When disaster strikes
The recent storms which ravaged Newcastle and surrounding areas were an outstanding representation of the Novocastrian spirit, and sense of community support and goodwill that epitomises our great city. Now that the water is receding, many residents are counting the cost, and considering what can be done differently next time the weather takes a turn for the worse.
And it is no different for business owners.
A critical component of how a business responds to a disaster is underpinned by how effective it has been in planning for disaster. Too often we see this planning limited to “I can retrieve a backup of my information”, and the common trap of associating business continuity risks with IT is fallen into…
Two weeks ago, the loss of electricity over an extended period of time, damaged phone lines, and physical and dangerous impediments to accessing the business, were unable to be alleviated by the restoration of a backup.
So what learnings can we take away from this event, and what questions can we ask of ourselves?
1. Is the tail wagging the dog? Quite often the business continuity plan (BCP) is driven by a single individual, or department, often IT. As disruption commonly impacts the entire business, all segments of the business should be involved in developing the BCP. It should never be left for one part of the business to assume what the rest of the business needs.
2. Revisit key business impacts: Does your BCP truly isolate and focus on the “mission critical” elements of your business? These elements should be mapped in a Business Impact Assessment. Quite often the accounting system is listed as one of the first to be restored – how will this help you communicate with your workforce, customers and suppliers?
3. Beware the macro focus: the BCP should give guidance on the “big events”, but not be isolated to these. The more frequent disruptions, including IT and telephone outages, and loss of power, are often less catered for, and over time, a significant expense.
4. Investment risk: the risk of not committing BCP resources to the most critical areas can result in time and money being poured into the restoration of equipment and services that you do not need.
5. External impacts: often the BCP is limited to disruption created within the business, without considering external impacts. For example, what if a major supplier has an extended power outage? How often do you enquire on the BCP capability of third parties who are critical to your operations?
6. Will it all work? The most effective way to ensure your BCP will deliver in the time of need is to test it through simulation. To find out the BCP processes implemented, and the people and technology surrounding it, does not respond when the time comes for it to be all “switched on”, is a disastrous and expensive outcome.
I am yet to meet a person who isn’t an expert in hindsight.
However, some small adjustments in some critical areas might have a big impact next time around.