Preparing for the Unexpected: Testing our BCP/DR Plans (Part 3)

In the final part of our 3 part series on testing our BCP/DR plans, we’ll be looking at test findings and the Executive Summary – how to present them and what they should contain.

Don’t forget, “Preparing for the Unexpected” airs every Thursday at 9am EST.

Happy listening!!

The StoneRoad Team

Advertisements

BCM & DR Program: Using and Dismantling Assumptions

In all planning, whether it is for projects or programs and regardless of the industry and nature of business, one of the key areas that often gets overlooked is the use and belief in assumptions.  Not just overlooked but they tend to become part of the fibre of every project and every BCM/DR program.  We assume ‘so-and-so’ knows this ‘action’ and will do that ‘activity,’ when in fact, so-and-so has no idea what they’re responsible for or even that others believe they’re responsible for it.

We don’t communicate assumptions often and if we do, it’s once or twice in the initial stages of a BCM/DR project or we make them up within the confines of our own segregated meetings, which aren’t attended by those that the assumptions are based on.  We capture the minutes of the meetings and action items but never reach out to those we assigned an assumption to; they’re forgotten and actually become part of the BCM/DR framework – the plans and procedures we expect others to implement at the time of disaster.

Assumptions are used to fill a void – an unknown.   When we don’t know an answer we plug in what we hope will be proven to be the answer but fail to follow up on it.  When it doesn’t occur the way we want, it’s because we put faith in an assumption, as though it was always correct rather than trying to disprove or valid it.  By failing to disprove it, we are in the false believe that we’re taking a step forward because we embraced and accepting the assumption and in this way, provide ourselves with a level of comfort and a reason to point the finger of blame when something goes wrong.

Assumptions aren’t just found during planning and development but during the implementation stages – or phases – of various program components.  Even when an actual disaster occurs assumptions abound, as Crisis Management Teams (CMT) and individuals assume that others are performing the activities required.  Even the assumption that people – and everything else – is and will be available when needed.  If everything was available when and where it was desired and expected, then we wouldn’t have such diverse plans and processes in place to deal with such disaster situations.

Assumptions aren’t always a bad thing.  At the beginning of the BCM/DR program development, assumptions help move things forward.  You plan up to a specific milestone based on a set of assumptions and then validate them through exercises and tests and conversations, as minute details slowly emerge the more and more planning develops.  The results of which (exercises, conversations etc) help fill in the gaps identified that were – originally – assumptions.  This way the assumption becomes a positive because it helps move the program forward by challenging those involved and initiating conversations between groups; communicating the expectations various groups and individuals have about plans, processes and procedures.  Not revisiting them and validating them will only cause problems.

As the organization, changes – plans, processes, resources, locations, lines of business etc – so to must the assumptions.  An assumption developed at the outset of the program development can’t be considered valid years later when all the players and everything else associated with it, has changed.  That ‘s simply ludicrous and naive.  They must be revisited over and over because they may be true under some circumstances but invalid under other circumstances.  Since no one ever knows, when or where a disaster occurs or under what circumstances, assumptions must be challenged, communicated and validated on a regular basis…and quite possibly, new ones developed over time.

 

© Stone Road inc, May 2012

**NOW AVAILABLE**

 “Heads in the Sand: What Stops Corporations from Seeing Business Continuity as a Social Responsibility”

“Made Again Volume 1 – Practical Advice for Business Continuity Programs”

“Made Again Volume 2 – Practical Advice for Business Continuity Programs”

by StoneRoad founder, A.Alex Fullick, MBCI, CBCP, CBRA, ITILv3

Available at www.stone-road.com, www.amazon.com & www.volumesdirect.com

What is a Disaster? (Part I)

Note: I came across this in an old folder, while looking for some reference material for the next BCM/DR book: “Essence”.   I wrote this 2 years ago (so it says in my notes) and decided to keep it the way it was written so the original spirit is still there, rather than editing it and making it into something else.  Even the “Now Available” section doesn’t even mention the 2nd book; Made Again.  I take full responsibility for any hiccups it may contain.  Enjoy…

****************************************************************************************************

Like many of you, I get asked this question quite often; ‘What is a disaster?’  I’ve been asked this by executives, employees, curious friends and families and from those are just curious as to what I do.  I started writing this as a little article but as I got going it got bigger and bigger – to the point that this might actually become a book at some point.

On the surface, we can say a disaster is something like a bomb, fire, flood, earthquake, a building collapsing and anything else that might harm people.  Honestly, that is the way the general public see a disaster; something that can be seen with the naked eye and has impact on people and facilities.  These disasters fall into two categories; the man-made disasters (terrorist actions) and the natural disaster (a peeved Mother Nature).

