Prepare for the Unexpected - There's Value in a Business Continuity Plan

STEVEN TAYLOR
Globe and Mail Update
June 4, 2007

Like it or not, in today's global economy companies need to anticipate and prepare for a wide range of emergencies, including natural disasters (such as an ice storm or tornado), regular business risks (such as chemical spills), employee dissatisfaction, and social unrest. Having contingency plans in place helps companies meet the expectations of the global marketplace by being resilient to local disturbances. Customers overseas may not be aware of the fact that your headquarters has been hit by a local disaster, and they shouldn't need to. All they need to know is that the product or service they need will still be available to them.

So how can companies develop contingency plans? Since the recent string of unexpected events like the New York City terrorist attacks or, closer to home, the SARS scare, Canadian businesses have been more focused on business continuity. Every business, large or small needs a business continuity plan in place. But having a business plan in place doesn't necessarily mean a company will survive. The plan needs to be well-structured, communicated, and tested to be effective.

Learning about the potential dangers that threaten a business might not be easy, but statistics from the University of British Colombia show that 80 per cent of organizations without a well-structured recovery plan shut down within 12 months of a fire or flood. Further to this, 43 per cent of companies experiencing disasters never recover.

Successful business continuity planning can save a business from bankruptcy and closure. But, good planning doesn't just happen. It involves several stages and thoroughly executing each step is crucial to success:

1. Conduct a business impact analysis: The most important step is to identify the value of business assets. Ask what the business impact would be if an asset was to be unoperational? Don't forget to take into account all areas where a loss could be critical. For example, in a manufacturing plant assets involve not only the personnel, IT network and production machines, but also the raw materials and goods being produced. If any are compromised, the plant cannot function. Once a business impact analysis has been conducted, next consider the likelihood of a disruptive event occurring. Typically called a risk assessment, this process will assist organizations in deciding where to place resources in the event of a disaster.
2. Justify the plan: Once a business decides what assets it needs to survive, a monetary amount needs to be assigned to protect each one. A direct correlation exists between the value of assets and the finances needed to protect them — the more something is worth to a business, the more effort and money is needed to protect it.
3. Strategize and write the plan: To outline the big picture, compose a strategy. This will specify the order of recovering infrastructures, the potential to leverage third parties such as service providers etc. Once the strategy is in place, the plan will follow, outlining the activities, tasks, and owners. When writing the plan, be sure to include all key stakeholders. They will have a good idea of how to best protect the different areas of the business. Involving personnel, internal systems, and IT will allow the company to cover off threats to all assets of the business. Depending on the industry, different regulations will need to be accounted for.
4. Test the plan: Having a plan is worthless unless it is proven to work. Testing a plan at least once per year ensures that the plan remains current and reliable. Testing the plan also allows time each year for review, lets the organization incorporate any new information, and ensures that the plan remains effective. The investment put into planning warrants that it work when an emergency takes place.

Depending on available resources, a company may decide to outsource the business continuity planning. Many businesses do not have the resources to implement a business continuity plan, and do not have expertise to prepare a good plan, especially when it comes to the technical parts. Allowing a third party to implement the plan can free up resources, letting employees focus on the core business while experienced business continuity assessment professionals focus on risks and the best ways to protect against them. The most important reason to outsource the planning process is that it will allow "fresh eyes" to look over the organization and the plan to ensure nothing is missed.

A large portion of the plan involves the establishment of an IT architecture that can support the safety needs of the business and withstand or quickly rebound from disasters. Guaranteeing network security is extremely difficult, which is why many organizations choose to outsource this task to professionals.

When selecting a vendor, ensure that the organization has available resources to provide infrastructure over and above, or in addition to, whatever the business would purchase and design into its own solution. Look for service providers that can reroute traffic during emergencies. Also considering that all businesses are now global, ensure that the organization has available resources wherever the business operates.

While a business continuity plan is something a business should not wait to implement, writing a good plan is key to business survival. Researching the correct resources, providers, and planners will ensure the plan is thorough and accurate. Testing and updating at regular intervals will help maintain the plan's integrity and will justify the initial investment. Making a reasonable investment in planning will give an organization a good plan, and in the end save the bottom line.

Steven Taylor is Sales Vice President, AT&T Global Services Canada

The above newsclip is distributed to educate and inform. This does not imply accuracy nor endorsement of the views by AT&T.