Peter Barnes, FBCI, argues that too few business continuity plans consider the ‘human variables’ and offers some guidance as to the issues to be addressed.
It is good to see the continuing upward trends in recognition of the value of business continuity management. A number of recent surveys have indicated that more firms than ever before are taking business continuity seriously and committing resources to a specific programme.
However, in my experience with many clients across a range of industries and business sectors, I am still concerned at the number of businesses that consider business continuity management to be primarily an issue for IT.
A common theme is that IT is expected to prepare plans to support the business in a disaster and that the business relies exclusively upon the IT function to service this requirement. To me this is not ‘business continuity’ planning. Even as an exercise in ‘IT disaster recovery’ planning I would question its value if, as is often the case, it has been undertaken without discussion with the business operations it must support. This will often result in a response that has over-engineered the infrastructure that supports some business needs at time of disaster and placed too little emphasis on supporting the tasks that are really critical – all through simply assuming that normal requirements will be mirrored in a disaster scenario.
It is therefore encouraging to find an increase in those that embrace the wider concepts of business continuity management and in those who use a comprehensive business impact assessment to prioritise their response to an unscheduled event so that IT and other services are proportionate to the real operational requirement.
However, it is only very rarely that I come across a plan that has taken account of the most significant variable of all – the people issues that will affect the firm’s ability to function in a disaster! Every firm will, at some time or in some context roll out the cliché that “its people are its most important asset”. Yet ask those responsible how the composition of these ‘most valuable assets’ has been factored into their business continuity arrangements and most will find it difficult to come up with a satisfactory answer.
Sure they will say how important their people are in terms of the roles to be performed on activation of crisis response or recovery plans:
– They have critical tasks to perform in an emergency;
– They are regularly exercised in crisis management or the recovery of IT systems / business processes.
Some will say how they have really thought the people issues through and, as a direct consequence, have appointed alternates to each key role. But almost all plans contain an assumption that the key people identified to populate their teams will be both available and will have the wherewithal to function to their normal capability following the disaster event. When questioned about this, few have really addressed the issue of the impact of a disaster event on the people upon whom the carefully planned response is dependent. Specific questions I ask are:
– Will a designated team really be able to perform with the speed and efficiency foreseen within the plan when close colleagues have been fatally injured in the firm’s disaster?
– What is the effect on individuals, for whom you depend in a disaster, when their personal space and memories (trinkets , photographs and so on that many maintain in their work-space) have been wantonly vandalised or destroyed in your disaster (it’s a little like the loss experienced in a burglary or fire in the home!) – will they continue to operate at 100 percent of their normal ability?
– To what extent have you assessed the risk that your employees / team members might be affected by the same disaster scenario at home? In many scenarios their primary concern will be to the immediate safety and welfare of their family – long before they are able to focus on the restoration of business process or system – however critical it is according to your plan!
– Do crisis-management / emergency response exercises consider the impact of the event on the stress-tolerance levels of the key decision-makers? The stresses of major disasters are of an altogether different nature to the stresses that produce the adrenalin to establish someone as a leader in his or her normal operational role.
In respect of the latter issue I am often reminded of the (perhaps apocryphal) tale narrated to me several years ago by Ron Ginn, FBCI (Hon), – one of the founding fathers and most respected figures in our profession – of a foreign national thrust into the leadership role but, due to the pressures at the time, unable to communicate with those around him except in his native Portuguese – not a widely spoken second language in many parts of Europe outside Portugal itself! Look around your own organisation – in these days of the highly mobile work-force this is the kind of issue that almost all firms must address – perhaps increasingly the rule rather than an exceptional scenario?
Some firms learned similar lessons in the response to the events of 9/11 – where there are graphic examples of firms with established business continuity frameworks whose management teams were so traumatised by the events around them that the pre-planned responses simply could not be activated in anything like the expected and rehearsed timescales. Several firms have reported that new structures / alternative people had to be drafted in to facilitate some level of activation of the plans that had been prepared prior to this calamitous event. While it goes without saying that this event brought on highly charged emotions for all people around the world, a much more localised or even personal disaster will be no less traumatic for the individual(s) affected.
Where does this lead to? The issues are very complex and it is simply not possible to produce detailed plans to address every conceivable scenario. However here are some key principles that I would recommend should be factored into your business continuity framework:
1. Use awareness and training programmes to command the attention of your people to consider that business continuity management encompasses not only IT, communications and business operations but also should address the infinite variables of the human factor;
2. Persuade leaders of the various teams within your framework that their responsibilities include, not only the operational or recovery tasks identified within the plan, but also the need to observe the conduct of their team members and to try to recognise when they might need support (or to be substituted) when they are negatively affected by the disaster event;
3. Seek input from specialists in the field of trauma recognition and counselling to help raise awareness of such issues and the correct ways to respond (getting it wrong can be very damaging to victims);
4. Consider how you might assess the performance of key team members under the types and extent of stress that you would expect to be encountered in a real emergency (few business continuity plan exercises can really illustrate or simulate this kind of reality); and
5. Use this information to review the construction of your teams – to take account of the fact that leaders in normal operations may not be the people who will be most effective in a disaster scenario.
About the author:
Peter Barnes is a Fellow of the BCI and former international operations director of Survive, The Business Continuity Group. Since leaving Survive he has developed a highly successful business continuity consulting practice, primarily in the financial services and banking sectors across Europe. He also undertakes regular conference speaking engagements and training presentations throughout the world. Contact: PeterBarnes@2c-consulting.com
•Date: 18th March 2005 •Region: UK/World •Type:
Article •Topic: BC general
this article or make a comment - click