Thoughts on business continuity exercises
It is well recognised by exponents of our art that effective evaluation of emergency or business continuity plans by exercise is invaluable. As contributors to this site we are all of like mind. The common thread in previous articles identifying senior management as an obstacle is not easily overcome. Our message needs to get out from this ‘congregation of the converted’ - out to those senior managers who are an essential component in a successful evaluation formula. Two CEOs of separate companies comment on a proposal to conduct a crisis management exercise: CEO A “We have to do this so just go ahead and get it done. Don’t bother me with the details and don’t spend too much. Let me know when it’s on and I will come along and say a few well chosen words to kick it off. I won’t be able to hang around but I will try to get back for the drinks afterwards.” CEO B “You will have my full support. I want this to work in the best interests of the company, the employees and our clients. We should all be involved but this will be your project. Let’s make it work and come up with some positive results or changes if we need them. Can you give me your first draft by the end of the month?” Do either of these sound familiar? In my experience I have dealt with both and it is not difficult to determine which was the more fulfilling experience, both for me as the facilitator, and for the participants. Crisis management exercises, or activities with a similar focus, must be supported by senior managers. If a manager is not supportive, more often by distraction than disagreement or disinterest, the exercise is doomed to not fulfil its potential. The manager must not only bear the mantle of supporter. He/she must be a driver. To assist the manager in driving a project, such as an exercise, he or she needs to be given the opportunity to appreciate what benefits the activity can bring to their organisation, and to their role. It is not my intention to suggest that the majority of executives cannot appreciate such things, more to suggest that, in the order of things, a busy executive has more pressing concerns. (I use the masculine gender without prejudice in the following...) CEO ‘A’ has separated himself from the exercise process. He shows greater concern for the cost than the benefit. He has not provided managerial input. He has not provided any guidelines. Even without knowing when it will occur he has taken himself out of the picture apart from the social side. CEO ‘B’ has embraced the process. He displays his positive attitude to its value. He devolves ownership to the project manager. He accepts that it may not produce all good news. He has retained his control with the introduction of a time frame. To management An effective contingency plan is an evolutionary and dynamic document that is reviewed in a timely and structured manner and keeps pace with change. I present the following, not intending to state the obvious, but in an effort to promote the exercise, in any of its recognised formats, as a very effective examination, evaluation and training tool, capable of ensuring continuous improvement. Does your emergency, continuity or contingency plan reflect current and future conditions? Do your staff demonstrate adequate knowledge of your plan? An answer of “NO” to either question should inspire immediate action. Will an exercise make participants more aware of your plan? You may have just identified a need to exercise – the first essential step in the process. The responsibility for the remainder of the process should be passed to a dedicated team. A facilitator will provide you with the best opportunity to present a structured and relevant exercise. If the two work in close cooperation, the team providing essential knowledge and the facilitator guiding the process, your exercise plan has the greatest probability of success. Your facilitator Your choice of facilitator is a critical factor. They are the other essential component in a successful evaluation formula. An untrained or inexperienced facilitator will either attempt to realise some wild imagining or produce only hollow efforts. Often the ideal consultant or facilitator will herald from an independent organisation. This will remove the risk of exposing pride or reputation to damage from an audience of peers or managers. An effective facilitator will provide realistic planning timeframes and will present an exercise structure that takes best advantage of targeted stakeholders’ availability. Food for thought In response to the problems and solutions described in the article recently published on Continuity Central (Improving business continuity testing and exercising) I suggest the following: Evaluations that appear to indicate exercising on a grand scale can be presented in smaller focussed events that provide impetus for each other in succession. Both managers and responders must be encouraged to have seconds or proxies and all must be exercised and evaluated. The ‘no-one cares’ attitude will exist and be tacitly supported by ineffective audit until a regulator or, in my experience, a coroner, asks, “What have you done to prevent this?” An activity spike will usually follow. The cited excuse of a “low probability of disaster” loses credibility when you insert Webster’s definition of ‘disaster’ - a state of extreme (usually irremediable) ruin and misfortune. The concept that “organisations simply don’t know what they don’t know” is eloquently put. Our task is to show them what they don’t know and the And then what? A great amount of material has discussed the exercise process, so I will not risk losing my readers by repetition. What I will state is that little emphasis appears to have been placed on the process that must follow the exercise to ensure an effective conclusion. I refer to actions resulting from any exercise debrief or ‘wash-up’. Managers, even if by delegation of the role, meet their responsibilities by ensuring the action process is complete. Accordingly, exercise debriefs must be minuted. Any recommendation that is discussed and considered necessary to implement change, training or other impact, must be translated into a positive action statement. This statement must outline the activity to be conducted and the result sought. The responsibility for this action must be allocated to a person who is present. A time frame for implementation must be agreed, recorded and adhered to. A review period must be established and adhered to. Again, accountability must be allocated to an individual. This closing step examines the impact of the action a reasonable period after implementation to determine if it was appropriate and effective, or requires further fine tuning. Final validation comes with your determination that the exercise has met the need. That performances resembled those expected under real conditions. That plans, procedures and performances have been improved. That risks have been reduced. That your credibility and reputation have been enhanced. 'Only the mediocre are always at their best.' Somerset Maughan The author
•Date: 2nd Sept 2008• Region: Australia/World •Type: Article •Topic: BC testing & ex. |
