|
By
Jim Burtles, FBCI.
It has often been said that 'business continuity
is not rocket science'. Indeed, it is better described as structured
common sense. However, it could be argued that the structures that
business continuity consultants tend to recommend are often way
beyond what is basic. Sometimes our recommendations extend into
elegant, complex or even bizarre superstructures that stray far
beyond simple common sense. These convoluted paradigms are proffered
as ‘best practice’ or ‘current thinking’
in order to distinguish the consultant from the run of the mill
practitioner.
 Perhaps
it worth going back to basics and considering what can be achieved
by the application of pure common sense. Maybe we don't even need
the structure if we simply open our eyes and minds and consider
some simple remedies that need not cost us a lot of time, energy
or money.
Our starting point for this logical non-technical
approach is to consider the differences between normal operations
and the interruption that we wish to avoid. If we can reduce the
differences then I suggest we are engaged in business continuity
management, which is simply an attempt to extend normal operations
beyond the point of interruption. We can also view it as preparing
to bypass the effects of such an interruption by recapturing or
rebuilding a near-normal state of affairs.
Basic preparations
Any manager of a business unit, function or department is bound
to be familiar with the processes and procedures of its regular
business routine. A major aspect of their executive role is the
ability to deal with the minor problems and frustrations that occur
from time to time. Their coping strategy is usually to identify
what is different. Then they can figure out how to reduce the difference
(or differences) and get the show back on the road. Whenever those
differences outweigh this simple coping strategy we have a serious
problem.
Serious problems are where business continuity
steps in to save the day!
So how can you extend your coping strategy to deal with larger problems?
One way would be to become better informed about what you have in
the way of resources and capacity to address those unknown nuisances
or inconveniences. More information can pave the way for alternative
solutions and preferred options.
Do you know, for instance, what is normally
physically there within your business unit or function? Is there
an inventory? Such an inventory should cover everything, including
those items that are no longer being used. In an emergency a 'make
do and mend' approach depends on having a range of options as well
as a resourceful and constructive attitude.
Whilst you are making an inventory for recovery
purposes it would also be useful to know what is critical. There
are at least two categories of criticality to consider: what is
critical to the business as a whole and what is critical to your
particular part of the business.
Other aspects of a resilience inventory that
you might consider would be:
* What is useful? (i.e. multi-purpose, easy to use, reliable or
adaptable);
* What should be there? (i.e. what you feel or know you might need,
or what is missing);
* Where it should be (i.e. where it belongs, how and when will it
be returned or acquired);
* Who can do what? (i.e. what emergency skills and attributes do
you have in your team)
Practical steps
Each and every business unit should be able to produce for itself
a simple emergency resource register. This would be invaluable in
an emergency and quite useful in a business continuity exercise
or rehearsal.
This emergency resource register might have
three sections. Each section of the register would consider one
aspect of dealing with an emergency situation within that unit.
Bear in mind that there may also be many resources or facilities
that are shared with other units.
Ask questions such as:
* What have we got that might be useful in the event of a fire,
flood or other emergency?
* What is surplus to our immediate requirements? (i.e. could be
useful to others);
* What is missing? (i.e. what might we need in an emergency).
Once you have prepared your emergency resource
register it would be a good idea to share it and compare it with
other units. Then you can revise and update your registers on a
mutual support basis. The end result would be that everyone would
know what to expect in the way of resources in an emergency, based
on what is already in place.
Improvisation
Often the progress of recovery from an emergency situation is made
easier when people are able to invent or resort to ad hoc measures
based on the limited resources that are available. Get together
with the rest of your group to develop an improvisation table in
which you list your ideas about how you might 'make do and mend'
in the event of an emergency. The result would be a useful reference
to remind you of: -
* The skills and resources that can be expected to be there;
* How they might be imaginatively employed for dealing with minor
emergencies;
* How they might be creatively put into effect for coping with a
real disaster.
At the same time you might find it equally
informative to develop a 'willingness register', where you make
a note of how to make the best use of your people as individuals
in an emergency. Don't forget to also ask about their limitations
and reservations, or what they are not prepared to do. For example,
some people may be unwilling or unable to travel long distances
due to family commitments such as children at school. In an emergency
it could be very useful to know: -
* Who is prepared to do what? i.e. activities and conditions they
will tolerate;
* Who is not prepared to do certain things? With a note of their
reasoning, perhaps;
* General reservations - i.e. those activities where the whole group
is reluctant;
* What people can do, or provide, above and beyond their normal
duties. For example - have four-wheel drive vehicles, a heavy goods
vehicle licence, or have unique skills.
You might also consider developing a skills
and interests database, listing all those alternative capabilities
that might prove useful under strange or unexpected circumstances.
Make the list as comprehensive as possible. If you restrict the
list, you just might miss something that could become a key attribute
one of these days.
The resilient mind set
The essence of a successful recovery is the attitude and capability
of the individuals who accept the challenge and carry out the tasks.
The true measurement of success from a business perspective is the
pace of the recovery.
All of our business continuity plans and preparations
are aimed at improving response and recovery times in order to reduce
the impact on the business. Thus, if we are to succeed with our
business continuity intentions we must establish and retain a resilient
mindset within our emergency, recovery and restoration teams.
This means developing their confidence and
skills through an education or training programme and enabling them
to experience success in solving the problems posed by an emergency
situation. Such programmes need not be onerous or expensive. Their
purpose is simply to prove to these people that they can solve unusual
problems under unusual circumstances. Providing they have the confidence
that stems from successful experiences they will make the plan work.
At the end of the day you can have the highest quality plan possible
and may have made the most meticulous preparations but it is the
preparedness and flexibility of the people implementing and using
the plan that will ensure its success or failure.
