When you’re building a BCM / DR program, there are allot of decisions to be made along the way. Some come from results of a BIA or other information gathering session and some have to be made through feedback received from the sponsor based on a potential roadblock encountered. Regardless, decisions get made and when they do, you – as the BCM / DR practitioner – should document these decisions.
When documenting decisions, ensure you keep a consolidated tracking log that outlines;
- What the decision is,
- Who made the decision (and what meeting it was made in, if not captured in an email),
- Date of the decision,
- Why the decision was required (what sparked the need for a decision in the first place), and finally,
- Give each decision a unique identifier (e.g. D-001, D-002 etc.).
If a decision was made during a meeting, ensure that there is reference to either the decision needed in the meeting minutes – at the very least, ensure the topic is listed on the agenda. That way in case you’re audited, everything will be in alignment.
There nothing worse than continuing down the BCM / DR path building plans and processes based on a findings and decisions, only to have someone question it later on and you not having anything to base your building activities on. You need to ensure that in the event someone doesn’t agree with a finding, policy, plan or procedure, you have something to show why the activities you’re performing are being executed in a specific manner. Often, people will forget the decision they made and why they made it, so with a documented tracking log you’re covering yourself – and them – should something go wrong.
There’s nothing wrong with making a decision that doesn’t give the desired outcome but its worse if it appears you’ve gone rogue and done your own thing without receiving support from above – because that’s how it will look. Documenting decisions by your sponsors – or even executives – help show buy-in from senior positions, as they are helping you along your building path.
So what kind of decisions are we talking about? It could be why a particular testing strategy is leveraged above another or why a specific IT technology recovery strategy is desired over another (e.g. why you are outsourcing recovery rather than performing it in-house), or even why a particular process will be leveraged in the crisis communication plan, rather than something you have proposed. All these types of decisions should be documented and captured for future reference.
If decisions are proven to be incorrect at some point, then you can change your strategy and tactical activities to help support a new action. And if that’s the case, make sure what caused the decision to become incorrect, as it may have been due to a working assumption (which you should also be documenting). If you don’t document decisions at the outset, it’ll look like you are not organized and don’t know what you’re doing.
© StoneRoad 2015
A.Alex Fullick has over 19 years’ experience working in Business Continuity and is the author of numerous books, including “Heads in the Sand”, “BIA: Building the Foundation for a Strong Business Continuity Program” and “Testing Disaster Recovery and Business Continuity Plans”.