An Article by
Graham N.
A Consultant from Sydney, Australia
Search Expertbase
Hire Graham
Virtually
Hybrid
In-Person
Business Continuity Management (BCM)
50 Claps
1305 Words
7 min
One of the emerging problems faced by businesses today is the question of how to continue to serve our customers if something goes horribly wrong. We have built up our reputation as a quality provider to our customers over many years, but if suddenly we couldn't deliver our product, how long would our customers wait?
Years ago, customers would give you a month or two to get back on your feet after a fire or similar crisis. But in these days of 24x7service, our customers expect us to have a way to still serve them, even in the worst of circumstances. So today, a business planning to survive needs far more than just a good business interruption insurance policy. It needs good business continuity management.
Remember, if you are out of business for a week you are probably out of business.
What is Business Continuity Management (BCM)?
Business Continuity Management is that collection of activities that goes into making sure your business can continue to operate, should something horrible happen to it.
What sort of "horrible" things can happen to my business?
* A fire or flood can damage or destroy your business premises
* Your mainframe, mid range, network or desktop computer hardware or software can fail, leaving you without the ability to access your data
* Your data can be corrupted by virus or other hacker attacks
* Your data lines can be cut
* The power to your premises can fail
* Civil protests or union action can stop you using your premises
* Your products could be contaminated, or your business can be affected by other reputational damage
* Accidental or deliberate explosions or terrorist acts could kill or injure staff
Business Continuity Management Involves
* Building Evacuation
* Crisis Management
* UPS/Generator
* IT and Voice Disaster Recovery
* Communications - staff, owners, regulators
* Communications - public, customers, suppliers
* Business Continuity Plans
BCM Linkage to Building Evacuation
In each of your locations you probably already have a building evacuation plan. Good evacuation plans for staff are an important component of effective BCM. If you don't have well rehearsed evacuation procedures already, then as part of your BCM you will need to develop them.
Your staff members are key to your business continuity, so you need to be sure they are well rehearsed in safely getting out of the building. And you'll need a role call of survivors, so you know which staff to move to your business recovery premises and also so the Crisis Management team leader can sound convincing on the six o'clock news. "Mr Jones, how many of your staff members are unaccounted for"? "I don't know" is not the answer you'll want to give.
BCM Linkage to Information Technology Disaster Recovery (IT DR)
At any time a hard disk can stop working, or something can wreck your network server. You take daily and weekly backups of your data and store them off site. But how often do you test your capacity to restore that data and systems software on to a replacement box? Each piece of business critical hardware and software should have a disaster recovery plan. That means that you know just where to find a suitable alternate computer and you know you can load your software and data files on to such a replacement computer and your business can continue unaffected. IT DR is an important part of your ability to continue your business. But if the people and business processes are not in place at an alternate location, it will not matter that the IT is working. You will still be out of business.
BCM linkage to Building Power Facilities
If mains power is cut to your building, you may have an Uninterruptible Power Supply (UPS) and/or a back up generator that will allow you to continue business from your primary premise. These are excellent facilities to have in place. But as part of your BCM, you need to be very clear on what power they will delivery to which power outlets and for how long. You may be able to continue business uninterrupted at your primary location because the generator simply replicates the lost mains power. But the generator probably only runs emergency lights and building evacuation requirements and the UPS allows you to shut down your IT in an orderly fashion. It doesn't allow you to continue to run the business.
Elements of Effective Business Continuity Management
Risk and vulnerability analysis
First you consider the risks that your business might reasonably face. While terrorism is much talked about, it's probably more likely that a fire or power failure will affect your business before terrorism does. By listing the sorts of likely risks you face, you can begin to plan ways to mitigate those risks.
Business Impact analysis (BIA)
Having identified the risks, you can consider the impact those events would have on the business. You can identify the critical parts of the business that you would have to recover first in order to stay in business.
Business Continuity Plan (BCP)
When you know the parts of the business that you will have to make sure are working in order to stay in business, then you need a plan. Your plan will include flowcharts which show how to do those critical processes, it will contain lists of where to find the people needed, list the materials needed and where to get them, list the computing hard ware and soft ware needed, list the voice and data communications required, list the contractual and statutory service requirements needed, and so much more. It will also identify the premises you will use to restore your business according to the BCP, how you will restore your data and voice connectivity to those premises and so on.
Crisis Management Plan
Whatever caused you to invoke your BCP, it was some form of crisis. So you'll need a crisis management plan. In that plan you will have listed all the business, mobile and after hours contact information for your crisis management team. They will be a senior group who can make and implement the decisions needed in a crisis. Your crisis management plan will include a communications plan, with details of who will need to know what and when. And list in detail how those messages are to be communicated with those people. All your stakeholders will need communication. There will be customers, owners or shareholders, the public, the media, the regulators, the industry bodies and most importantly, your staff.
Rehearsal and testing
The effectiveness of your business continuity plan is limited to how well the people involved can implement the plan. Writing the plan is important, but a waste of time unless it is rehearsed. By doing a series of graduated rehearsals, from desktop walkthrough to "live" simulations, the crisis management team and the business recovery staff can all learn how to play their parts. Waiting for a real crisis to happen and then discovering that the plan had overlooked a critical area is a bad idea.
Ongoing plan maintenance and development
Once developed and rehearsed, the plans need to be monitored to ensure they remain current. As your business systems, products and customers change, the plans need to be reviewed. As key staff come and go, the plans need to be reviewed. With each rehearsal and test further enhancements will be identified and the plans developed. Each successive improvement increases the speed and efficiency with which your business will be able to recover from something "horrible".
Useful Information Sources
http://www.standards.com.au HB 221:2004 Business Continuity Management Handbook http://www.thebci.org/ The Business Continuity Institute UK http://www.drii.org/ The Disaster Recovery Institute International USA http://www.continuitycentral.com/ Continuity Central - A resource for Business.
This Article is authored / contributed by ▸ Graham N. who travels from Sydney, Australia. Graham is available for Professional Consulting Work both Virtually and In-Person. ▸ Enquire Now.
Comments
What's your opinion?
50