Many organizations have disaster plans in place to
address such issues as civil unrest, disease outbreaks, and certain
natural disasters. Information Technology departments normally have
plans in place to backup and protect critical business data, and
procedures in place to reestablish data processing capabilities in the
event of power outages, fire or other disasters. What many organizations
are lacking, however, are plans, procedures and tools to be used
during such disasters and automated systems outages to ensure
the business continues to operate and serve customers. How will you run
your business (make products, service customers, market your products
and services, collect payments, etc.) without power, technology or other
critical infrastructure? Or, will you just be out of business for a
Your IT department has likely identified the
business critical data processing needs for your organization, and has
strategies in place to protect your company data. Plans and procedures
are probably in place to designate an alternate data processing center,
recover critical automated systems and restore data. These are all
components of a well designed disaster recovery plan. Notice the
operative word – “recovery”. These procedures outline the steps
necessary to reestablish a normal working environment after
What is generally missing from an organization’s
strategy planning, however, is a Business Continuity Plan (BCP). This is
a plan including appropriate procedures, templates, worksheets and other
tools, used to direct business operations from the point of a disaster
through the reestablishment of a normal work environment.
Most organizations lack well-thought-out plans for
how to operate the business should circumstances arise which threaten,
or otherwise make unavailable, automated systems or other “modern” infrastructure.
How will you produce your product or service without the necessary
infrastructure? How will your employees know what to do in the event of
any type of outage? How to you transition back to infrastructure support
when it becomes available again? (This last point is as critical as the
Below is a list of “keys to success” when
developing your Business Continuity Plan:
Create a master plan for the entire organization. Each department
should be responsible for their portion of the plan, but have at least
one consolidated copy available for business leaders to use as a
reference. Be sure to detail the following considerations:
has the authority to declare the emergency?
are the decision criteria to be used to determine if an emergency
are the backup decision makers in the event the primary is
criteria are used to determine when the disaster has passed, and
normal operations may resume?
you need a team to handle various aspects of the plan? If so, who are
need to consider alternate sites for business operations? If so, how
are those made available? Is there a specific notification period
required, or are facilities always available?
Each department should detail the specific steps to take when an
unplanned event occurs. During a crisis, you may opt to forego less
important business process steps in favor of focusing on those
operations critical for continuing business operations. For example, you
may waive the need for certain reporting processes in favor of "spending" those
resources on manual quality assurance processes. The important thing is
to document the business processes to be executed, and the steps needed
to complete the process (remember, these are manual processes now. The
steps should be different than when automated systems or other
infrastructure is being used.) Don’t rely on your standard operating
procedures in times of crisis.
One additional point – don’t store your manual
business process procedures in an automated system which will be
unavailable in an emergency! Develop the procedures using an electronic
tool, but print the procedures and any other necessary documentation and
store them in a binder. Remember, you probably won’t have access to this
information in an emergency unless it is on paper!
During an emergency, there will be a lot of confusion and questions
about what is happening, what happens next, and so forth. Clear, concise
communications between leadership and employees is critical at this time
to minimize confusion, initiate plans and stabilize the situation.
Consider the following:
Develop specific procedures for how communications will be
handled (will employees call a toll free number for the latest
has the authority to initiate communications?
is the authority to answer questions from employees, media, vendors
are the first steps to be accomplished in any situation, and who is
responsible for each?
Roles & Responsibilities
Clear definition of everyone’s roles and responsibilities during a
crisis is critical for senior management; however, do not forget that
roles and responsibilities for staff are important, too. Employees
focused on continuing business operations and adapting to the new
circumstances will be more productive and helpful, than those left to
gather in the halls and speculate on what is happening. For example, if
all customer services representatives are not needed because
telecommunications are unavailable, reassign them to another role during
the event. This gives people a sense of purpose and contribution in an
emergency. Give everyone a job to do – especially until manual business
processes are functioning and stabilized.
Without the use of automated systems, manual (paper-based) systems
will have to be in place for the duration of the event. In addition to
manual business processes, additional tools, templates, forms or other
items may be required to collect data, make notes or manage your
business processes. Consider what tools are used now (they are often
developed right into your automated system) and adapt those for manual
use. Consider also whether/how multiple automated data management tools
could be combined for manual business processes. The more paper you have
in a manual environment, the easier it will be to lose information.
Consolidate for easier management.
Once the disaster situation is resolved, and automated systems are back
online, each department will need to determine how to transition back to
automated, normal processes. In some instances, it might be easy. In
other situations, there may be data missing which needs to be entered
into transactional information systems, and/or information from
executing the manual business processes may need to be transcribed. Be
sure to describe and document the specific steps and decision points needed in order
transition back to normal operations. Define what happens to the paper
records after processes are back to normal – are these documents
required for any regulatory reason?
While nobody like to think about disasters, it is critical to
practice the plans and procedures periodically (at least once per year).
Manual business processes should be checked for any updates/changes
needed since they were written or last tested. (This often happens when
process improvement initiatives and been recently implemented.)
Supporting tools and templates should be reviewed to ensure all critical
information will be collected and/or documented. Communication plans
should be updated as needed with new phone numbers, vendor names or
other information which has changed. Employees who may not participate
in limited scope exercises should receive periodic training on the
procedures and actions to be performed immediately after a disaster
Disaster planning is often overlooked, but can be
one of the most crucial planning exercises you go through every year.
You perform your strategic planning every year in order to grow your
business. Why wouldn’t you plan for disaster in order to protect your
Creating an Agile
Departments Are Not unto