We all know there is a benefit to regular exercise. It strengthens muscles and our cardiovascular system. It helps to strengthen our skeletal system. It even helps improve our overall sense of happiness and wellbeing. And yet……
I won’t cite statistics about how many people actually exercise or how often they do. That’s not the point of this article. The point is that, despite the known benefit, most people just don’t bother or they over estimate the amount of exercise they get.
The same seems to hold true for business continuity plans (BCP). “Why bother to conduct an exercise?” Some people say, “All the information we need is in the plan. All we need to do is follow it, right?”. Well,… no. This type of attitude is based on three assumptions that, to quote the old song, “ain’t necessarily so”.
The first is that the BCP is up to date. If business continuity was treated as a project rather than as a program, it’s more likely that the plan has sat untouched on a shelf since it was first completed. No company’s operations are static. When the time comes to invoke the plan there will be trouble implementing it effectively.
Another assumption is that the plan is a “cookbook” and all the crisis management team has to do is follow the step-by-step instructions and all will be well. Wong. A well-written BCP is a guidebook not a cookbook. It doesn’t absolve the team members from exercising sound business judgment when a business interruption occurs.
The last assumption can be fatal to the business: “We’re never going to use this anyway.” It only takes a cursory review of the news to see that events, whether natural or man-made, happen with regularity. A volcano in Iceland erupts and shuts down air traffic to and within Europe for weeks. An ice storm in Atlanta causes total chaos. Further up the east coast, the same storm causes power outages that last for five days or more affecting homeowners and businesses alike. Things happen and businesses need to be prepared. Part of being prepared is exercising the plan annually.
Let me tell you a true story. I was the BCP manager for the risk management department of a major card payment company in New York City. Testing our plan was required annually by the central Service Continuity staff. Usually, they provided the scenario but in the last year I was with the company, they changed this. I had to write the scenario for our business unit.
We’d previously tested pandemic and civil unrest scenarios. This left me scratching my head for an idea until a news article caught my attention. The New York City Department of Emergency Preparedness was going to run a drill testing the city’s response to a hurricane. Hmmmm…..a hurricane. It had been a while since a major hurricane had hit the NYC metro region. If one did, it could cause a loss of our building (we were located along the Hudson River) and the loss of the area due to storm surge (we were located in lower Manhattan). Our employees could be stranded at home due to loss of power and damage to the transportation infrastructure. This could work very well as a BCP scenario.
After doing some research with the NYC Department of Emergency Preparedness and with the management firm that operated our building I constructed a scenario with two hurricanes a week apart threatening the NYC area. The first one missed to the south. The second one was a direct hit.
In my scenario, lower Manhattan was flooded up to 23rd Street. The subways and the commuter trains were completely flooded, as were all the electrical conduits that run under the streets. Worse, our building was flooded due to the storm surge damaging the electrical distribution system, the heating and ventilation system, and the communications system. Power was lost over much of the region which meant that our employees couldn’t work from home because they’d lost both power and internet access.
The team members ran through the exercise and did a good job, though we did find some gaps in our plan that needed to be addressed. On the way out of the exercise, one of the senior VP’s pulled me aside. “You went a little over the top with this ‘doomsday’ scenario, didn’t you?” he said. “Well, maybe”, I conceded. Never argue with a senior VP. “But, it could happen”, I replied. Several months later it did in the form of Superstorm Sandy.
Sandy played out much as I had written in my scenario, except it was much worse. Because our team had practiced, we knew to shift work to other sites well before Sandy hit. We also knew our building would likely be damaged and unavailable for a period of time and so our employees were instructed to take their laptops home and plan on working from home for the near term.
What I hadn’t counted on in my scenario was the extent of the damage to the electrical infrastructure of the region. We had employees without power for weeks, not days, after the storm. The transportation system took longer to come back than I had predicted. Our building wasn’t restored to full operational use for several weeks after the storm. Because we had anticipated this type of a situation and practiced for it, we were better able to cope with the magnitude of interruption to our business operations that exceeded what my imagination was able to produce.
Business continuity plans need to be exercised for the same reason that people need to exercise; to strengthen their weaknesses, to improve their overall health, and to improve their sense of wellbeing. Teams which exercise their plans regularly improve their ability to respond to business interruptions and gain confidence in their ability to respond effectively, even to situations for which they have not practiced.
Do you need assistance in creating, revising, or exercising your Business Continuity plan? Contact me at david@discenzabcs.com to discuss how I can assist you and your team in gaining expertise in implementing your business continuity plan.
David Discenza, CBCP, president of Discenza Business Continuity Solutions, has been involved in business continuity planning since 2009. He was the business continuity manager for the Risk & Information Management (RIM) group within American Express and currently works with companies in Philadelphia, New York City, Washington, DC, Baltimore, Connecticut, and nationwide to help them formulate plans they can implement when an unexpected business interruption occurs. David is certified as a Business Continuity Planner by the Disaster Recovery Institute International.
Recent Comments