Get The Business Continuity Operating System Book by Brian Zawada
Treating The Causes Of Bad Business Continuity Plans
Faults & Fixes: Bad Plans
Developing strong business continuity plans characterized as actionable, relevant, and simple to execute can be a very difficult task for many organizations. In other articles, Castellan examined the different types of business continuity plans, what information should be included, and how organizations can focus on the basics to develop effective plans. One trend that our consultants see across industries is that as business continuity programs mature, planning approaches inevitably change, often (and unfortunately) becoming more complicated and burdensome over time. As plans become overburdened with complex requirements, simplicity, quality, and effectiveness suffer.
This perspective examines the six typical symptoms of “bad plans” and their common root causes, and provides suggestions on how organizations can develop plans described as actionable, relevant, and simple.
SYMPTOM: PLANS LACK FOCUS
Root Cause: Recovery requirements are either not defined or inadequately defined
One of the most common questions we hear when discussing the plan documentation process with business plan owners is “What am I supposed to do?” The answer to this question and the focus of any plan should be very simple; the plan is used to guide response to and recovery from the time of the disruptive incident through return to normal. In order to do so, plans must document the answers to a few simple questions, notably:
- Who is involved with the recovery effort;
- How do we recover;
- When do we recover (and to what performance level); and
- How do we operate in “recovery mode”?
The results from the business impact analysis (BIA) should establish business continuity requirements, enabling the plan documentation effort. The BIA should define what activities need to be resumed, how soon these activities need to be resumed, to what performance level, and what resources are needed. If a plan doesn’t address BIA results in a concise manner, the plan will lack focus and will likely be ineffective.
SYMPTOM: PLAN ACTIVITIES AND TASKS ARE TOO GENERIC AND ARE OFTEN IRRELEVANT TO PLAN OWNERS
Root Cause: Plan owners are unclear on available strategies or do not incorporate existing strategies effectively
Strategy development must occur before documenting business continuity plans. Too often, practitioners forget that a key function of a plan is to document the steps necessary to recover and describe how to operate in “recovery mode.” In order to ensure that plans are relevant and make sense, plan owners and practitioners must work together to identify strategies in the event of a facility loss, personnel absenteeism, IT downtime, or supplier loss. Once plan owners are aware of approved response and recovery strategies specific to their business activities, plan documentation typically becomes significantly simpler. Imagine trying to document the steps necessary to relocate operations to a new facility without knowing where that location is, how many employees can go there, and what resources are available.
SYMPTOM: PLAN CONTENT VARIES GREATLY BETWEEN DEPARTMENTS OR BUSINESS UNITS OR HAS NOTICEABLE DEFICIENCIES
Root Cause: Expectations are not being adequately set for the plan owners and/or there is no quality assurance (QA) process to validate completed plans
Plan content will vary from department to department and from plan owner to plan owner based on each department’s individual needs. With that said, deviations in plan content are not the same as deficiencies. In some cases, a department’s plan may be overly generic, consisting of simple activities that do not deviate from template materials provided from business continuity planners. As a result, plan owners appear to “miss the mark,” leaving out information that may be essential to have during a disruption. In other cases, departments may include extremely detailed explanations of how to accomplish non-essential tasks or elect to include emergency management procedures that may already be present in other documentation, such as facility evacuation plans. These plans also appear to “miss the mark” because the useful, relevant information is masked by too much detail. The challenge for business continuity practitioners is to determine what types of content are necessary and relevant and communicate expectations to plan owners when it is time to create or update plans. It is also not enough to simply receive a plan back from a business owner and check the box that the activity is complete for the year. Business continuity practitioners need to incorporate a quality assurance process, potentially using a rubric or guide, to ensure that plans are meeting necessary specifications. In many large organizations or organizations without a dedicated business continuity professional or team, it may not be feasible to review every plan, but organizations should at least consider evaluating a defined percentage of plans on a rotational basis that will cover the breadth of planning activities over the course of time.
