In a previous article, I described the top seven mistakes that organisations make when they develop a Business Continuity Plan (BCP). Here are seven ways to make sure you do it properly and that your disaster plan actually works when you need it.
The right approach includes the following elements:
- Top management are involved in collaborative Risk Management workshops to determine their shared views on Risk appetite and Risk evaluation criteria, from which follows the commitment to BCP from the top.
- A ‘superhero’ team is established, consisting of 4-5 BC Facilitators from across the business to assist in creating the plan, engaging other staff, and planning and running training and rehearsals.
- Middle management and general staff are engaged in one or more efficient, highly interactive workshops (tackling Risk, Business Impact Analysis (BIA) and BCP strategies), so they start developing buy-in for the process and contribute to optimal, easy-to-maintain documentation, practical work-arounds and realistic continuity procedures.
- BCP documentation is simple to maintain (e.g. by using colour coding and bullet-style checklists) and based on a top-down holistic approach (e.g. by working with a small number of ‘core consequence scenarios’). It resides on an interactive, common platform such as the organisation’s Sharepoint/network/Intranet site (i.e. one that the broader workforce already uses in their daily life) and has a remotely accessible copy in case live systems are down.
- Staff awareness campaigns focus on training everyone, which also means informing those who don’t have a BCP role that they should not claim recovery provisions such as laptops, work space and connectivity (and even vacate their existing place of work to accommodate others who have a more time-critical role).
- Disaster rehearsals/simulations are fun and strongly encourage participants to make mistakes and identify BCP gaps instead of covering them up, only for these gaps to show up during a real incident. Exercises include audio-visual tools and a range of practical assignments (including realistic testing of decision-making processes and notification systems) in order to ensure management and staff develop a true readiness for incidents.
- Key staff (e.g. BC Facilitators) are recognised for their contribution (e.g. during performance appraisal time) and are provided with highly interactive training (including practical exercises and the opportunity to learn from other organisations) and ideally the option to certify their skills in related standards such as ISO22301 and ISO31000.
The goal is for everyone to be able to sleep soundly at night knowing that, not only are good plans in place, but also that they are up to date, and that the right people know what to do should an adverse event occur.
If you want your BCP to work when you need it most, contact us at www.businessasusual.net.au.
And if you’re keen on training, you can also have a look at our upcoming courses in Business Continuity, Risk, Information Security and Supply Chain Security Management (incl ISO22301, ISO31000, ISO27001& ISO28000 certification exams).Browse our upcoming Training & Events
Signup for our Newsletter