Yet a man-made disaster can be intentional and unintentional.  Terrorism and the actions of 9/11 was very much a disaster but it was man-made; conceived by (mad) men and executed by men and had an incredible impact on not just the World Trade Centre but the city ofNew   York, surrounding areas and the world in general – which is still being felt today.

An unintentional man-made disaster can be that of someone who starts a fire while working with a blow torch and an explosion ensues.  It might just be carelessness or negligence but it’s not an intentional act.  Or it could be someone who left a candle to burn all night and it catches the drapes/curtains or the bed spread and ‘poof!’ up goes the house. Again, it can be a disaster but it’s not an intentional disaster.  What would we call the Great Fire of Chicago (1871), when Mrs. O’Leary’s cow kicked over a lantern?  It wasn’t man-made, it wasn’t intentional and it wasn’t started by any natural phenomena, like a lightening strike.  Maybe we need a new category for things like that.  (For the record, it was never established that the cow started the fire, as a reporter some 20+ years later admitted to starting the ‘rumour’ and the story took off just like the fire did.)

I typed in “Define Disaster” into a search engine and these are some of the things that popped up (minus the punk rock band reference I found);

  1. a      failure
  2. an      unplanned, calamitous event with widespread impact
  3. something that causes great distress or destruction
  4. a state of extreme ruin and misfortune
  5. unrealized expectations (like      a big budget movie that flopped)
  6. time limiting, though the impacts may go on indefinitely
  7. something that warrants an extraordinary response from      outside the affected community area

 

Disasters come in many sizes, styles and circumstances.  Not all are those related to our classic BCM defined definition(s);