Nice to have
After a fire, a flood, or some other damaging incident, the first
phase of the recovery process is likely to involve retrieval and
salvage of the building's contents. Without some forethought and
pre-planning this can become a rather haphazard game of chance from
the business continuity point of view. How do the retrieval teams
know where to concentrate their efforts? How can the salvage people
identify the items they are dealing with? How are the recovery group
going to figure out what belongs to whom, where it came from and
where it should go? The whole purpose of the exercise is to return
these things to their original owners or users in a useful state.
Salvage engineers rely on their skills and knowledge to achieve
the useful state but they can't be expected to know what belongs
to whom, or even where it came from, without some help from us.
We must also remember that much of what they handle is likely to
be barely recognisable.
To ease their task and help solve some of the
problems of the business restoration groups, there should be some
plans and background information available to them:
* Floor plans should be available to help direct the retrieval and
salvage operations of specific items or groups of items;
* Plans showing the general layout of building should be available
to assist rescue workers and track progress of the emergency management
and damage control work;
* Consideration should be given to a suitable desk or work position
identification scheme so that items can be related to their original
context;
* A detailed layout of the working environment may also be useful
if it becomes necessary to recreate the same or a similar set up;
* It could be very useful to have a personal addressing scheme for
tools and property.
Numbering every workstation, desk or working
area might form the basis of a personal addressing scheme. In a
large building the numbering scheme would include a coding system
to identify the floor, wing or section of the premises. For example
23/GF/A might represent desk number 23 on the ground floor of block
A. These numbers (or address codes) can simply be recorded on a
floor plan or perhaps each desk and associated item of equipment
might be suitably labelled. Address labels might be colour coded
to indicate the particular floor, wing or building. Ideally, such
labels should be attached before the event(i.e. NOW) but there may
be objections on aesthetic grounds. There might also be objections
because the dynamic nature of the business could make it difficult
to keep the addressing scheme up to date. Some thought needs to
go into the way in which you would implement and maintain such a
system.
Cover up plans
During a disaster, such as a fire or other destructive event, much
of the secondary damage to equipment and facilities could be avoided
if these were suitably protected from water, dust or smoke etc.
Therefore it would be very useful for everybody (especially the
fire fighters) to know what should be covered up, if there is time
to do so. Such cover up plans should focus on the one or two items
of major importance - there is no point in trying to save everything.
Time and safety considerations will be against any complex or ambitious
intentions.
Of course, a cover up plan is not very practical
unless you have some tarpaulins, dustsheets or plastic sheeting
to implement the plan. Key items of equipment or machinery should
have their own fitted covers and should always be covered at the
end of each working day. But, like the clean desk policy, this idea
is totally dependent on everybody acting responsibly.
Security sweeps
Very often in the aftermath of a disaster there are a number of
items that cannot properly be accounted for. Either items are found
that were not expected to be there or things that ought to have
been there cannot be located. 'Extra' items are a source of concern
as they might have contributed to the incident as triggers, catalysts
or accelerators. Missing items pose the problem of whether they
went missing before, during or after the event. In either case,
it raises the question of the incident being a deliberate criminal
act.
Regular security sweeps can help us to assess
what is actually there against what should be there. Such activities
can be carried out within the group without any formal input or
action from the regular audit or security function. Informal local
inventory checks should be regarded as an aspect of prudent management.
They can also act as a timely reminder of the need for caution and
preparation to improve resilience as a natural part of the business
continuity regime.
Improved fire drills
Regular fire drills are an established activity in every business
that carries a fire certificate. However they are an exercise that
often bears little fruit. Yes, we do establish that everybody can
hear the alarm and get safely out of the building, but surely there
is an opportunity for us to learn a lot more without significantly
increasing the cost and inconvenience. I would also suggest that
we adopt a forward thinking approach to the evacuation procedure
itself.
On the way out:
It makes sense to advise all of your staff to ensure that they pick
up their personal possessions such as keys, jackets and handbags
providing they are at or near their desks. The benefits are that
people are less inclined to rush or panic and they will be better
prepared for what comes next. That could be 'return to work', 'stand
around' or 'go home'. Standing around without a jacket can be unpleasant.
Going home without any keys or money can be difficult.
Whilst they are out:
Ask managers to deliver a message or instruction to their staff
once they are gathered at the assembly point. This is precisely
the sort of thing that might be called for in a real emergency situation.
Perhaps the message could be to get everybody from each group or
department to do something in particular before they return to work.
Ideally, all managers would be able to direct every one of their
staff to carry out a simple task. However, I suspect that many would
fail.
Once they are back:
When the staff return to their normal place of work it would be
very instructive for them to make a fire exposure list. This is
a list of all of those items and information that would (or might)
have been lost in the event of a real fire. When you combine all
of the lists from a section or department you can get a good idea
of how vulnerable you might be to the loss of work in progress.
It might highlight the need for better protection or more precautions.
In conclusion
Business continuity management, which is a discipline that is senior
to the business continuity planning process, need not require a
major investment. But it can be very effective in recovering a business
or, more importantly, in eliminating the need for recovery. Anything
that is relatively inexpensive yet effective has to be seen as a
sound investment. Moreover, if one doesn't apply a little common
sense it becomes rather difficult to justify one's actions after
the event. Whenever somebody's head is about to roll, it is more
comfortable to be a spectator than the spectacle.
Jim Burtles is at business continuity consultant
and trainer with Automata Services. Contact him at j.burtles@ntlworld.com
•Date:
18th June 2004 •Region: UK/Worldwide •Type:
Article •Topic: BC
general
Rate this article or
make a comment - click
here |
