Series: CIO - A Year In Preview, Business Continuity Disaster Recovery Planning

Series: CIO - A Year In Preview
Business Continuity/Disaster Recovery Planning (BCP and DRP)
Submitted by Martin Hockham, Partner at Negenit, Consulting Without Boundaries

Even if your business hasn't become very dependent upon Information Technology (IT), it is important to develop and implement an appropriate Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP) to improve the probability of surviving a business interruption. This is separate from a Health and Safety Plan to protect the lives and health of employees, this article is about the survival of the business itself. If your Auditor hasn't already pointed out the need, it shouldn't be a surprise when they do....it has become an increasingly common requirement for Auditors.

Statistics are available which indicate that of companies experiencing a major loss, 43 percent never recover enough to reopen their doors. Another 51 percent close down within two years. This means a mere 6 percent survive the long term. To ensure your business is not a disaster casualty, you need to take the time to look at your Business Continuity requirements.

The terms BCP and DRP are terms which sometimes are mistakenly used interchangeably, but they are separate and discreet. Over recent years they have become part of our common business language due to the recognition of risks to the survival of the business in the event of a disaster created by the scale of dependence on IT.

Business Continuity Planning goes beyond IT and looks at the business-at-large to identify vulnerabilities that could cause business failure from a number of types of events that are unlikely, but still very possible. In most cases IT will be one such dependence. For example, if your business were housed next door to Sunrise Propane in 2008, and if your facility wasn't completely destroyed in the initial explosion, could it have survived the closure for a week during the subsequent investigation? Or the two weeks after the Mississauga Train Wreck? In this case, even if the IT shop were housed at a distant service provider, it could be sitting idling, but if there is no one able to use it, it wouldn't help ensure survival of the business.

Disaster Recovery Planning can be considered an integral sub-set of Business Continuity Planning. It deals with ensuring that if a disaster does subject you to the worse case - a smoking hole in the ground - you can recover enough capability to enable the business to come back after being out of action for a time. This planning is particularly common surrounding the ability to recover the IT function since the costs are easier to justify due to the wide operational dependence.

So a Business Continuity Plan is one which puts Risk Mitigation Measures in place to reduce exposure of the business to identified risks with a range of impacts, in a less-than-worst-case scenario. While a DR Plan puts in place Contingency Measures (for example, facilities, equipment, services) which will help with speedier recovery if a worst-case event does occur.

Often, it isn't just the disaster event that we need to consider, but the surrounding impacts. If your business could not survive with the doors being shut for days, or weeks, you should consider some of the risk mitigation measures that are proven to increase survival rates. This isn't to say the business will be able to continue as though nothing happened (this might be too expensive), but can it come back to life in a reasonable time period for it to continue operations? Remember, in today's business environment, the competition are just a "mouse-click" away.

Such plans begin with an objective examination of the business operation to produce a Business Impact Analysis. This document will identify and quantify the value of the risk in identifiable hazards. Often hazards which are easy for the trained eye to see, but which have become all too familiar to management and staff, and therefore not recognized as hazards. This exercise provides the added benefit of increasing employee awareness of risk factors, and identification is essential to exposure reduction.

An objective assessment of the business's resilience will nearly always provide some surprising awakenings. For example, it might take more time to locate suitable new business premises after a fire, and get phones and power laid on, than it takes for your "loyal" customers to find a new supplier. And with all the effort of finding, acquiring and arranging, you will have little time to communicate your status to customers. Instead of assuming survival, you owe it to investors, staff, customers and suppliers to improve the quality of understanding.

A Gap Analysis will compare the "The Existing State" to "The Ideal State" and produce a prioritized-by-value - rated by urgency and by cost - shopping list of initiatives with a management checklist to follow and manage progress.

Some measures are simple, cost little and can be implemented immediately. Other measures may have significant costs associated with them and may have to be shelved indefinitely. But there could be several which can be justified, but would take some time to investigate, arrange and implement. Some measures may even improve productivity, thus having a "negative cost".

Few businesses have "extra" staff available to undertake such a study; few businesses have staff experienced in conducting such a study; few businesses, or their staff, have a successful methodology to follow; few businesses are prepared to empower their staff to inquire into planning and managing disciplines required to understand the core of the business. This can be a business-changing project that needs to be initiated and completed; not be permitted to languish as "second priority".... the true value is in the completion.

The examination doesn't have to be "too expensive for me". It can easily be tailored to the size of the business operation. If you don't think having a Business Continuity / Disaster Recovery exercise conducted on your business has any value, are you saying, "My business has no value?"

Every business should have a BCP as a Survival Assurance policy for identifiable and unforeseen hazards. Knowledge is empowering. Understanding the situation of your business and knowing what options you have to consider, will improve your peace of mind, and that of those that rely on the continued successful operation of your business.

By: Martin Hockham
Partner at Negenit Corp. (BC/DR Planning, Program/Project Management, IT Management and Consortia Coordination)