|
Ray
Liepa details what’s required for quality control of business
continuity management documents.
Your
business impact analysis and risk assessment report is finally complete,
and the content is as per the agreed scope and / or project charter.
Microsoft Word spell checker has sorted out any typo and grammar
errors. Layout and fonts (style and size) look good, paragraphs
are set to “justify”, a table of contents is in place,
and you have read through the report a final time and all looks
good. Ready to print, bind, and issue to the client / project sponsor?
I don’t think so! Why?
Several reasons, and most of them are worthy of comment and consideration.
Let’s start at one of the basic requirements before looking
at some of the nitty gritty niceties. Who else has read through
this document? You, as the author of the document, have (hopefully)
been very close to all the information gathering stages: meetings,
interviews, workshops, site and facility inspections etc. You have
written the report from your understanding and viewpoint, based
on your exposure to the whole organisation (or at least to the extent
of the agreed scope) and the mound of information you have gathered.
When you have created a report like this from scratch, you were
probably exposed to each set of information a number of times; when
you first received it in whatever form, as you collated and analysed
it, as you assessed it, as you wrote the first draft, as you modified
and updated the draft, and as you read through it (again). You feel
thoroughly comfortable with the information now and with the way
you have written it, and that could be your downfall. It is somewhat
akin (and this might not be the best analogy, but think about it)
to looking at a several storey glass windowed building to check
if all the windows are closed. How do you look at it; to see if
all the windows are closed, or to see if any are open? It can make
a difference to the outcome and what you “see”. A similar
situation can arise when you read through the document and are assessing
information that you have seen a number of times before. You expect
to see or read things a certain way, and that is what your brain
tells you actually is there – what you expect to see!
So, perhaps pre-issue rule number one should be to have at least
one other suitable person read through your draft report as a peer
review. Preferably use someone who has been involved in the information
gathering process for the report. Even better is to use a two-person
peer review process. Discuss with the reviewers any changes suggested,
and correct any wording or explanation that is not clear to the
reviewer, or could be mis-interpreted.
Are there some basic document creation techniques or guidelines
to assist in this process and ensure it is as least time consuming
as possible for the reviewers? Absolutely. Assuming you are using
an already developed report template (almost always the best way
to go when you are going to be repeating this whole exercise for
multiple reports), then just ensure the following suggestions are
incorporated as appropriate to your environment and updated prior
to the peer review process:
* Front cover with clear title, issue date, version number, any
logos required
* Headers: any document classification, DRAFT background across
each page
* Footers: document identification, version, page numbering, print
date
* Document revision control: table format with changes effected,
page numbers, version numbers and dates
* Document history: table format with reviewer titles, names and
review dates
* Document history: table format with project sponsor, client review
details
* A one-page abbreviations table – check through the document
for all used
* Assess whether a glossary of terms is required (preferably insert
at the back)
* References: table format summary of documents, notes, information
sources
* Signoff: table format with “internal” name, designation,
company, and date
* Signoff: table format with “client” name(s), designation,
company, and date
After changes don’t forget to select a final spell check and
update the table of contents (should just be a select TOC and F9
if you are using MS Word). This should complete the basics of preparing
the report to a satisfactory standard to now present to the project
sponsor or client for their review. One final check before printing
and binding is to assess if certain pages would be clearer to understand
or have more impact if they were printed in colour. One example
of this in the BIA/RA report is the business impact analysis and
risk quartile matrix. In colour it is immediately apparent where
the high impact / high risks are (being located in the red zone),
and thus printing this page in colour removes any ambiguity that
might arise if the table is presented in shades of grey.
Deliver the draft report in the format agreed, which could typically
be a printed copy, by e-mail in MS Word, or in a read only Adobe
Acrobat pdf format. A word of warning, be wary of presenting documents
in MS Word format, especially if they are a draft version, meaning
the documents are really still in a work in progress state and therefore
subject to further change. Particularly for the project sponsor
or client review, it is far safer to protect the integrity of the
original information in the document by not allowing unauthorised
changes. At all times retain a central (such as the document author)
change control and version control over the draft report right up
to the point where it is finally issued and signed off.
When the draft report is issued for project sponsor or client review,
schedule a follow-up meeting with the project sponsor or process
owner to discuss any changes (these should be agreed by all three
parties – the client or project sponsor, the document author,
and the relevant department), information additions, or any explanations
that might be required. Ideally set this meeting to be not more
than one week or thereabouts after delivery of the report. Experience
has shown that some project sponsors are not averse to taking the
whole arm when offered a hand, so keep control of the timescales.
Even at this late stage a certain element of dragging the heels
by the project sponsor or document reviewers can drastically delay
the final report delivery, and thus hinder closure of this project
phase.
After the draft report meeting and discussion with the project
sponsor, apply the agreed changes, update the document footers and
quality control tables, assess whether another internal peer review
is required, remove the draft header, give a final spell check,
and re-issue as the final document. To confirm that this is a final
document issue and the content is complete and as per the pre-agreed
scope to the satisfaction of the project sponsor and other relevant
parties, get sign off. This can be in a number of formats, but perhaps
the easiest is to have a sign off table in the document. This should
list the document approval names and company designation as required
against the signature and date. Ideally this should have been agreed
up front and documented in a project charter or similar document.
These suggestions are offered as the minimum requirements for good
business continuity management document quality control. Hopefully
by implementing all of the above you can improve your document deliverables
and in doing so improve the overall standard and value to the client
/ project sponsor. However, please note, in addition to all the
points previously discussed, you also need to assess and possibly
add the specific requirements that your own working environment
or the company you are consulting for requires. These could involve
several related areas, but in a nutshell could also cover document
management and classification for information security, use of a
document management system application and control, specific font
sizes or report style layout, and even specific company logo rules
for use on documents.
The above is not a complete ‘list of requirements’
for good document management and quality control, but does provide
what I consider to be the main basics of the process. If you implement
the above, you will be a long way down the road to achieving good
document quality control. Happy writing !!
Ray Liepa MBCI is a business continuity consultant with
ContinuitySA (Pty) Ltd: South Africa. ray.liepa@continuitysa.co.za

•Date:
15th Dec 2004 •Region: S.Africa / World •Type:
Article •Topic: BC
general
Rate
this article or make a comment - click
here
|