Business disruption can be costly. Extra expenses plus lost revenues result in reduced profits. Insurance won’t cover all the costs and it can’t replace the customers that go to the competition. That is why it is essential to have a business continuity plan for continuing business. The development for a business continuity plan has four steps:
Information technology (IT) has components like servers, networks, laptop and desktop computers, and other wireless devices. It is critical to have the ability to run both enterprise software and office productivity. Recovery strategies for the information technology therefore should be developed in order for the technology to be restored in enough time to meet the business’s needs. Manual workarounds need to be a part of the IT plan in order for the business to be able to continue while the computer systems get restored.
- Do a business impact analysis in order to identify any critical business or time-sensitive functions and/or processes and the resources which support them.
- Figure out, write down, and implement the plan so you can recover critical business processes and functions.
- Create a business continuity team and make a business continuity plan for managing business disruptions.
- Train the business continuity team and do testing and other exercises for evaluating recovery strategies and evaluating the plan.
Business Continuity Impact Analysis
The disruption to a business function can be analyzed using the business continuity impact analysis. The BCIA uses information to make any decisions about strategies and recovery priorities.
The , provided by ready.gov, worksheet is useful in getting this information (as discussed in the Business Impact Analysis). Make sure this worksheet is done by one who knows the company well. Once the worksheets are finished they can be put into a table to summarize:
Prioritize so the functions with the most potential impacts are restored first. The “Recovery Time Objective” is the moment in time when a process or a function needs to be recovered before any unacceptable consequences might occur.
- When a negative impact to the business occurred.
- Financial cost and operational impact of the business function loss.
Resources Required to Support the Recovery Strategies
Resources are needed to recover time-sensitive processes. The Business Continuity Resource Requirements Worksheet ought to be completed by those in managerial positions. These completed worksheets are then used to find out what resources will be needed for the recovery strategies to be successful.
After an incident disrupts operations in a business, resources are needed to follow through with recovery strategies and to restore the normal business operations. The business can provide these resources or they can come from an outside source. The following is a list of possible resources:
Following a loss, all resources will not be able to be replaced immediately. Because of this, managers need to estimate which resources will be needed at which times following an incident.
- Third party services
- Utilities (natural gas, power, sewer, water, internet, telephone, wireless)
- Inventory including finished goods, raw materials, and goods in production
- Machinery, production facilities, and equipment
- Vital records (hard copy and electronic)
- Technology (data, software, communication equipment, peripherals, and computers)
- Office space, equipment, and furniture
Conducting the Business Continuity Impact Analysis
The worksheet and the worksheet (provided by ready.gov) both need to be provided to business process managers. In addition, they need the instructions for the processes, and how the information should get used. Review the information after the managers complete the worksheets. Identify the inconsistencies or gaps. Meet with each manager if information needs to be obtained or clarified.
After each worksheet is validated and complete, identify priorities for business process restoration. Also identify the requirements for both primary and dependent resources to develop recovery strategies.
Disaster Recovery Strategies
If production machinery breaks, a facility gets damaged, information technology gets disrupted, or a supplier fails to make deliveries, the business will lose money and those losses will grow. Recovery strategies are another way to restore the business operations to the minimum acceptable level after a business disruption. The strategies are prioritized by recovery time objectives (RTO) that are developed during a business impact analysis.
Recovery strategies require different resources such as materials, information technology, equipment, facilities, and people. Gaps can be found by analyzing the required resources for executing the recovery strategies. For example, if one machine fails but other machines are there and can make up the lost production, no resource gap exists. However, if all machines are lost and there are none that are undamaged to take their place, another facility with undamaged machines may need to pick up the slack.
Strategies might involve displacing some activities in the company, entering into reciprocal agreements or partnerships, or contracting with third parties. Utilize staff with substantial knowledge of business functions because they will know best what may or may not work. All possibilities should be explored and then presented to management for their approval (and to decide how much needs to be spent.)
Several recovery strategies might be able to be explored depending on the resources available and the size of the company.
Utilizing other controlled (or owned) facilities which perform similar work could be a good route to take. Operations could be relocated to alternate sites if both haven’t been impacted by the same incident. This strategy is also assuming that this surviving site has the capacity and resources needed to assume work that the impacted site was engaged in. If the second site can’t accommodate the first one, prioritize the production and provide additional resources and staff.
If realistic, utilize telecommuting in order to cut down on alternate site requirements. This strategy will only work if you ensure telecommuters have suitable home work environments and that they either have or are equipped with computer access with the required data, applications, peripherals, and of course a secure broadband connection.
In emergencies, other facility’s spaces could be put to use. Training rooms, conference rooms, cafeterias, etc. could be converted to provide office space if there isn’t enough space elsewhere. The workers will need connectivity, equipment, power, furnishings, etc.
Arrange with other businesses to support each other in case of a disaster. If space is available, issues like the protection of intellectual and private property, capacity of and connectivity of information and telecommunications technology, impacts to everyone’s operation, and the allocating of expenses will need to be looked at. For legal reasons, agreements should be both negotiated in writing as well as documented in the business continuity plan. Make sure periodically that each party can still hold up their end of the bargain.
Information technology recovery strategies and business continuity are supported by multiple vendors. Outside help can provide resources like office space or a live data center. Other options might include equipment, replacement machinery, or technology equipped office trailers. Regional disasters could cause competition for these resources which would limit the availability and drive up the cost.
Several strategies for recovering manufacturing operations exist such as using leased or owned facilities. Some manufacturing strategies include:
Several factors should be considered when manufacturing recovery strategies:
- Buying business interruption insurance
- Contracting with outside parties
- Limiting orders (e.g., maximum unit quantity or order size)
- Reallocating any existing inventory, repurchasing inventory
- Maintaining the higher raw materials or the finished goods inventory
- Prioritizing production—by customer relationship or profit margin
- Retooling production of one item to another
- Increasing the manufacturing output from operational facilities
- Shifting the production from one facility to a different facility
- How much longer will it take to get raw materials or to ship the finished goods to customers?
- Will the delay impact relationships with the customers?
- How much money will be lost by displacing other production?
- How expensive will it be to shift production of one product to another product?
- How long will it take to shift the production of one product to another?
- Will facilities be available when they are needed?
- What quality issues could come up if production is outsourced or shifted?
- Are there regulations which could restrict the shifting of production?
- What long-term consequences could be associated with each strategy?
Phones keep ringing and the customer service staff are occupied with keying orders in the computer and talking with customers. The electronic order entry system processes payments, checks the available inventory, and routes the order to the distribution center to get filled. All of a sudden the order entry system shuts down. What are the customer service staff supposed to do now? As long as the staff already has paper order forms, no phone order will be lost as the staff manually processes orders while they wait for the electronic system to come back up.
“Manual workarounds” include the order forms as well as the procedures for their use. When information technology resources aren’t available, these manual workarounds are essential recovery strategies.
Developing Manual Workarounds
Identify each of the steps in the automated processes. It can help to create a diagram of each process. Think of these aspects of information as well as work flow:
Develop data collection forms to assist in capturing information and define the processes for the collected information. The manual system’s progress can be tracked by establishing the control logs which document transactions.
- Manual intervention points
- Tasks (in order)
- External interfaces (resource requirements, activity, contact person, and company)
- Internal interfaces (resource requirements, activity, person, and department)
Because manual workarounds need people to do manual labor, staff may need to be temporarily reassigned or other assistance may need to be brought in temporarily.