1. 16 Continuity Q3 2013
©iStockphoto.com/lorrainedarke
Getting the
balance right
Will Brown, John White and Thibaut Minguet
consider whether time spent planning
for the longer-term would be
better spent ensuring that
you are quick to respond
A
s BC practitioners, we continually
assess our business processes;
analyse our changing operating
environments; identify and reduce our
vulnerabilities; design, improve and
validate our response capabilities; and take
advantage of (or respond to challenges
associated with) new technologies. One
area that we also need to consider is the
timeframe for our plans.
In this article, I want to explore the extent
to which long-term BC planning can prove
effective. I will also focus particularly on
when the value realised from long-term
planning is exceeded by the effort put into it.
Appropriate planning
As BC professionals we all recognise that
BC plans should be appropriate to the
nature and size of the business, but the
question is what period of time should we
plan for following an incident? How far
into the future can we see? How quickly
do our certainties become predictions, our
predictions forecasts, and our forecasts
guesses?
There are two key thoughts that I would
like to raise right from the off:
• Firstly, that BC planners will realise a far
greater benefit by focussing their efforts
on shortening their response time than
elongating the time covered in their
recovery plans; and secondly,
• That BC planners should only plan
to the extent of accurate information
available to them at the time of planning
– all other planning should be about
ensuring the process continues when
certainties run out.
BC plans, by definition, help organisations
to respond to events which do not come
with a set of recognisable parameters
spelling out how severe or long an incident
might be. Having said that, with effective
risk controls and awareness of our operating
environment, neither are we completely
blind to the things that could happen. As
such, the ‘normal’ business environment in
place when plans are invoked is one of rapid
change, and a high level of uncertainty.
This sense of uncertainty exists whether the
incident is the result of an identified risk or a
completely unseen event.
Whether the incident in question has
come completely out of left-field, or
is recognised as something which the
organisation could have foreseen, the
objective of the first response remains the
same – to respond quickly and effectively,
stabilising the incident and moving as soon
as possible into recovery.
Getting out of the blocks
This is perhaps explained better using a
sports analogy. In a 100 metre race the start
is crucial. Sprinters repeatedly practice this
phase of the race. Following a good start,
the rest of the race is a sustained effort, but
the end result will be strongly determined
by how the start was executed.
Experience tells us that what really
matters in the recovery is not how far into
the recovery you can plan for, but how
quickly you can recover from an event. The
more you can plan for the early stages of
your recovery, the better armed you are to
face longer disruptions. It is very difficult
to predict how your customers, suppliers,
processes or employees will react to a
disruption, and what the consequences of
your first actions will be.
You can, however, still prepare for
the ‘money time’. This is the time when
information is critical but when you have
none; when you need to make decisions
based on incomplete or missing facts.
Focusing your efforts on being ready for
the first 10 metres will make the difference
at the end.
This is also supported by the fact that your
initial decisions will change the way events
play out. Past the initial response period, you
need to adapt and take into consideration
the consequences of your first actions.
The disruption will bring new rules, a new
environment that needs to be embraced. If
your business is not agile enough to adapt
to the new ‘world’ caused by the disruption,
your recovery will take longer and the
outcome will certainly not be as predicted.
Detailed task lists with extensive and
specific action lists for every possible
scenario will give the business continuity
practitioner who believes in quality being
defined by the kilo a great sense of self
worth. In reality though, how much better
could some of this time have been spent
in refining first response protocols, or
addressing real and known risks?
‘Manage’ is the key word
Following an incident, ‘heavy’ plans tend
not be used at all. As we mentioned earlier,
the quality of a plan is not measured by its
size or length, but how it helps the response
team to manage the incident. The key word
here is ‘manage’. Plans should not be a
list of tasks which need to be completed
to ‘recover’ the organisation. Plans should
focus on enabling the process of recovery.
The reason for this is simple – you can
accurately and effectively predict the process
steps required to gather information and
react to it; you cannot predict the content of
that information and its implications, and if
you do, your plan is wholly dependent on
your planning assumptions.
With each iteration of decisions made
during response and recovery, the ‘real’