|
 David
Honour asks whether the priority should be given to crisis management
or plan development when funds are limited.
In an ideal world, with unlimited funds and resources, business
continuity managers would develop well rounded, fully tested, comprehensive
business continuity plans, whilst at the same time putting together
carefully chosen, regularly exercised, crisis management teams.
However, the reality is that for the vast majority of organisations,
business continuity management activities are compromised by limited
budgets and insufficient time and resources. Therefore some prioritisation
must take place. This is the first in a series of Continuity Central
articles which will attempt to explore the prioritisation process
and the reasons behind the budgetary and resource decisions that
business continuity managers make.
Plan development and crisis management are both key areas of business
continuity but where should the priority lie? Where funds and resources
are limited is a better to try and focus on both areas or should
one area be given the lion’s share of resources to the detriment
of the other?
In true business continuity style the way to make the decision
is to start with a risk assessment:
1) Scenario one: split funds and resources equally between
the two areas.
This would mean that both plan development and crisis management
could be covered up to a point. However, there is a substantial
risk that both areas will be compromised with the result that the
business continuity plan is not as good as it could be and neither
is the crisis management team. Both could fail to perform well during
an invocation.
2) Scenario two: focus funds and resources on plan development.
Here a detailed business impact analysis would be conducted and
the major risks identified. Mitigation and recovery strategies would
then be determined. This would result in a document that fully details
the steps that will be taken to restore the company’s mission
critical assets within the required recovery time objectives for
the incidents that have been considered. However, since little resource
has been put into developing the crisis team there is a strong risk
that the plan will not be correctly used and implemented during
an incident and that, if a scenario occurs which goes beyond the
boundaries of the business continuity plan, there may be panic and
confusion rather than strong crisis leadership and rapid decision
making. One of the major lessons learned from September 11th was
that many companies with well-prepared business continuity plans
failed to handle the crisis effectively because the disaster created
conditions which were beyond the scope of the plans.
3) Scenario three: focus funds and resources on crisis
management.
Here the bulk of the limited resources are used to develop an excellent
crisis management capability. A team is selected for its experience;
its decision making capabilities; its ability to perform well under
severe pressure and to be able to think ‘outside the box’.
The team is frequently exercised and is strongly developed using
team-building techniques. The advantage in this scenario is that
the crisis team can respond to any potential incident and can quickly
develop appropriate recovery strategies, even if these had not previously
been envisioned. However, there is a strong risk that, because the
focus has been on crisis management, rather than on business continuity
plan development, the information that is needed to implement the
disaster recovery strategies that the crisis team develop might
not be available or might take a long time to acquire.
From the above it seems clear that a compromise solution is required.
The benefits seem to fall on the side of having a strong crisis
management team; but some element of business continuity plan development
is necessary to ensure that the team has the necessary information
and that the required pre-planned disaster recovery arrangements
have been made. This is the MINIMISED PLAN and MAXIMISED TEAM approach:
MINIMISED PLAN
Keep the business continuity plan document to the absolutely bare
minimum - no complicated procedures and processes, just simple information
that the crisis management team can use as the basis of taking action
and decisions.
MAXIMISED TEAM
Build the best team possible with your internal resources and add
external resources where necessary to strengthen the team and fill
the gaps. Use psychometric testing to help with this process. Train
the team and exercise it again and again. Encourage lateral thinking
and positive leadership. Ensure that your team can always be quickly
contacted and that members know the exact location of primary and
secondary Emergency Operations Centres and muster points. Ensure
that each team member is backed-up by a deputy. The team should
be empowered to make all necessary decisions for the company, should
include key directors and managers and must have a clear leadership
structure.
The above approach requires a particular ‘breed’ of
business continuity manager to facilitate it. This person will no
longer be primarily a planner but instead will be a ‘people
person’. Analytical skills will still be needed but will take
second place to team building and training abilities.
MAKE A COMMENT
Got an idea for a useful addition to the Business Continuity
on a Limited Budget article series? Let
us know
•Date:
12th November 2004 •Region: World •Type:
Article •Topic: BC
general
Rate
this article or make a comment - click
here
|
