While globally, the level of maturity of business continuity programs continues to rise, there are still many organizations that do not feel fully prepared. And, there is confusion when it comes to creating business continuity plans. On average, respondents to MissionMode’s Readiness survey rate themselves at 58/100 in overall preparedness, and a recent disaster preparedness benchmark survey found that 75% of companies worldwide are failing in terms of IT disaster readiness. According to our Readiness Survey, 60% of organizations have underdeveloped plans as follows:
- 6.9% currently have no business continuity plans in place
- 21.6% have preliminary plans created but not trained
- 31.9% have plans created and trained for some event types
- 39.7% have plans created and trained for all event types
With so many potential sources of business disruption, one of the first challenges when creating business continuity plans is to prioritize which events to create plans for. We advise organizations to fully develop and train the highest priority plans before moving to the lower priority items.
Once your team has identified exactly which events to plan for, then it is time to work through the details of plan development. The diagram following outlines the six stages of business continuity plan development:
Stages of Business Continuity Plan Development
Every type of event will require a different set of team members to tackle. In addition to the Business Continuity Director, it is critical to identify which functional areas will be impacted by a specific event type. For instance, in the case of severe weather, the following resources may be called upon: executive leadership, communications, facilities management, manufacturing/operations, customer service, finance, and human resources. External vendors and emergency personnel may be tapped as well. For IT disruptions, the list of team members would likely look quite different. For each event type, primary and secondary team leads should be identified by functional area and all contact information collected across multiple devices for emergency notification purposes.
For many event types, there are tools and processes that can be put in place to monitor the situation. For example, in the case of an epidemic or influenza outbreak, the spread of the disease and proper preventative tactics will be closely tracked and reported by public health officials. By event type, different team members will be responsible for following the situation and activating the BC team as needed. Plans should reflect which team members own risk monitoring and at what point team activation is needed.
Impact Assessment (Go/No Go)
For every event type, there comes a decision point at which the team needs to determine if response is needed – the Go/No Go point. Response can be limited to employee communications or may require full cross-functional team activation. For fast, effective impact assessment, team-wide access to quality information is essential. Teams that operate with a centralized incident management system are assured full visibility to all needed information as soon as it is available. This may include weather forecasts, video footage from impacted locations, number of employees/customers impacted and more. Plans must identify what information is required by event type, who will be responsible for collecting/sharing that data to facilitate decision making, and expected speed of information collection and sharing.
Post Event Metrics Review
Every good business continuity plan includes a section for key performance metrics and post event review. Depending on the event type, various metrics should be analyzed to determine the effectiveness of the response. These may include both qualitative and quantitative factors such as: team member availability/participation, speed of decision making, employee communication effectiveness, speed of recovery, and more. Plan templates should include which metrics need to be collected/evaluated by event to assess success.
Once the team has determined that an event is serious enough to merit a response, the functional teams must do specific assessments to solidify and communicate their response plans. Planning templates must be created to guide this effort by including checklists of likely impacts that each functional team needs to consider in plan evaluation. Functional plans should be shared across the full BC team for approval and funding if needed.
At this stage approved plans will be executed by all of the functional teams with each team updating their task lists to share status on action items and facilitate additional decisions as the situation unfolds. Because many of the teams have inter-dependencies, full visibility to the incident management dashboard is essential to efficient program management.
How To Use This Information
We hope this information will help you with creating your business continuity plans. If you need help, give us a call call us at 312-455-8811 or schedule an online demonstration to learn about our MissionMode IMS.