You know what it’s like – the first couple of days back from a vacation are always the worst. You have mountains of emails and projects to get caught up on, among other things.
Compounding this problem are any new projects that your company leadership so graciously decided to throw in your lap while you were out. Missing an important meeting like this can lead to all kinds of headaches…
This is the theme of a presentation from Virtual Corporation about setting up a business continuity program – “You missed the meeting…and now you’re in charge of business continuity! What’s next?”
We came across this presentation following our post on the good, the bad and the ugly in response to Hurricane Hermine back in September. As we explained, it was readily apparent to those of us in the eye of the storm in Tallahassee which businesses were prepared for a disruption to their operations and which ones were not. Unprepared companies like our local Walmart stores not only lost business to competitors with a better business continuity plan, they lost a huge amount of merchandise requiring refrigeration, suffered damage to their reputation, and more.
According to Forrester VP Stephanie Balaouras, many business continuity planners fail to consider downstream consequences caused by the initial crisis. Many planners, for example, don’t anticipate outages to critical items like electricity, water or telecommunications.
If you have found yourself being put in charge of business continuity for your company, don’t panic. Take a deep breath and consider the following 6 steps to setting up your business continuity program.
Step #1 – Assess your situation
The first question you should be asking yourself out of the gate is whether you have the requisite skills and knowledge to be the business continuity planner at your company. If you don’t know what Organizational Resilience Management (ORM) and its tightly integrated disciplines are, your first step should be getting familiar with these concepts before speaking to leadership and relevant departments.
Step #2 – Define your organization’s resilience (ability to resume operations)
Organizational Resilience Management (ORM) can be defined as “systematic & coordinated activities & practices through which an organization manages its operational risks, & [sic] the associated potential threats and impacts that are inherent.” ORM’s integrated disciplines include business continuity, disaster recovery, risk management, emergency management, and crisis management. Here you can identify a minimal level of capability to serve as a benchmark in the event of an emergency.
Step #3 – Gather critical data and determine risk
Like other important functions at your company, accurate information is critical for justifying, building and maintaining a business continuity program. You also need to understand your organization’s appetite for risks (…see step #2) along with its current ability to respond and recover. Instead of just gathering information at random, you should have a process to both collect information quickly and then use it to create an appropriate business continuity program for your organization.
Step #4 – Gain executive buy-in
Without “buy-in” and approval from executives, your business continuity program won’t get off the ground. To get this buy-in, you first need to have an intimate understanding of the leadership’s organizational and reporting structure for ALL parts of the company. Next, you need to understand what’s keeping these individuals up at night. Depending on the size of your company, you may need to hold executive business impact analysis (EBIA) sessions with leadership to understand their top concerns.
Step #5 – Determine your strategy
What is the long-term vision for your business continuity program? What are the formal policies you will adhere to? You may also need to develop a business case for ORM, and definitely identify the overall scope of your program. Elements of your program’s scope can include: functions and services, event classes/categories, continuity strategies, specific office locations, and any tools you will use.
Step #6 – Build your program
Once you’ve completed the first 5 steps, you’re ready to actually build your program. Get ready to roll up your sleeves and dig in. Here’s where you will formally document policies and procedures and establish any necessary training programs. Developing a consistent process that is structured, uncomplicated, repeatable and reasonable helps ensure your program’s long-term success.
A few words of advice and caution you need to keep in mind when setting up your business continuity program…
Caution: You should absolutely NOT jump in head first without any knowledge or experience with business continuity.
Making assumptions and taking an ad-hoc approach to planning, establishing and executing your program are just a few ways to ensure failure.
Advice: Take the time to talk and listen to executives and managers about their pressing concerns. Ask probing questions, plan accordingly and be honest with executives about resources you will need. Also, having a strong command of the subject and a passion for your business continuity program will dramatically increase the odds of it succeeding.
Caution: Don’t assume the business areas have coordinated use of systems and/or vendors.
Advice: Understand system dependencies up- and downstream.
Advice: Prioritize activities based on criticality to the organization functioning and fulfilling its mission.
Exhausting…but worth it.
Setting up a business continuity program can be an exhausting process, but will absolutely be worth it should an emergency occur or some other disruption to your company’s operations. Circling back to Stephanie’s article, good business continuity planning is “…the cornerstone of a resilient organization,” especially considering how so many businesses are completely dependent on complex technology.
We invite you to visit our post on Hurricane Hermine for a real-world glimpse of how a business continuity program helps companies and their customers, or how a lack of a cohesive plan can have negative impacts ranging from inventory loss to damaged reputations and more.
