WELCOME TO THE CONTINUITY CENTRAL ARCHIVE SITE

Please note that this is a page from a previous version of Continuity Central and is no longer being updated.

To see the latest business continuity news, jobs and information click here.

Business continuity information

Developing scenarios

Jim Preen provides some advice on how to set up convincing business continuity exercise scenarios.

Terror blasts, white powder attacks, pandemic flu, cyber crime, the list goes on. At the sharp end of business continuity it really is one thing after another.

We seem to spend our lives frightening the life out of crisis management teams by dreaming up the best possible scenarios to test their response and the company’s business continuity plan. So what makes for the top scenario - one that really tests the plan and the players?

Of course before you come up with a convincing story line, you have to decide what you are trying to achieve. In other words a scenario must enable the aims and objectives of an exercise to be met - if it does then that is the measure of success for that particular scenario. Inevitably, scenarios are very business or client specific, so what will work for one, might be a complete failure with another.

Another major consideration is engaging all the participants. If people are bored the test will fail. For example, a strategic scenario is unlikely to get much traction with the premises team while a faulty air conditioning unit (however important) will quickly bore the CEO.

A colleague recalls an exercise run for a food processing company. The specific aim was to see if the company could continue to supply chickens to a major supermarket chain while refurbishment was underway at their plant.

The initial scenario - building work - was credible because it was real - the later introduction of food contamination and product recall was again entirely believable. Finally the company was hit with the failure of one of their processing machines and the discovery of asbestos. These additions were again quite plausible and had the added bonus of bringing the Executive into play because of reputation issues.

This story worked because it developed in a logical, credible way introducing more complex challenges as time progressed.

Another colleague makes the valid point that ‘no plan survives contact with the enemy’ and therefore to test the flexibility of a plan you have to grab players and haul them out of their comfort zone.

One example of this is the white powder attack. Powder is found in the mailroom, which leads to immediate evacuation and no access to anything left in the office for an indefinite time.

Suddenly people find themselves without car keys, computers, paper files and most of their personal belongings. So how do you get your people to safety or home? Mobile phones become overloaded and out of the blue there are major problems communicating with management, staff, family, suppliers and customers. Then the local media start getting in on the act and suddenly you have a pretty interesting tabletop exercise that forces people to think creatively and (hopefully) come up with innovative solutions.

Of course a white powder attack could be just one element of a far wider scenario. Take, for example, activists targeting an organization. A bank is unexpectedly forced to endure the wrath of anti-vivisectionists because it lent money to a science laboratory that carries out animal testing.

This provides an excellent opportunity to disrupt operations as well as the potential for staff injuries and harassment. It will also likely engage the media.

Using activists as part of the scenario can also probe the underlying business model and reputation of an organization.

‘No blame’ scenario
Another factor to take into account is the culture of the organization involved in the plan test. Some prefer a 'no blame' scenario such as severe weather or terrorism - where the company is an innocent victim. But naturally, as good scenario writers we’ll throw in injects that attempt to hinder the company’s response. This should drive the simulation because although the initial incident wasn’t the company’s fault, if their reaction is seen as tardy or in some way lacking then staff, clients and the media will soon be up in arms.

Alternatively, some organizations are quite content to face the music and accept a scenario in which they bear some of the blame. This might involve data loss, product recall or perhaps the crisis scenario of the moment - cyber crime.

Pandemic flu
Well I guess I won’t be allowed to escape without nailing my colours to the mast. So what is my favourite scenario? As with all things scenarios seem to be at the whim of fashion or at least what’s been in the news recently. How long before we start devising an exercise based on widespread rioting and looting?

Some years it’s terror attacks, then the smart money is on damage to data centres, but for me, I miss the ‘good old days’ of pandemic flu. That often seemed the perfect scenario because it was and is potentially catastrophic (how we love a good catastrophe!), could affect any organization, but also allowed for planning, being a rising tide event.
It involves human beings rather than technology, which can be a turn-off to those not technically minded and given the medical evidence also highly credible. No doubt it will stage a comeback in a year or two.

Ultimately, I suppose, the scenario itself is not the most important factor, it’s the resultant impacts that count and how the players react and interact as the scenario unfolds.

Now over to you. What have I missed out? What are the scenarios you’ve found most successful and why? Email editor@continuitycentral.com to respond.

Author: Jim Preen is with www.crisis-solutions.com

•Date: 25th August 2011 • Region: UK/World •Type: Article • Topic: BC Exercising

Business Continuity Newsletter Sign up for Continuity Briefing, our weekly roundup of business continuity news. For news as it happens, subscribe to Continuity Central on Twitter.
   

How to advertise How to advertise on Continuity Central.

To submit news stories to Continuity Central, e-mail the editor.

Want an RSS newsfeed for your website? Click here