SYMPTOM: PLAN LAYOUTS BECOME BURDENED WITH UNNECESSARY MATERIALS OR ARE NOT READABLE / ACTIONABLE
Root Cause: Plan development is being driven by poor or inadequate templates or inflexible software
Templates and software tools are essential for any business continuity program as they provide structure and repeatability, but these tools must be implemented so they are relevant to the organization, add value, and allow sufficient flexibility. Templates and software tools represent starting points where information can be entered and modified. Once the plans are customized in either a template or tool, the end product should be readable and actionable. Over time, planning requirements may increase; however, if the result of a populated and customized template is a jumbled mess (and this trend is repeated across a few different business areas), then consider modifying the template. Software can be especially tricky due to the initial implementation cost and the development costs associated with modification; however, I can’t stress enough how important it is to not let a software tool drive the program. Software is a tool to be capitalized on by business continuity professionals to add value through efficiency improvements, but it should not dictate the parameters of the program or what needs to be included (or not included) in a plan. For more guidance on implementing business continuity software, check out Stacy Gardner’s recent blog post: How, When, and If to Implement Business Continuity Software.
SYMPTOM: PLAN CONTENT IS NOT DEVELOPED FOR THE RIGHT AUDIENCE
Root Cause: The wrong person is tasked with documenting the response or recovery plan and business continuity activities are being delegated too far down to a person not qualified to do the job
All managers delegate, and when done right and appropriately, delegation is often a good thing, especially when managers are able to leverage subject-matter experts (SME) to assist in the planning process. However, business continuity practitioners always need to work with managers to ensure that plans are written at an appropriate level and provide actionable steps for the recovery team which usually consists of managers and SMEs. If the new summer intern isn’t familiar with business operations, he/she is probably not the best person to develop the department’s business continuity plan; populating administrative data is one thing, but an inexperienced, unqualified person should not be responsible for the final deliverable for a department. Business continuity professionals can work with business owners to ensure appropriate buy-in and further set expectations for plan owners during the strategy and plan development process to ensure proper ownership and review prior to approval.
SYMPTOM: PLAN CONTENT IS POORLY DEVELOPED OR DEMONSTRATES A LACK OF UNDERSTANDING FOR THE BUSINESS CONTINUITY PROCESS
Root Cause: Training on plan development is either non-existent or insufficient; adequate support structures for the plan owners may be lacking
In order for plan owners to be able to create business continuity plans based on approved business continuity requirements and strategies, they must be familiar with the program and with basic business continuity concepts. As practitioners, we often take concepts like recovery time objectives, alternate work areas, and cross-training for granted. But, for plan owners, developing business continuity plans is often a distant second to everyday operational activities, especially since most are not experts in continuity planning. However, plan owners are often experts in their respective areas, so business continuity practitioners have to develop sufficient training programs that bridge the gap between business continuity and operational activities to ensure relevancy to plan owners. So often training falls in the maintenance cycle after the BIA, strategy development, and planning, but ideally training is an ongoing activity to assist program stakeholders at all times during the planning lifecycle. Poor plan content usually reflects one of two things – insufficient buy-in (managers not allocating sufficient time to planning activities) or a lack of understanding of their roles and responsibilities under the business continuity program. Remember that training is more than just a 30-minute PowerPoint presentation where one shows pictures of disasters and gives stakeholders definitions of the BIA and risk assessment. It is a collaborative process and can take many different forms, including coaching sessions and desk-side briefings with plan owners.
Business continuity planning and the development of business continuity plans may seem like a daunting task, especially in larger organizations. As the scope of a continuity program grows, practitioners may become frustrated as complexity increases but quality does not seem to improve. In these cases, it is always important to reflect on the program to determine what can be done to improve program effectiveness. There is no panacea for solving issues with business continuity planning initiatives, but there are considerations and steps that can be taken to assist in and improve the process.
Continue to visit castellanstg.wpengine.com or our blog for more posts in Castellan’s Business Continuity Faults & Fixes Series.
Business continuity and IT disaster recovery planning is all that we do. If you’re looking for help with building or improving your business continuity program, we can help.
Get resilience insights delivered to your inbox.