Will Your Business Continuity Plan Really Keep Your Business Running After a Disaster? (Part 1)

Preparation and planning are critical to achieving positive and profitable business results. This is especially true when setting up a Business Continuity Plan (BCP).

A BCP can drain the necessary money from your budget if it is not properly targeted to return real value. It may not be a reality to expect that you can restore all business operations after a disaster like nothing else. This can cost more than you can afford to have backups and contingencies to get all business operations back online immediately. The fact is that some operations are more valuable than others. Some are critical to the survival of the business, others are important but can wait to get back online, and still others can operate using lower cost alternatives and workarounds. Think about it, the absolute best way to ensure there are no business interruptions is to operate 2 duplicate operations; 2 buildings and staff of people performing identical functions. When one goes down, it changes to the other. This may be possible for large organizations, but extremely expensive. And it is certainly not a reality to expect both facilities to be working on the exact same projects. This is not an economic reality.

Like most major projects in life, doing this right requires careful and meticulous planning to get to the proper scope that provides the contingencies necessary to keep the business viable while not wasting money on non-critical functions. How is this determined? For a BCP, the most critical part of the scope of the plan is to perform a Business Impact Analysis (BIA). A BIA is a tool to objectively assess the potential consequences of losing a business function. The result of the BIA is that company management can make informed decisions about which operations and functions require resources (people and money) to provide contingencies in the event of a disaster and to be able to determine to what extent this is needed (how much money and resources) . These decisions are based on the criticality of the operation or function.

A BIA documents the key criteria for evaluating each business function or operation, including:

• Business impact if function / operation is lost (loss of profit, cost, etc.)
• How long after the outage will the company feel the impact (what will happen after 1 day without this? After 2 days? 5 days? 10 days? Etc.)
• Alternative solutions available (interim fixes)
• Risk mitigation (things that can be done now before a disaster strikes. For example: data files are in the basement and are subject to flooding. Can they be moved to a higher floor? Are copies made and stored off-site?)
• Resources necessary to recover the function of the function (people, materials, time, money)

This BIA process is repeated for each business function / operation deemed important to the business.

Based on this documented information, functions / operations are assigned an importance ranking. Some are critical to the survival of the business (for example, order processing, customer service, reporting to regulatory agencies, etc.) Others may be less important or may be delayed (for example, landscaping of facilities, development of new marketing campaigns, website update). And some may have low priority due to successful risk mitigation (for example, data files are out of the food zone and backup copies are available, so the risk of loss is low).

The next piece of this puzzle is determining the target payback time for each of the identified high-value items; How long after a disaster should they be back online? Can the company survive 2 days without receiving orders? Can it survive 3 days? Etc.

By considering the risk of not having these features online and the potential cost of providing contingencies, you can find a breakeven point where the initial investment will bring you the value you need. For example, do you need a 24/7 hot-site to back up online orders (costs $ X)? Or can you get by with a lower level of service that will give you a 1 business day turnaround time to be back (cost $ ½ X)?

Based on all this quantitative information, it is now possible to effectively design a profitable BCP that targets truly important business functions / operations and allocates money and resources wisely to maximize ROI. For example, it may be wise to invest in cloud computing or external servers to provide backup for managing inventories or orders. Or it may be wise to hire an alternative distribution provider or storage facility, if you determine that these are critical to keeping your business alive and should be up and running shortly after a major site or operations shutdown disaster.

By following this approach, you will be able to take the necessary steps quickly and effectively to keep things running in the event of a disaster, instead of running in all directions frantically trying to fix things and wasting time, money, and valuable customers in the process.

Once you have done this task, the BCP is really a valuable tool in maintaining the integrity of your business and not just a waste of your profits or another document that you have to write for the auditors and then file.