Business Continuity Plans are aimed at providing solutions that work in disruptive situations; solutions that will restore vital business processes within the parameters set by the business. The range of things that can wrong is wide, and the extent of each disruption will vary dramatically. As such, a Business Continuity Plan should be activated as soon as there is a realistic indication that the incident looks like it will escalate into a disruption and therefore breach the Recovery Time Objective for the relevant business processes.
But the time to find out that plans don’t work is not when the disruption has already occurred! If a plan hasn’t been exercised or tested, it’s just not a plan you can depend on.
One mistake many Business Continuity Plans make is to focus on total outages. That means they are often structured so that they can’t be tested piecemeal. Quite understandably, companies see a full interruption exercise involving the entire business as too risky, so testing never moves beyond a theoretical discussion based exercise—often leading to an unpleasant surprise when the plan does need to be invoked in practise.
In ContinuitySA’s view, therefore, a Business Continuity Plan must be able to be exercised in a flexible manner, starting with a theoretical discussion based exercise and then progressing in maturity into practical simulations and exercises. The plan and exercising thereof must also make provision for the fact that a department or even half a department may be sent offsite to the work-area recovery site for a day to see if they can, in fact, continue to function as planned.
This approach has the added advantage of familiarising staff with the components of their plan documents, the various logistical arrangements and communication requirements and what is truly expected of them should the plan be invoked. Exercising is an important and integral component of Business Continuity Management—and forms part of the five-day course mentioned in the previous blog.
In summary, training and exercising go hand-in-hand, ensuring that the ‘reaction is routine’ and that the recovery capability has been validated and proven! You don’t want to be counting the cost when it is too late…