Selecting a business continuity planner

Consultant or staff; generalist or specialist. The choice is yours. John Glenn provides some help.

Every organisation - commercial, industrial, non-profit, and government - needs a business continuity plan.

Some require a business continuity plan to meet fiduciary demands. Others need a business continuity plan for additional regulatory requirements. All must have a viable business continuity plan if they expect the organisation to survive a disaster event.

The first step to create a business continuity plan is to find a planner.

Business continuity vs. disaster recovery
A brief aside. Disaster recovery is NOT business continuity. Disaster recovery is the reactive sub-set of business continuity; it is the ‘picking up the pieces’ portion of the plan. Business Continuity is proactive and focuses on :

* Avoiding or mitigating risks;
* Maintaining at least a minimum level of service while restoring the organisation to business as usual;
* Is best implemented on an enterprise level (vs. business unit [profit centre] or resource [eg HR, Facilities, IT]).

Consultant or permanent employee
The business in search of a business continuity planner has three primary options:

1. Assign business continuity tasks to an employee and hope for the best.
2. Hire a business continuity planner/consultant.
3. Hire a business continuity planner from another organisation.

Unless the organisation is prepared to fund an employee's training and can find a mentor for on-going support, tasking a current employee with business continuity tasks is foolish.

That leaves the remaining two options. There are pros and cons to both.

Considerations
There are several organisational attributes which should influence the decision to bring in a consultant or to create a staff position and to hire a planner.

The primary question must be: is there enough plan and plan-related work to keep the planner busy beyond the time it takes to create a plan, typically about six months.

If the organisation
* Has multiple sites
* Is highly complex
* Is a regulated industry

it is a candidate for a staff (in-house) planner.

There are strong, and sometimes flawed, opinions on who should be brought in to fill a position.

Both consultants and staff planners can bring a high level of expertise to the business. Consultants typically have a broader background that staff planners. Conversely, a staff planner from within the organisation's industry has focused on problems unique to that industry.

Whether a consultant will "work out" as staff or a staff planner as a consultant depends solely on the planner's personality, not the planner's experience.

For the best of both worlds, employ a planner from one side to create a plan, and have a planner from the other side perform a gap analysis - review - of the completed plan. A plan review always is in order, regardless who creates the plan.

Planner as subject matter expert
Many organisations have the misconception that a business continuity planner must be an IT expert. If the organisation wants an IT disaster recovery plan, that requirement may be valid. Operative word: "may." The best business continuity plan is an enterprise plan, one which includes profit centres and support groups. The myriad of internal and external interdependencies precludes anything less.

If the "planner as IT subject matter expert" is valid, the planner would need to be a subject matter expert in all areas that make up an organisation.

The planner must be a business continuity subject matter expert. Period.

Actually, there may be a disadvantage to employing ‘specialty’ planners. Assume a planner who specialises in IT is brought on board. The planner brings his, or her, prejudices to the job, prejudices which may jeopardise the organisation. Rarely will a planner find the exact same system configuration in two unique organisations; assumptions should not be made based on prior organisations. Moreover, the specialist may overlook risks to other units. This is not to say that a planner's experience is of no value. As long as the planner - and the plan sponsors - realise that "all plans are alike and all plans are different," the planner's experience can be the most valuable asset.

Planner's attributes
No matter if the planner candidate is a consultant or an in-house staffer, he or she - to be successful - must possess the attributes listed alphabetically below.

Comfort in the job
While planners can be expected to have a life outside the office, they should "live and breathe" business continuity during business hours. This means talking about business continuity to everyone who will listen, from senior executives to the newest intern.

The rank and file will see the planner walking around the building - inside and outside - and unless someone tells them why this person is poking his or her nose in strange places, the reaction can be negative (paranoid). While ‘all hands’ should be aware of the planner's project before it officially begins, the planner must be able to talk one-on-one with individuals at the individual's level of comprehension.

Curiosity
A planner who ‘knows it all’ will almost guarantee the plan will fail.
The plan will fail because a know-it-all planner will make assumptions. In business continuity planning as in journalism, assumptions are ‘fatal flaws’ that must be avoided at all costs.

Beyond assumptions, most of us learned as children that know-it-alls tend to stifle cooperation. Cooperation from department subject matter experts is critical to any plan's success.

Diplomacy
Unless the planner is a VP/chief something officer, the planner must depend on the good will of all the people working on the plan. Typically, that means mid-level (operations level) managers and their staff.

While the planner needs an ‘800-pound gorilla’ for a sponsor, diplomacy proves much more productive that a heavy hand or a threat to ‘tattle’ to the sponsor. The planner must have subject matter expert allies if the plan is to protect the organisation.

Documentation
Business continuity planning is rife with documentation and the planner must be comfortable producing such deliverables. While a proposal may not be necessary, the planner still needs to provide a statement of work and project plan.

The statement of work, the SOW, is a prose version of the project plan. Both set the scope of the project, both identify resources, and both specify major milestones by name and anticipated date.

An all-inclusive questionnaire needs to be created to capture information for the first phase deliverable. The questionnaire must be carefully crafted so it is ‘right’ the first time; modifications as the Q&A process progresses can skew the results when data are weighed at the end of the Q&A period.

The planner must create a first phase deliverable typically consisting of an executive overview, business impact analysis (BIA), and recommendations. The BIA includes identification of critical processes, risks to the processes, and impact/probability data.

The planner must be able to create concise - brief, unambiguous - documents for the responders. The planner must keep in mind that responder instructions may be given to someone other than the person who normally would perform the specific task. Details are critical.

Finally, the planner must put it all together into a final deliverable which includes both phases, training program, maintenance methodology, call trees, vendor lists, and all background data used to make recommendations.

Marketing, selling the process
Planners constantly must market and sell business continuity - even when business continuity has stratospheric support, the planner needs to convince others that planning is good for them; that it protects them as individuals, it protects their jobs, and it may help them get new hardware or software to enhance their efficiency and value to the organisation.

Mentoring
Subject matter experts know just about everything they need to know about their subject, but unless they also are also business continuity subject matter experts, they need direction from the planner.

Mentoring is more than "diplomatic management," it is helping others develop skills they can use today and tomorrow.

Organisation
A planner must have better-than-average organisational skills. The planner will be juggling multiple tasks and, in most cases, will be working in semi-isolation. Anything less than a self-starter with a commitment to project completion will result in a never-finished plan.

Training
Even in large organisations with training departments, planners still need training expertise. Planners must help professional trainers develop curricula. In the absence of trainers, the planner needs a proven methodology.

John Glenn, CRP, has been helping organizations of all types avoid or mitigate risks since 1994. http://johnglenncrp.0catch.com/

DOWNLOAD PDF VERSION OF THIS ARTICLE

•Date: 28th May 2004 •Region: Worldwide •Type: Article •Topic: BC general
Rate this article or make a comment - click here