Ask yourself – If a major operational disruption was to occur tomorrow, would you be able to respond and recover in a timely and efficient manner?
For many organisations, the answer to this question is only brought to light once an incident occurs. A reactive approach to Business Continuity will inevitably delay your Response and Recovery phase as you enable high stress levels, conflicting priorities, and employees are left wondering where to go and what to do next.
High stress levels
When a significant operational disruption occurs, it’s only natural that stress levels will increase.
Management are concerned with staff injuries, the impact on stakeholders (including customers, the community, regulators, etc.), and the general survivability of the organisation. On the other hand, staff are concerned for their colleagues, the people they support and deliver products or services to, and their own livelihood.
If your plans and procedures don’t consider the human impact of a major disruption, then you will debilitate your ability to Respond and Recover effectively, and, at worst, create a secondary disaster that may not be survivable.
I often come across Business Continuity plans that provide a sense of priority without a sense of timing. In some cases, these plans even sequence Business Activity resumption by risk rating. I’ve also seen plans that sequence Business Activity resumption by Maximum Acceptable Outage (MAO). This isn’t quite as bad, but what does it mean if it looks like you won’t meet the MAO? You then need to reprioritise efforts.
I can assure you that if you don’t have a clearly defined list of Business Activities (and critical Resources) in recovery timeframe order then you will have to endure a vigorous debate over whose department needs resources to resurrect them first. In my experience, the department that wins is the one with the manager who shouts the loudest or has the highest seniority.
Where do you relocate to?
Once you have exited your building after an emergency evacuation, where do you go next?
Not having an answer to this question will mean you will have to make decisions on the fly (aka Plan-to-Plan), which can place your organisation at further risk of failure. It’s stressful enough having to manage the response process, but to fold a new relocation strategy as part of the recovery phase adds another layer of analysis and stress. As a result, you will further delay the recovery process.
So, what Business Continuity considerations do you need to address in order to proactively and effectively respond to an unforeseen incident?
I believe there are five crucial aspects for you to consider to ensure your organisation can return to business-as-usual as quickly as possible:
- Define your ‘Response and Recovery’ management structure
Response is different from Recovery – in some ways, it’s separating the decision makes from the doers. This will allow your organisation to clearly identify who will be responsible for different aspects of the journey back to Business As Usual. Your employees will know who to turn to when a decision needs be made and/or direction needs to be given.
- Have clarity of recovery timeframes
Golden Rule: Priority without timing may result in failure.
The Recovery Time Objective (RTO) is the principle metric for this aspect of the process. Having Business Activities defined with a RTO and signed off by Executive Management before a disaster occurs saves Team Leaders having to debate their case during an incident.
- Communicate, communicate, communicate!
Golden Rule: Time between announcement = (Damage to reputation)2
It’s important for every organisation to have a structured set of tools, polices and templates for two-way communication with internal and external stakeholders.
Internally, this will allow you gather information, manage stress levels, and advise and direct your employees in a unified manner.
Externally, all of your stakeholder groups will be provided with the information they need to understand the situation at large and avoid potentially damaging knock on effects.
- Identify where to relocate your teams.
An event that forces you to evacuate and relocate business operations requires the answers to two important questions;
- Where will business operations continue to operate from?
- Where will your Crisis Management Team manage the Response and Recovery of the organisation?
While a) is typically core to the Recovery phase and the subject for your plans and procedures, I often find that within plans b) is quite vague and requires a resolution as the CMT is evacuating out of the building.
I recommend specifying three places to go. Regardless of what you call this place (e.g. Crisis Command Centre, Emergency Operations Centre etc) define;
- One facility on-site;
- One facility within 10 – 15 minute walk; and
- One facility more than 5kms away.
Furthermore, I recommend defining criteria for selecting an alternate location just in case. My advice is not to head for a nearby café or pub with internet access.
- Implement Response and Recovery role training.
Anyone who has a responsibility in the Response and Recovery process must be adequately trained to fulfil their role. Take it as a given that a person’s role in times of Response and Recovery is quite different from their business-as-usual role. An excellent method for assessing and improving the experience of staff in dealing with a disaster is to involve them in a program of BC Exercises – a zero to low risk environment to make mistakes, to learn, to experiment, to collaborate and grow experience.
It is easy to envisage the inefficiencies and unknowns that you will have to deal with if these five aspects of the Business Continuity process are not adequately addressed before an incident occurs.
Do your organisation’s Business Continuity capabilities confidently prepare you for an unforeseen incident? Contact one of the Linus team today to understand how you can ensure your BC exposure will ensure you can respond to an incident in a timely manner.