and the potential cost for providing contingencies, you can find a balance point where the investment up front will provide the value you need. For example, do you need a hot-site up 24X7 to backup online ordering (cost $X)? or can you manage with a lower service level which will provide 1 business day turn-around to be back (cost $? X)?
Based on all of this quantitative information, it is now possible to effectively design a cost effective BCP which targets the truly important business functions / operations and allocated money and resources wisely to maximize the return on investment. For example, it may be wise to invest in cloud computing or offsite servers to provide backup for managing inventories or orders. Or it may be wise to contract with an alternate distribution vendor or warehouse facility, if you determine these are critical to keeping the business alive and they must be up and running within a short time following a disaster which shuts down your primary operations or site.
Following this approach, you will be able to quickly and effectively take steps needed to keep things running in the event of a disaster, rather than running around in all directions trying to frantically fix things and losing precious time, money and customers in the process.
Once you have done this homework, the BCP is truly a valuable tool to maintain the integrity of your business and not just a drain on your profits or another document you have to write for the auditors and then file way.
About the Author: Erik Kopp