Business Continuity Life Cycle - Part 2

Training scope and objectives – Specific training modules must be designed for emergency response, crisis management, damage assessment, disaster recovery teams and so on.

Gap analysis – Training programs must be designed based on gaps between existing skill sets and desired levels of proficiency. You must also plan for contingencies such as attrition, new recruitments, role changes within the company and so on.

Training requirements – Lack of a budget can often hamper training initiatives. Your organization can work around this constraint by incorporating micro training modules into everyday tasks that familiarize employees with what is expected of them during a disruption. You can also facilitate additional guidance through readily available reference material in multiple formats.

Scheduling and timelines – Shorter training schedules are more effective. Employee engagement is more, and visible improvements can be seen in implementation. You organization must also ensure that training schedules don’t clash with the timely execution of mainstream business operations.

Evaluation – You must carefully choose the parameters against which training outcomes are evaluated. Skills acquisition must be segregated into categories such as physical, logical, technical and then gauged accordingly.

In many industries, a BCDR capability is mandated by law. These standards and regulations are modified over time which could imply marginal, significant or extensive changes in your existing solution to meet the new requirements.

BCDR projects need to be structured in such a manner that plan development can be commenced as soon as approval is obtained on the project’s scope, budget, schedule and other aspects.

The prime focus is to sustain business operations, especially those that generate income and address the company’s corporate obligations such as remuneration and insurance. BCDT teams have the choice of developing plans for single, multiple or all the business processes. If your organization’s scale of operations is huge, then you can develop individual plans for each business process which can then be collated to leverage a consolidated BCDR capability.

BCDR teams work towards failing over mission critical operations to a backup facility. These backup facilities have the infrastructural capabilities to support operations during extended periods of time while operability at the main facility is being restored. Continuity of operations includes business continuity and disaster recovery plans as subcomponents.

This component of your BCDR project is deployed immediately after a major crisis. All DR plans include an IT segment that address the company’s crisis time technological needs and the restoration of business applications, servers, network infrastructure, and equipment and so on.

Crisis communication plans can be developed in parallel with BCDR plans. The ability of a company to transition business disruptions often depends on the effectiveness of its communication strategies and the relevance of its information sharing protocols in different scenarios. An already dire crisis situation can worsen if misinformed employees share inaccurate information with the press and media that further jeopardize the organization’s position. Strategies must be developed for both internal entities such as staff, teams and departments, as well as external entities such as suppliers, customers, stakeholders and investors.

Your organization’s IT department should ideally take responsibility for this component of the BCDR project. IT systems and infrastructure are an integral part of businesses today and a cyber security breach can severely compromise an organization’s commercial interests. These could include incidents such as:

Cyber incident responses are developed as part of disaster recovery plans and their scope includes addressing cyber attacks, evaluating the damage done, mitigating the impact on systems, recovery and resuming operations.

Your organization’s facilities team designs evacuation procedures that can be implemented during fires, floods, earthquakes and similar catastrophes. These plans include:

Your business is at risk when there is a possibility of a threat exposing one or more of your organization’s operational vulnerabilities. The first step involves creating an exhaustive list of all possible threats to your business. Data gathering techniques include questionnaires, interviews, document reviews and investigations. This is followed by assessing each threat across a range of relevant qualitative and quantitative parameters. The same procedure is then followed for the vulnerability assessment exercise. Finally, data is collated and a consolidated risk assessment report is generated.

This stage involves mapping your organization’s assets, resources, systems and infrastructure to the processes and operations they serve. Now your BCDR team assesses the impact on business when the availability of each of these components is disrupted. The impact on business can be further segregated into categories such as finance, operations, IT systems, legal and so on.

The main focus areas of the business impact analysis are:

The ISO 22301:2012 mandates the development of a business continuity strategy (BCS) after the business impact analysis (BIA) and risk assessment have been completed. Business continuity strategies include options for recovering and resuming mission critical processes at the least acceptable level within a specified time frame.

