Business Continuity Planning: TIME IS MONEY BE PREPARED OR ELSE!
Business continuity planning can be defined as the set of procedures developed by the management of an organisation that will assist the business to continue its operations despite a significant interruption (to its buildings, IT systems or employees) with the ultimate objective of restoring the business to pre-disaster levels. These interruptions include fire, flood, earthquake, riots or similar event. Most persons think of business continuity only in terms of the recovery of information technology systems. However, the components of business continuity planning are much broader in reality. A solid business continuity planning program should include three key elements: emergency response planning, which deals with the people element; disaster recovery planning, which covers IT systems and business resumption planning which deals with the activities of the business units e.g. payroll processing.
How much money should you spend on business continuity planning?
"While costs is one reason cited by some company or not implementing a business continuity program, there are other reasons. An AT&T study found that 75% of companies surveyed had business continuity plans while another 25% did not. Those that did not have plans were asked to give the reason for the absence of plans. There explanations are summarised below:
Why companies don't have a business continuity plan?
1. 48% - think it is not a high priority
2. 25% - don't believe a major disaster will happen
3. 21% - too expensive
4. 15% - not familiar with what is required
NB - multiple responses were allowed
Does your company have a plan? If not, what is the reason? You should seriously raise this issue at your next Board or Senior Managers' meeting. But do you know how much you should spend on developing and implementing a plan? Do you know how to even go about developing a plan? Stay tuned for the answers to these and other questions in future articles.
Business Continuity Planning
Time Is Money - Be Prepared or Else! Part 2
The last segment ended, with the question of what is the cost of developing and implementing a business continuity program. This segment will address this question.
DO A COST-BENEFIT ANALYSIS
The amount of money that should be spent on a continuity program should be treated like any other investment decision that a company makes. Generally, companies do this kind of analysis before regular investment decisions are made. In business continuity language, the cost-benefit analysis is equivalent to the business impact analysis. One of the key deliverables of the business impact analysis is that it shows the estimated financial (e.g. lost sales, penalties) and non-financial (e.g. customer inconvenience, customer dissatisfaction) damage that would be suffered as a result of a major disaster. The cost or cash outflow of implementing the business continuity strategy represents the investment and the savings that would accrue from using the plan to continue in business despite a significant disruption represents the "cash inflow". These "savings" or "cash inflow" include the protection of the company's reputation, money saved from not compensating clients for delivery delays and additional sales made that would otherwise have been lost if there was no continuity plan, inter alia.
It should always be remembered that a business continuity plan does not have to be in place for a company to survive a disaster although the statistics show that 93% of these companies go out of business within 5 years - this is because of the severity of the after effects caused by the disaster. Many companies survived 9/11 even though they had no disaster plan. The main message however, is that a plan will facilitate a faster recovery and hence will save your company money - the cost of implementing the plan is therefore a worthwhile investment! So how much should I spend on business continuity planning?
The amount that should be spent on your business continuity plan should be enough to provide the minimum resources required to keep your business going after a disaster, until the business is in a position to return to pre-disaster levels. This amount that is spent, however, should be less than the financial and non-financial impact that would result if a disaster were to occur.
Business Continuity Planning: Time Is Money - Be Prepared or Else! - Part 3
The last segment ended, with a discussion on the cost of implementing a business continuity strategy. This article will seek to address Business Impact Analysis (BIA) i.e. how BIA results influence recovery strategy selection.
The BIA is perhaps the most important exercise in business continuity process. The BIA will clearly indicate to senior management the business case for preparing a business continuity plan. Some of the critical outputs of the BIA include:
" Identification of time sensitive business processes that are required after a disaster;
" The downtime tolerance in terms of IT systems for the business units;
" The financial, customer and regulatory impact of a disaster on the company;
" Minimum resources required for continuity after the disaster has occurred.
If therefore your BIA suggests that the minimum downtime tolerance of your key business processes is three (3) hours, then the most likely implication is that you should have a replica of your IT resources at another location, as any other recovery option is unlikely to restore your business processes within three (3) hours.
Alternately, the BIA might suggest that thirty (30) days is the minimum downtime tolerance of your key business units and that the financial and non-financial impact would not be material for the duration of the thirty (30) day period, in which case a formal business continuity plan may not be necessary, as you may be able to get back your processes up and running long before the thirty (30) day period.
The implications of this last point is powerful. Many companies automatically assume that they need to have a replica of their computer room at another location or that they need a reciprocal arrangement with another company that has a similar computer system. In fact, this may not be the most efficient strategy. In rare cases a company could chose a "do nothing" strategy. The Board should approve the outputs of the business impact analysis and the final recovery strategy selected.