In this week’s bulletin, Charlie discusses his reasons why flowcharts aren’t useful in most business continuity plans, and looks into how we could improve our plans.
Over the last couple of days, I have been rewriting a client’s business continuity plan. One of the features of their plan has been to have a number of flow charts. I have seen flowcharts in a lot of other plans, covering a number of different activities, either the call out of an incident, covering the whole of the response, or how to deal with specific incidents. Although they may look good, and they may be liked by those who are responding to the incident, I think on a whole they have a number of fundamental flaws which make them inappropriate for use in plans.
The following are reasons why I think you shouldn’t use them.
- Non-linearity of Business Continuity Response: Business continuity response is seldom linear or follows a standard path. An incident may change and take different paths, as the incident may take a different path to how the writer of the flow chart envisaged. This makes them difficult to follow.
- Rigid Decision Points: Flowcharts often involve decision points with simple ‘yes’ or ‘no’ answers. However, in a crisis, initial assessments can change as new information emerges, and decisions may need to be reconsidered. Flowcharts typically lack the flexibility to handle such revisions.
- Limited Flexibility: Flowcharts tend to rely on binary decisions (yes/no), and may not accommodate the ambiguity often present in crisis situations, where multiple factors need to be considered.
- Sequential View: In an incident, you may start planning and implementing the recovery, almost as soon as you understand the impact of the incident. The sequence of flowcharts sees one activity after another and it doesn’t really allow for the changing of the sequence, depending on the needs of an incident.
- Overly Obvious Information: Many flowcharts state the obvious, such as ‘beginning – middle – end’. Such basic information does not require a flowchart to convey.
- Lack of Explanation and Action Lists: Flowcharts often lack the necessary explanations and detailed action lists required for guiding a comprehensive response. This complexity is essential in a business continuity plan.
- Meeting Regulatory Requirements: Flowcharts may not provide the depth of information and assurance required when plans are mandated for regulatory purposes.
I don’t practically like them and think checklists are better – what are your thoughts?
