When people hear the term Business Continuity Plan (BCP), they immediately think of catastrophic events like fire, flood, or loss of life. In reality, the probability of those types of events occurring are slim, so unfortunately the prevailing attitude is “That would never happen to us, we’ll deal with it if it arises”. But what about smaller incidents? How would you deal with the loss of a major supplier, loss of a critical piece of equipment, loss of an essential service? We all should have a “Plan B” for those “what if” scenarios.
But a plan itself is not the end of it. You must test it, often, especially when you first develop it. Testing can start with table top discussions – asking the “what happens if…” questions. This familiarizes the players involved in what to do (and not do) in certain situations. The next step is a simulation – “show me how you do it…”. This is typically for IT failures, where you would simulate a failure of a server for example, then test the restore of your backups to a backup server. You don’t touch your production environment. The final test is a full disruptive test – “pull the plug”. After each test, whether table top, simulation or disruptive, feedback is gathered and the BCP is updated, making it better the next time around. BCP’s are living documents. They must be updated when things change in the organization – contact information, process changes, inventory, etc. It’s a continuous cycle: analyze > design > implement > test > maintain… then repeat.
One of the major complaints about BCP’s is the cost. Not everyone needs globally redundant data centers. In the Caribbean we all don’t have the luxury of multiple utility providers. Depending on the findings in your Business Impact Analysis (BIA), one of the recommendations could be “do nothing”. If an asset’s cost is minimal and the risk of losing it is minimal, or replacement time and cost is also minimal, then “do nothing” is actually a valid recommendation. It is all a question of how much risk the organization is willing to accept or transfer (via insurance).
A BCP also has some positive side-effects. Documentation of your critical processes is one of the biggest areas of focus when developing your plan. During this time you may see opportunities where it could be beneficial to make changes to these processes in order to save time, money, or reduce risk. If the process owner is not available at the time of a disaster, someone else can take the documentation and get the recovery process started. If you are an organization which has insurance for disasters and loss of profits, having a plan (and shown that it is tested) could lead to reduced insurance premiums.
Finally, BCP can be used in your personal lives. What happens at home when the power goes off? Who picks up the kids from school if the parents can’t? What is the role of each family member in the event of a natural disaster? Make your own BCP for the home. You’ll be glad you did!