|
Emergency Preparedness FMJ Article
The key to survival: Planning ahead for business
recovery
John Newton
Facility managers are uniquely placed to understand the
consequences of unplanned interruptions and to take appropriate
corrective actions. In many ways, you do this every day,
constantly challenged by minor glitches in the systems modern
businesses depend on. Photocopiers break down, furniture
or carpets are damaged, security systems malfunction or
communication cables get severed during renovations. In
these instances the hit is localized, manageable and unlikely
to threaten the viability of the organization. Facility
managers arrange for the mess to be cleaned up or fixed
and move on to the next project.
Such abnormalities are par of a normal day, because coping
with the unexpected is the facility manager’s job.
People depend on you to solve their problems and keep them
functional, productive and able to meet their deadlines.
Most corporations don’t sweat the small stuff—they
manage it effectively. Suppose your company experiences
a major unplanned interruption—a fire, severe storm
or bombing that prevents access to your building for hours,
days or months. Where would you go? What would you do? Would
the company be able to survive?
The unfortunate reality is that many businesses do not
survive even relatively small interruptions to their normal
operations. They are totally unprepared to continue delivering
services and meeting the needs of their customers.
Technology was the driving force
Businesses always have made efforts to protect their assets,
from raising platforms to keep goods dry, to installing
sophisticated climate control systems and fire suppression
equipment. Actions focused on anticipating a particular
threat and mitigating potential losses through design. Each
threat was addressed separately as a unique problem. Various
forms of insurance also were employed to share risks. However
in the post-war years, there have been significant changes
in risk-management practices, more by technological innovation
than by economic concerns.
When computers were introduced to the business world in
the 1950s, a similar attitude prevailed. For those using
this new technology, the value of stored data led to the
common practice of electronic backup in the 1960s. Duplicate
tapes were made of key data, stored and revised regularly.
Managers slept better knowing company records could not
be lost through accident or error. For almost 20 years,
data backup was considered sufficient to ensure a business’s
long-term viability. The assumptions were reasonably accurate
during a period dominated by personal contact, consistent
growth and a regional focus.
Then the global marketplace emerged, with “Just-in-time”
attitude and an electronic communication bonanza. This revolution
created a highly interconnected business world where time
is critical, competition is fierce and substitute products
and services are readily available. Companies can no longer
afford to be non-operable for even a few days or hours without
losing market share and shareholder confidence. The implications
of these trends for companies have been immense and demand
new approaches to coping with major unplanned interruptions.
Date is enough
In a fast-paced business environment, data is necessary,
but does not necessarily ensure survival. Highly reliable,
protected information critical to a company’s operation
must be available seven days a week, 24 hours a day. But
date is not enough. Without skilled and knowledgeable people
to access, manipulate, update and utilize stored information,
corporations will grind to a halt. What can a facility manager
do?
The answer developed in the mid 1980s and is now in full
swing throughout North America, England and other countries
around the world. In a scant 15 years, the attitude of visionary
corporate leaders has shifted from data protection to total
business protection. Today, key financial services, some
government operations and a portion of the Fortune 1000
are prepared to continue operations—no matter what
happens!
Will you be back in business?
These businesses implemented a business continuity plan
to ensure their survival, give direction at a time of crisis
and restore normal operations in the shortest possible time.
When a bomb exploded in the underground garage of New
York’s World Trade Center, thousands of people were
forced onto the street. Many businesses never reopened.
The crime scene was cordoned off for an extended investigation
and safety checks. Most of the businesses in the building
had no continuity plans and more than 60 percent were not
in business two years later. By comparison, when First Interstate
Bank experienced a fire that gutted five floors in its 62-story
building—including their main trading floor—they
were back in business the next day and even made money!
The difference is First Interstate had a well-developed
business continuity plan.
Successful business continuity planning must include several
components: vulnerability assessment, emergency preparedness,
human and facility recovery plans, communication strategies,
loss reduction programs and business resumption procedures.
The total package is commonly defined as “planning
to ensure the continued availability of essential services,
programs and operations, including the resources required
to perform critical business functions.” These resources
include skilled people, their workplace, stored data, operation
manuals, computer equipment and communication systems.
To guarantee continuity, a company must be able to recreate
critical business functions in the shortest possible time.
Business continuity planning will help the organization
stay alive through a crisis and return to full operating
capacity. The plan should be unique, tailored to the business
and responsive to customers’ needs.
A plan protects corporate investment, ensures a future
for your employees, and indirectly enhances the economic
health and ongoing quality of life in the community. In
today’s business climate, continuity of operation
is critical to survival.
Focus on consequences
Adopting business continuity practices has shifted the planning
focus from contingency to consequences. In planning for
response, recovery and rehabilitation, companies are less
concerned with the cause of the interruption and more interested
in the consequences for their operations. What services,
operations and systems are affected? Which of these are
critical to the core corporate mandate? How do we mitigate
our losses? These are the questions facility managers should
ask immediately after an interruption.
The answers will be found in your business continuity
plan, which describes what functions are critical, what
resources are needed and how the recreate operational units,
along with details that otherwise might be lost in the chaos.
Without a plan your organization is rudderless, left to
the whims of uncontrolled events and the wits of survivors.
