BCM for Beginners cont'd ...

Whatever type of organization you are, you will probably choose one of the following strategies:

• Accept the risks - change nothing.
• Accept the risks, but make a mutual arrangement with another business or a business continuity partner to ensure that you have help after an incident.
• Attempt to reduce the risks.
• Attempt to reduce the risks and make arrangements for help after an incident.
• Reduce all risks to the point where you should not need outside help.

Your attitude to risk will be partly based on the costs of delivering effective business continuity. When working these out, remember to include both money and people’s time. It is also prudent to look at the requirements of your Customers as many now will require your organisation to have BCM plans in place to assure your ability to meet contract or supply arrangements. this is particularly relevant if you work with the Public Sector or organisations affected by the Civil Contingencies Act 2004.

You should also review and assess your current insurance provision very careful. Significant risks may be excluded from cover or there may be limits on types and amounts of payments imposed. Many SME organisations are affected by this simple error leaving them in dire straits. BCM plans and insurance can complement each other very effectively if aligned carefully enough.

Importantly be VERY careful over the duration of cover for such things as Business Interruption Insurance, Businesses continually underestimate the time and costs of recovery. This squeezes cashflow tremendously and it is this factor that often forces the business to close.  If you are unclear on specific areas within your poilcy do ask and confirm the details in writing.   

Develop your plan

Once your strategy has been decided upon, the plan can be put in place. Business continuity management plans will look different for different organizations. However, most good continuity plans share some important features:

• Make it clear who needs to do what, and who takes responsibility for what.
• You should always include deputies to cover key roles.
• Use checklists that readers can follow easily.
• Include clear, direct instructions for the crucial first hour after an incident.
• Include a list of things that do not need to be thought about until after the first hour.
• Agree how often, when and how you will check your plan to make sure it is always a ‘living document’.

A good plan will be simple without being simplistic. You will never be able to plan in detail for every possible event. Remember that people need to be able to react quickly in an emergency: stopping to read lots of detail may make that more difficult.

Rehearse your plan

The BCM plan is a living document and sometimes, you only discover any weaknesses in it when you put it into action. Rehearsal helps you confirm that your plan will be connected and robust if you ever need it.

Rehearsals are also good ways to train staff that have business continuity responsibilities. Possible ways to rehearse the plan include: paper-based exercises, telephone cascading and a full rehearsal.

You need to develop strategies that enable you to check the full plan with the minimum of cost and disruption.

Business continuity management solutions

Types of solution

There are a number of different solutions available today designed to help an organization both in the development and execution of their business continuity management plan. These include:

1) Business continuity planning

Here, help is provided to assist organizations to develop a workable business continuity plan. This includes help with:
· Preparing and presenting environmental analysis and business continuity plans
· Providing on-going management of business continuity projects and strategies

2) Business recovery solutions
· A range of solutions that enable organizations to identify the best possible means of ensuring effective recovery following an unplanned event. These include:
· Mobile units that include the necessary systems and work area shipped to site
· On-line recovery
· Workplace recovery at a dedicated centre nearby

3) Managed continuity services

A partner will deliver and manage solutions in areas where the organization may lack resource and expertise internally. Typically consisting of:

· Recovery rehearsal management - mutually agreed rehearsals to ensure that your business continuity plan is effective
· Continuity contract management - the partner takes on the responsibility for the relationships and service agreements that are already in place
· Data management - secure management and storage of data in real-time, without disruption to business operations
· Telecoms management - covering all call centre and general telecoms equipment.

4) In-house or external

Due to cost considerations many organizations will utilize internal resources to develop and execute their business continuity management plan.
While this may be realistic for a smaller organization, a larger one will typically require some external assistance.

To provide business continuity for critical business processes, organizations who decide to facilitate it in-house must:

• Acquire, train and retain skilled personnel who can develop and manage the complex interdependencies and specialized elements of creating and maintaining a BCM plan
• Establish and maintain relationships with vendors to assure the quick delivery of replacement PCs, network hardware, desks, chairs, telephones, etc., in the event of a major incident
• Secure adequate funding from end-user departments to implement and maintain adequate business continuity protection
• Make adequate provisions for adding recovery support staff in the event of a regional or natural disaster.
• Ensure that sufficient latent capacity will be immediately available to assure rapid failover and recovery
• Test the capacity availability without disrupting ongoing operations
• House failover equipment in a separate location from the main production equipment and provide further redundancies, such as obtaining electrical supplies from different sources.

Using a business continuity management partner for some or all of these requirements can be attractive for organizations that prefer to focus already scarce resources on day-to-day operational issues. By establishing a long term strategic relationship with a reputable BCM partner organizations can gain a competitive advantage.

Engaging a BCM partner enables these organizations to:

• Leverage the partner’s extensive investments in the latest technology,
• continuous improvements to methodologies, and skilled people
• Benefit from the expertise gained in solving problems for a variety of
• organizations with similar requirements
• Use the partner’s backup facilities and resources

Take advantage of the partner’s economies of scale on assets, resources and procurement to help enable a lower cost of operation and significantly less risk Concentrate on achieving core business growth objectives.

Ten things to look for in a business continuity management partner

BCM is critical to your business and although there are now an increasing number of organizations offering BCM services and solutions, the partner you choose must deliver support that addresses your company’s critical business processes.
Below are some of the factors to utilize when evaluating a potential business continuity management partner:

1. A focus on business continuity, separate from traditional disaster recovery services
2. Integrated solutions to assure availability of non-data centre resources, including networks, end-user workspace and call centers
3. Experience across a wide range of industries and disaster scenarios
4. Sufficient resources to accommodate multiple recovery clients in the event of a widespread disaster
5. The ability to understand the integration of IT with business strategy, and define the risks and impacts of a disruption to critical IT infrastructures
6. An understanding of e-commerce dependencies and business-critical requirements
7. Skills and resources to manage complex business continuity programs in a rapidly changing, networked IT environment
8. A significant investment in modern BCM facilities
9. Support for multi-vendor and multi-platform IT environments
10. A proven track record in recovery and technical support.

Summary

Business Continuity Management is not just about reacting to an incident. It’s not just about disaster recovery, crisis management, risk management control or technology recovery. And it’s not just a professional specialist discipline... far from it!

BCM is a business owned and driven activity that can provide the strategic and operational framework to review the way your organization provides its products and services and increase its resilience to disruption, interruption or loss.

While larger organizations generally can be said have more to lose and more ways to lose it than smaller organizations, smaller firms often suffer the most devastating results from seemingly minor business interruptions.  The resilience that comes from scale of operations can also mask the real world commitment and effort from SME organisations required. Owners and small business shareholders work tremendously hard and give up an enormous amount of time to the business. Yet, most do not count this investment when considering what they are protecting when creating a BCM process.

We would strongly recommend that all business carefully consider the guidance contained within this website and that the British Standard for Business Continuity (BS25999) is used as the model for your planning even if you decide not to seek accreditation. BS25999 uses a framework that establishes good practice gained from a huge amount of experience from a wide range of organisations.     

Smaller size limits the ability of an organization to absorb losses and respond to interruptions. The key to recovery is time. Following an unplanned event, the organization which recovers in the shortest possible time will mitigate their losses to an optimum level.

The Continuity Forum regularly runs workshop sessions to help organisations get started with Business Continuity both directly and in association with our Public Sector partners and others. For more details on these please check out the events pages or contact us directly using the link below. 

If you would like to know more about how your organisation can get involved and benefit from working with the Continuity Forum, please email us HERE! or call on + 44 (0) 208 993 1599.