Business continuity strategies meet the requirements identified during the BIA exercise and consist of four broadly outlined categories:

Business continuity planning is essentially the identification of the internal and external business risks to your organization and developing a business recovery capability accordingly.

By developing a business continuity plan, you are assuring your customers, investors, stakeholders and other interest groups of a minimum service level during a business disruption.

Time is of the essence during disasters and apart from having a fully fledged BCDR capability in place, it is equally important to be able to deploy plans quickly. This requires monitoring mechanisms that constantly keep BCDR teams updated on the status of various impending threats.

Business disruptions can impact your organization through a variety of factors. Some of them have been discussed below:

Business disruptions heavily dent an organization’s cash flows through expenses such as payroll, health & business insurance, rent, utility services, travel expenditure, provisions and so on.

An organization’s ability to generate revenue during a crisis is severely hampered. This is especially true in the case of activities such as accepting new orders, order fulfillment and shipment.

One of the most critical aspects of any business disruption is that your organization can’t sell its merchandise. For instance, if your customers purchase your products through a website that has been compromised, then sales will suffer. Similarly, customers won’t be able to get in touch with sales representatives and place orders if the company’s purchasing facility has been damaged.

Receiving orders from customers during business disruptions can create backlogs in order fulfillments. If your storage facility has suffered an impact, then your products might be unavailable due to damage. Also, orders might take longer than usual to process due to procedural delays, which in extreme cases can lead to order cancellations and loss of customers to competitors.

Even if your organization is able to take new orders and products at storage facilities haven’t suffered severe damage, you might still not be able to deliver due to logistical hassles and operational constraints such as damaged roads or unavailability of transport.

Many organizations allow their customers a considerable leeway for making payments on orders. Following up on customer payment, ensuring error free shipments and preventing invoicing inaccuracies are some of the challenges that can arise due to business disruptions.

While incoming revenue slows down during a business disruption, organizations also have to bear additional costs such as

These additional costs tend to be more in the case of organizations that don’t have a BCDR plan in place.

The ability of an organization to survive a business disruption depends on factors such as

Cash flow and valuation largely influence an organization’s ability to raise capital. Both these factors get severely affected during a disaster or business disruption.

Decreases in revenue have a direct impact on the organization’s market value. Obtaining loans from banks immediately after a disaster might be difficult, even in the case of businesses with a proven track record, since their ability to generate revenue in the immediate future is impaired. Banks might lend a loan, but at a considerably higher interest rate.

Business continuity plan execution can be broadly broken down into the following three stages:

BCDR teams begin by responding first to the most severely affected operational segments of business.

BCP execution begins by carefully assessing the disaster at hand, the severity of the crisis and the feasibility of continuing operations. Influencing factors can include employee health & safety, property and infrastructural damage.

It is equally important that BCDR members strictly follow the roles that have been outlined for them without deviating from the original plan.

This becomes possible when you have a comprehensive BCDR plan that has taken into consideration all possible business disruptions. BCDR plans should be universally accepted by all teams and departments in an organization leaving no room for conflict of opinions.

Your organization needs to restore key business processes within predefined timeframes. This is a crucial activity that involves both internal as well as external business entities.

In this stage, BCDR teams are confronted with the immediate consequences of a business disruption such as a server malfunction, security violation or system failure. Infrastructure and operations are restored through precise procedures. Nevertheless, since crisis situations are erratic and unpredictable, these procedures are often improvised to address the specific disruption at hand.

Mitigating the impact of a disaster is a crucial objective during the recovery stage. This might even include temporarily stalling operations to detect the problem. Many of the activities in the recovery stage overlap with those of continuity of operations.

Assessing business continuity plans provides valuable insights into how gaps in the existing BCDR capability can be bridged to render an improved performance during future incidents.

Assessments must span across all aspects of a BCDR solution such as:

One of the main purposes of evaluating a BCDR plan is to compare and contrast its performance with the organization’s resiliency goals & objectives to identify areas for improvement such as: