Here’s Part II…
8 – Proper Representation – This doesn’t mean to make sure you represent them (though you are in some ways), it’s to make sure that every department and division has a representative that you can approach. It’s important that every area that is in scope for you has a single point of contact that you can discuss processes and plan development with. This ensures that what is being discussed and developed for each area, is in fact a true representation of what they require. If there is no representation, how can you know their requirements and needs? You can’t. Sure, you may know some if it but you won’t know the nuances of their processes and their dependencies. By the way, this includes not just a subject matter expert (SME) but a management representative as well (hopefully a director or VP; someone that is close to the Senior Executive team). This ensures that if key decisions are required in a division/department, then you’ve got the right people involved to help you get the answers you need.
9 – Leverage Existing Materials – Since the wheel has been invented, there’s no point in trying to re-invent it; the wheel is the wheel. The same is true for documented plans and procedures. If you already have something that states how to store / build/ configure the Mainframe, why get an IT person to write a document for Technology Recovery Plans (TRP)? Leverage the items you already have. You can reference them in other materials and always keep a copy with your disaster plans but don’t start from scratch. True, you might have to add a couple of bits that reference TRP or amend a few pieces so hat they reference what to do in recovery/restoration situations but at least that’s easier than starting from the beginning. If you have existing documentation and procedures that are required in a disaster, leverage them; it’ll make things much easier for you. A good example is one I’ve encountered in the last couple of years. With the avian flu taking the headlines a couple of times, HR personnel wanted to develop contingency plans for departments in case people weren’t available. However, we’d already done that in the BCM program and it took some time to get the HR people to understand that the avian flu was another trigger for the existing plans we had in place; they had to concentrate on HR policies (time off, payroll etc). Why we’d start over from the start was beyond me; we just leveraged what we had and enhanced them to add specific details related to the flu pandemic.
10 – Document Issues & Risks – Like any good project, you must capture the risks and issues associated with your initiative. At first you identify your risks, just like you do in a Risk Analysis (RA). Then, if the risk occurs, you raise an issue. Ideally, you should identify all your risks prior to having issues. If you did, then you’re better prepared for the issues when they happen and you’re not ‘blind sided’ by them. Rarely should issues appear out of nowhere. With each risk and issue, capture who owns it and the estimated date of resolution/mitigation with period checkpoint (aka reviews) so that they can either be closed or the right mitigation strategies be put in place. Also identify what the risk/issue is impacting or could impact, so that you can watch for signs that the risk might be realized. If the same items keep cropping up, you know you’re previous resolutions didn’t work or that there is a bigger problem than you know.
11 – Plan a Logical Approach – Trying to jump right into the final deliverable isn’t do-able. You can’t develop a proper restoration and recovery process if you don’t have all the right details to support it nor understand why you have to develop a specific strategy. You’ve got to start with the foundations; you can’t build a house without a foundation so you can’t build an effective contingency strategy. That means, starting with a Risk Analysis (RA) and a Business Impact Analysis (BA), or some hybrid of the two that helps identify your processes and ultimate Recovery Time Objectives (RTO). (Note: Obviously a BIA and RA provide more than that but you get the idea.) Using the house analogy again; too many people focus on the colour of the walls but they don’t have any idea where the walls are going yet and don’t know how many bedrooms the house is supposed to be. So make sure your approach is logical and you follow a step by step plant to get to your deliverable; an effective restoration and recovery strategy that meets the need of the organization. Remember, Peter Drucker once said, “Efficiency is doing things right, effectiveness is doing the right things.”
12 – Communicate Often – It may seem obvious but communication isn’t always something that is done right. You’ve got to communicate often and use multiple channels and to multiple groups. One memo doesn’t cover it; not everyone requires the same level of information and not everyone translates your words the same way. Each group of individuals must understand what the status is and what is happening in the project. If you’re communications are sparse and ‘wishy-washy’ then you’ll create problems for yourself because it only invites people to ask more questions. Not only that but they’ll approach other for information, which might not know the details you know. They’ll do this because they see you aren’t communicating often enough with the right information and thus, they’ll seek it elsewhere. So communicate often and ensure that the content is effective, succinct and detailed enough that everyone gets the same message but not too detailed that people begin to ignore your communications.
13 – Seek Expertise – Despite our best efforts, no one know everything. No one can know the entire organization and that means, no one can know what is required for the DR/BCM/ERM project/program. You might have areas of expertise and have some knowledge on subjects but there may be gaps. There may be struggles with how to even structure your program creation and if that’s the case, seek out assistance from 3rd party vendors and/or consultants. Ensure though that they are providing the service you need, not the service they want to sell you. Still, outside experts can help move things along better than if the project was managed internally. If you need the help and are missing a key skill set to get your restoration and recovery strategies in place, then by all means, bring someone in to help you with that or you may not end up with what you expect and it may not get done when you need it done.
Thus end Part II.
Part III – and the final part – will be next week.
“Heads in the Sand: What Stops Corporations From Seeing Business Continuity as a Social Responsibility” and
“Made Again Volume 1 – Practical Advice for Business Continuity Programs”
by StoneRoad founder, A.Alex Fullick, MBCI, CBCP, CBRA, ITILv3