Yes, some companies may survive a hit without a plan and
continue to prosper, but it is risky to depend on luck!
The global economy is much less forgiving than the regional
marketplace, with vast sums of money moving at the slightest
hint of trouble. For example, remember the Asian financial
crisis and the taming of the “Eastern Tigers”
near the end of 1996.
A business continuity plan is not a guarantee. It is a
process and a means to understand in detail how an organization
operates and how it can successfully cope with major unplanned
interruptions. Through development and implementation of
business continuity planning concepts, a new attitude to
risk management will become embedded in the organizational
culture.
Viability can be assured only when the business continuity
process has been integrated throughout the corporate entity.
Every manager and employee has a part to play—from
the maintenance of accurate contact numbers to the assurance
that alternate facilities continue to meet the needs of
rapidly changing organizations.
Understanding the consequences of interruptions to critical
business functions will be essential to determining the
most appropriate and cost-effective recovery strategies.
Moreover, once designed and implemented, these strategies
will require testing through simple and eventually more
detailed exercises. Your company can reduce its vulnerability
and improve its chances of surviving with a logical series
of plans and actions.
Companies advanced in business continuity planning apply
their generally accepted vulnerability criteria to a wide
range of business decisions—from relocations to mergers.
Decision makers must be confident that their decisions have
addressed continuity issues and appropriate safeguards.
Every day executives make well-researched management decisions
without assessing the potential consequences for the viability
of the company. Don’t let your organization be blind-sided!
The potential consequences of the Y2K date problem were
a disaster waiting for all businesses. Determining critical
functions, a key aspect of business continuity plans, has
become particularly important for applying limited resources
to address issues like Y2K. Knowing which business functions
or processes are most important to the survival of a business
will be crucial for organizations just beginning to their
compliance program.
Be prepared
With a plan you are prepared; without one you are vulnerable.
In today’s rapidly changing world, each business decision
is considered carefully so you and your company’s
shareholders can feel confident about the future. With a
business continuity plan, everyone sleeps better knowing
actions have been planned for the safety of your business
data and protection of the complete business operation.
When disaster occurs, insurance can cover your physical
assets and some business losses, but it cannot replace customer
loyalty or guarantee the continued flow of new business
and critical investments. Detailed action plans prepared
by management and staff enable you to reassure existing
clients and accept new business with confidence.
These plans document who does what in a crisis, cutting
through the chaos to direct key people and resources to
the continuity of critical functions. Plans should address
key elements such as resource requirements, voice and data
needs, space and equipment, transportation and communications.
Your continuity plan will be unique to your organization.
There is no “standard” fill-in-the-blanks continuity
plan. Look closely at how your organization functions and
work from that vision. Ask questions about the consequences
of interruptions and begin to develop a continuity mind-set.
These are practical steps you can take today rather than
waiting for a disaster to uncover your organization’s
weaknesses.
If you’ve developed a plan already, don’t
stop there. Ask your third-party suppliers if they have
a plan because you depend on their services. Will they be
there in a crisis when you need them most? Consider making
continuity plans a requirement for all outsourced contracts.
Key people can’t function without a workplace, access
to critical data and all the systems, services and basic
supplies often taken for granted. In business continuity
planning, the facility manager plays a significant role
in ensuring people have the necessary tools to continue
working after a crisis. Moreover, the facility manager will
lead the salvage and recovery activities, as well as the
“return home,” which can be as psychologically
taxing as the initial disaster. For this reason, make sure
you are part of the business planning team.
Remember: these plans are for total business protection;
they must focus on the consequences of a disaster and involve
everyone, and therefore, will become embedded in tomorrow’s
business culture.
SIDE BAR
Ten Key Activities
The Business Continuity Institute (BCI) and the Disaster
Recovery Institute (DRI) have recently concluded discussions
that led to the identification of the 10 key activities
professional practitioners should perform to design and
implement comprehensive continuity plans. To be thorough
and complete, a plan for your organization will require
all of these activities, which are presented in logical
sequence, though some can be undertaken concurrently.
1. Project Initiation and Management
2. Risk Evaluation and Control
3. Business Impact Analysis
4. Developing Continuity Strategies
5. Emergency Response and Operations
6. Developing and Implementing Business Continuity Plans
7. Awareness and Training Programs
8. Maintaining and Exercising Business Continuity Plans
9. Public Relations and Crisis Communications
10. Coordination with Public Authorities
Of course, your organization changes—as it will constantly—plans
and procedures must be reassessed and revised to reflect
new operating structures, adjustments of internal and external
dependencies like new technologies and outsourced services.
Your plan will never be perfect, but it will be better than
no plan at all, and may make the difference between bankruptcy
and survival.
FMJ
About the author: John Newton is the principal
of John Newton Associates, a business continuity consulting
and research firm based in Toronto, Ontario, Canada. He
is a registered professional engineer and holds a doctorate
in environmental geography with specialization in coping
with hazards. He also has a master’s degree in urban
and regional planning and a bachelor’s degree in civil
engineering. Newton also is an associate member of the Business
Continuity Institute, a member of the Canadian Centre for
Emergency Preparedness, and director of the Disaster Recovery
Information Exchange in Toronto. Reach him at +1-416-929-3621
or jnewton@interlog.com.
|
