This week is part two of Charlie's guide to what should be included in every business continuity plan.
The turmoil in Ukraine is continuing a pace.
At the time of writing, US President Barack Obama was urging Vladimir Putin to seek a diplomatic solution to the crisis and Crimean MPs had called a referendum on joining Russia.
The Sochi Paralympics opening ceremony was also due to get underway, complicating matters even further.
The situation continues to unfold faster than I can write. I have therefore provided, as promised in the last bulletin, my final five observations on good continuity planning:
- Items not needed on the day. Many plans I see are a cross between a plan containing information needed on the day of the incident and policy information. During an incident you do not need information on how often the plan needs to be exercised or the responsibilities of the Business Continuity Manager. My suggestion is to go back through your plan and move to a separate document any information which you do not need on the day of an incident.
- Telephone numbers. I think telephone numbers should not be contained within the plan. You may wonder how that can be so, as surely you need the numbers to communicate with your key interested parties. Having telephone numbers available are important but I think it should be a last resort to put them within the plans. As soon as you put numbers within a plan you create a monster, which needs to be constantly fed. Every time a number changes you have to change the number in the plan and then send out the amendment to all those who hold a copy of the plan. This creates a huge administrative task, if you give out copies of the plan in hard copy this kills loads of trees, as you will have to reprint a number of copies of the plan. If you just send out the relevant section or page of the plan what you end up with is an unamended plan stuffed full of amendments.
If possible, make use of existing lists within your organisation. There are people whose responsibility it is to update telephone lists. The CEO’s PA may keep all the senior management team’s details up to date on a laminated card and send the card out to all executives. Get yourself on this distribution list for the card and instantly you have a list of the telephone numbers of all senior managers. If HR keeps a list of all home telephone numbers and mobiles, ask for the list to be made available to the incident team on the day of the incident. Often people are happy to give HR their details but may be reluctant to give the details to anyone else in the organisation. My suggestion is to, wherever possible, avoid putting the telephone number in a plan and try and make use of existing lists which are maintained by others.
- Your plan should have a logical sequence. Too often plans have lots of good information but it is difficult to find. Perhaps on the first page of the plan you could have an immediate action list rather than have pages of background information, scope objectives and quality assurance information. These are all important and should be in the document but why not put them at the end so they can be referred to only if necessary.
- Details of the medium to long term recovery. Many plans only concern themselves with the short term recovery and the immediate actions to be carried out after an incident. They go into great detail of how the first 10 members of the call centre will get to the work area recovery centre within the RTO of 24 hours. What the plan does not mention is the strategy for recovery of the 90 other members of the call centre who need to be recovered within one week. Yes there can be some hot planning on the day but I believe there should be some detail within the plan of how to recover the “second wave” of staff.
- A team to manage the incident. Often at the operational level a plan contains lots of good information on the recovery of the department but does not contain any information on who will manage the recovery. Will their representative on the Tactical Team manage the recovery or will it be the departmental managers who will get together and implement the plan? The Good Practice Guidelines 2013 says that every recovery plan should have a team to manage it.
We should be periodically reviewing our plans and checking they are fit for purpose. Next time you do this you many want to check your plans against this list!