Here are a few reasons why business continuity plans fail, and how to avoid them.
1. Unrealistic Expectations
Many plans are created expecting that power, cell phones, phone lines, Internet, and water will all be working, and roads will be open. Plans are written expecting that everyone will show up for work, staff won’t have damage at home, won’t have to take care of families and pets, and won’t be stressed. This seldom happens.
As you create your plan TAKE AWAY some of the items mentioned one at a time, and then in groups. What will you do if power is out? Cell phones? Both Power and Cell Phones? If your community is out then you may just have to wait until these services are restored. Or, will you need to relocate to an alternate site with power and cell phone service while repairs are made? What can you do now to prepare for relocation so you can do it quickly and efficiently?
While planning TAKE AWAY key personnel who may be traveling or not available because of the disaster. Who will fill their places? Do the back-ups know what to do? Do they have resources like keys, passwords, and other critical items to do the job? Will other areas be affected if the back-ups are handling critical tasks? Assume that you will not be able to reach your key personnel and have to rely totally on their back-ups.
2. Focus on the wrong things
Question: What is your business continuity plan? Answer: We backup our servers every night.
That is a partial IT plan, not a business continuity plan. You need to focus on your personnel (their safety first!) and on your facilities. How will you communicate with your staff during/after a disaster? How will you get your response team to show up? How will communicate to the rest of your staff on your recovery activities and when they should expect to return to work? How will you reach staff if your area is evacuated? If your mail server is down?
Prepare your office with survival supplies—water, food, personal hygiene supplies, flashlights, batteries, etc. in case you have to Shelter in Place due to hazards that restrict travel. Educate your staff and encourage them to create or purchase survival kits for their homes, cars, and suitcases for events when they travel. (The more prepared your employees are, the faster your business will recover.) Gather contact info for your staff that includes personal e-mail addresses, cell numbers for their spouses or partners, and an out-of-area family contact you can reach and leave a message for your employee. Share the contact info with your key managers. You also need to have an alternate site that is far enough away so it will not be affected by the same event that disabled your main office.
3. Little or No Testing
Plans are often written and placed on a shelf or distributed to managers with little or no testing. An untested plan is not a plan, but a collection of words.
A simple table-top test in a conference room using a simulated event scenario can be surprisingly effective in finding weaknesses with a plan. Talk through an event, and take away certain resources, with your response team and make changes to your plan. You could relocate some personnel to your alternate site to see what it is like to work from that location. Do you have enough supplies at the alternate site? Is there enough Internet bandwidth for communications? Cell signal? Phones and phone lines? Finally, you could do a complete fail-over exercise and stress your systems to see how they will stand up during a disaster.
4. No Disaster Experience
Plans written by people without disaster experience can be doomed from the start. If you make the wrong assumptions, you will come to the wrong conclusions.
Depending on the size of your organization you may want to get someone trained, or hire a Certified Business Continuity Professional to facilitate your planning process.
5. Too Detailed
Plans are not owner’s manuals for your business, but guidance to your managers and staff on what tasks are to be completed, and in which order.
Include critical contact information for your staff, customers, and vendors. Too much detail can create clutter hiding important information. You need to designate which departments, and which processes and systems, will be recovered first. Consolidate your contacts so you can quickly reach staff, customers, your insurance company, and vendors. To supplement your plan you may need detailed documents with recovery steps and other critical information. However, in most cases, your subject matter experts (not always managers) will know what to do.
6. Not Updated
Business needs change. Technology changes. Staff changes.
Annually (or whenever there is significant change to your business or infrastructure) you should conduct a Risk Assessment and review your response plans.
7. Not Shared
A plan sitting in an office is of no use if the office burns down or you can’t leave your house. A plan is no good if it is only provided to a few top managers and leaves those who need to respond waiting for information. A plan is no good if it is in your head and not written down.
Write your plan. Even if it is one page saying “Recover our sales systems before our accounting systems” you will be giving key information to your staff. Use electronic tools like smart phones, tablets, and laptops so your plan is quickly available to your employees. (WARNING: Plans stored using online services may not be accessible if power or communications are compromised. If you use an online service make sure you download your plan and distribute it locally.) Periodically test your critical employees’ access to your plans, and the version they have, so you know they will have the right information if an incident occurs.
Plans created by Semel Consulting have helped businesses survive the Joplin tornado, Superstorm Sandy, and many smaller incidents you never heard of.