  1. Personal Disasters – What might happen to a single      person doesn’t affect the organization.       This is not to say that a disaster to a single person isn’t important      just that it rarely affects the operations of a corporation. It can      however, have impact on decision making if the disaster (whatever the      situation) impacts a key member of a team.       It may delay decisions and delivery times if that person cannot      provide the appropriate response when needed.
  2. When People We Know Are Impacted – Using the example above, we      see can see a disaster when something occurs to others.  We may wonder how we’d respond under the      same circumstances and may wonder why the situation seems overblown.  We may also feel it is a disaster      because the situation has hurt or impacted someone we know personally.       When that happens we are closer to the situation and can be      inadvertently impacted by it – it becomes out disaster as well.  With respect to an organization, if a      member of the team has a terrible accident, it can impact all those that      work with him or her.  Personally, I      recall coming back to the office after Monday lunch to find that a      co-worker (who sat beside me) had passed away over the weekend.  It impacted out entire team because for      days it was hard to look at the ‘empty’ desk.
  3. When People Are Powerless to do      Anything –      We will also believe things are a disaster when we are powerless to stop      things.  For instance, right now there      are terrible floods inPakistan      and if you watch the news and view maps, it looks like half the country is      under water.  Not only is it a      disaster because of the flood, it’s a disaster because we – the general      public – can’t stop it.  We can help      those in need by providing supplies, food and financial support but that      doesn’t stop the mudslides, the rain or the water from flowing.  We are powerless to do anything about      the disaster itself but we do have the ability to provide a response to      it; all the while the water continues to flow.
  4. When Corporations Experience a      Disruption –      We watch the news; we know that a simple issue for a company can have      disastrous impacts on people and other corporations.  If you’re wireless provider has a hiccup      with their service – even a small one – it can mean you loose emails,      tests and calls to your personal device, which depending on what the      contents were, could mean the loss of business, miscommunications or a      wrong decision being implemented because no one received all the      details.  When we don’t get what      we’re used to –and don’t see any progress to fix the situation – we feel      that the situation is a disaster.       It’s not being managed properly and we aren’t being compensated for      the situation.  Years ago I recall a      situation where a Financial Institution (in Canada) had an issue with      their internal systems.  It was down      for a significant amount of time – over 24hrs if memory serves correctly –      and during this time people had checks bounce, mortgages default and other      issues.  Because of what a bank      does, people saw it as a disaster for the bank and questioned their      internal recovery processes.  Sure      it was a disaster for the bank but people experienced a disaster too      because of the problem; dealing with creditors, other banks, credit card      companies and anything else financial related.  This situation alone proved that the      company needed a stronger BCM program – and they have by the way.  Again, corporations can experience a      disaster and we don’ feel it is anything significant until we feel the ramification and      impacts of the situation.
  5. When Something That People are      ‘Attached’ to No Longer Exists – This can mean people losing their jobs, the death      of a loved one, the burning of an old historic building, an earthquake      that changes the landscape, volcanoes that destroy lush forests and so      forth.  When we are attached to      something, we – as humans – want it to last forever; at least while we are      alive and can experience it. But nothing is permanent.  Everything changes and change is one      thing people don’t like.  Depending      on our proximity to the situation, when something is gone it hits us hard      and we have to face reality – that nothing lasts forever.  When our home burns to the ground we      lose everything; it’s a disaster.       However, everything in that home can be replaced and a new home can      be rebuilt.  We were to attached to      the way things were that when it’s gone we experience a disaster.  Same thing with corporations.  When they are riding high on profits      selling, selling and selling  they      eventually will run out of steam because they may have oversold and under      produced; they simply can’t handle the continued growth.  They are attached to the money and      prestige that was coming their way but now when it begins to ebb away,      they feel the company is in a disaster even if it is of their own making.
  6. When Something Foreseen as      Manageable Becomes Out of Control – Sometimes some issues are manageable due to the      reoccurrence.  There are many      instances where email has a hiccup every so often and based on daily      operationally protocols can be fixed quickly and things just continue back      to normal.  However, if it’s the      same issue over and over again and it’s not investigated and resolved,      those little incidents pile up and now you have something that can’t be      fixed so easily.  Picture a single      pebble on a trail.  One pebble      doesn’t cause too much trouble and is easily fixed but if more pebbles      being to pile up without ever investigating what’s causing the pebbles to      get there n the first place, you can end up with the path being      blocked.  Now you have a bigger      issue to deal with; one that might not be resolved so quickly.  It now has greater impact upon      operations because things can’t continue.       All those quick fixes need to be reviewed to see what has to be      changed and how to find the root-cause of the situation; when that should      have been done earlier.  What was      thought to be manageable now escalates into something greater and slowly      gets out of control.  Now, you‘ve      got a disaster on your hands.
  7. When Expectations Aren’t Met – When corporations experience      crises, we expected that they know how to rectify the situation and set      things right (cough). They have plans in place to ensure that a product or      service continues to be delivered as soon as possible with the least      amount of impact to clients, customers and partners.  I think many individuals can understand      that, well, crap happens, and will continue to happen.  That, I think many of us can grasp.  What we won’t grasp and won’t tolerate      is the fact that a corporation doesn’t know what its doing and doesn’t      have a plan to make sure I – as a customer – and continuing to get my      product or service.  I might      tolerate a day or two of downtime and work around that but after a week      with no progress; I’m not going to be so forgiving. I see that that what      might had been an mild interruption escalated into an unmanageable      disaster and now I’m not too happy.
  8. The Proximity to the Situation – If we are closer to the      situation playing our before us, the situation becomes more a      disaster.  An earthquake on the      other side of the world is a disaster but we aren’t there so we don’t feel      the impact of it – we feel the impacts of the consequences of the      earthquake by watching news reports and seeing photographs.  Hopefully we feel strongly enough to      donate aid.  But, the disaster      doesn’t have as great an impact as if it occurs to us.  Suddenly, we expect response teams to      help, aid to arrive, lives and homes to be saved and time is of the      essence.  This same feeling and need      doesn’t occur when you watch it on the news – even if you ‘feel’ for those      impacted.  The closer the disaster      is to us the more likely we are to be impacted by it and know individuals      (and maybe family members) that are impacted by it.  Our proximity seems to drive a need to      response and need to help.  The      closer the situation the greater the disaster is perceived because it      impacts us – no them.
  9. Personal Involvement and Impact – We are more apt to identify      with a ‘disaster’ when we are impacted by it.  This doesn’t mean impacted emotionally
    by seeing news reports or the feeling of having the heart strings tugged,      this is being directly impacted physically, financially and emotionally;      meaning we are part of the disaster.       The more involved we are with the situation the greater is becomes      a disaster for us.  If we loose our      homes due to a flood – it’s a disaster.       If see out neighbours home burn down and they find themselves with      nothing, then it is a great disaster to us because we ‘feel’ for tem;      loved ones (assuming they are good neighbours) are impacted and as such,      we are – though admittedly, not to the extent of the family that lost      everything.  The point is, the      closer we are to the situation – financially, physically, emotionally –      the greater the feeling of something being a disaster.  Watching the news a seeing someone’s      home burning on the news may be a disaster for a short period but we      change the channel or get up and get dinner.  It’s not the same if we live beside the      impacted family or they are members of our own family.  Suddenly, the impact of the situation is      greater and the disaster is closer to home – our personal involvement is      greater.

There can be more added to this list but for the sake of time and space (on this page) I’m only listing these 10 things.  You can add more based on your own experiences and beliefs.  There can be many ways in which we define and classify disasters.  A disaster is going to mean something different to every person and to each organization.  What may affect and impact one, may not affect or impact another – at least not a severely.  It is different for everyone.

**NOW AVAILABLE**

The new book by StoneRoad founder, A.Alex Fullick, MBCI, CBCP, CBRA, ITILv3, “Heads in the Sand: What Stops Corporations From Seeing Business Continuity as a Social Responsibility.”  Available at www.stone-road.com **