Emergency Preparedness FMJ Article

The key to survival: Planning ahead for business recovery

John Newton

Facility managers are uniquely placed to understand the consequences of unplanned interruptions and to take appropriate corrective actions. In many ways, you do this every day, constantly challenged by minor glitches in the systems modern businesses depend on. Photocopiers break down, furniture or carpets are damaged, security systems malfunction or communication cables get severed during renovations. In these instances the hit is localized, manageable and unlikely to threaten the viability of the organization. Facility managers arrange for the mess to be cleaned up or fixed and move on to the next project.

Such abnormalities are par of a normal day, because coping with the unexpected is the facility manager’s job. People depend on you to solve their problems and keep them functional, productive and able to meet their deadlines.

Most corporations don’t sweat the small stuff—they manage it effectively. Suppose your company experiences a major unplanned interruption—a fire, severe storm or bombing that prevents access to your building for hours, days or months. Where would you go? What would you do? Would the company be able to survive?

The unfortunate reality is that many businesses do not survive even relatively small interruptions to their normal operations. They are totally unprepared to continue delivering services and meeting the needs of their customers.

Technology was the driving force

Businesses always have made efforts to protect their assets, from raising platforms to keep goods dry, to installing sophisticated climate control systems and fire suppression equipment. Actions focused on anticipating a particular threat and mitigating potential losses through design. Each threat was addressed separately as a unique problem. Various forms of insurance also were employed to share risks. However in the post-war years, there have been significant changes in risk-management practices, more by technological innovation than by economic concerns.

When computers were introduced to the business world in the 1950s, a similar attitude prevailed. For those using this new technology, the value of stored data led to the common practice of electronic backup in the 1960s. Duplicate tapes were made of key data, stored and revised regularly. Managers slept better knowing company records could not be lost through accident or error. For almost 20 years, data backup was considered sufficient to ensure a business’s long-term viability. The assumptions were reasonably accurate during a period dominated by personal contact, consistent growth and a regional focus.

Then the global marketplace emerged, with “Just-in-time” attitude and an electronic communication bonanza. This revolution created a highly interconnected business world where time is critical, competition is fierce and substitute products and services are readily available. Companies can no longer afford to be non-operable for even a few days or hours without losing market share and shareholder confidence. The implications of these trends for companies have been immense and demand new approaches to coping with major unplanned interruptions.

Date is enough

In a fast-paced business environment, data is necessary, but does not necessarily ensure survival. Highly reliable, protected information critical to a company’s operation must be available seven days a week, 24 hours a day. But date is not enough. Without skilled and knowledgeable people to access, manipulate, update and utilize stored information, corporations will grind to a halt. What can a facility manager do?

The answer developed in the mid 1980s and is now in full swing throughout North America, England and other countries around the world. In a scant 15 years, the attitude of visionary corporate leaders has shifted from data protection to total business protection. Today, key financial services, some government operations and a portion of the Fortune 1000 are prepared to continue operations—no matter what happens!

Will you be back in business?

These businesses implemented a business continuity plan to ensure their survival, give direction at a time of crisis and restore normal operations in the shortest possible time.

When a bomb exploded in the underground garage of New York’s World Trade Center, thousands of people were forced onto the street. Many businesses never reopened. The crime scene was cordoned off for an extended investigation and safety checks. Most of the businesses in the building had no continuity plans and more than 60 percent were not in business two years later. By comparison, when First Interstate Bank experienced a fire that gutted five floors in its 62-story building—including their main trading floor—they were back in business the next day and even made money! The difference is First Interstate had a well-developed business continuity plan.

Successful business continuity planning must include several components: vulnerability assessment, emergency preparedness, human and facility recovery plans, communication strategies, loss reduction programs and business resumption procedures. The total package is commonly defined as “planning to ensure the continued availability of essential services, programs and operations, including the resources required to perform critical business functions.” These resources include skilled people, their workplace, stored data, operation manuals, computer equipment and communication systems.

To guarantee continuity, a company must be able to recreate critical business functions in the shortest possible time. Business continuity planning will help the organization stay alive through a crisis and return to full operating capacity. The plan should be unique, tailored to the business and responsive to customers’ needs.

A plan protects corporate investment, ensures a future for your employees, and indirectly enhances the economic health and ongoing quality of life in the community. In today’s business climate, continuity of operation is critical to survival.

Focus on consequences

Adopting business continuity practices has shifted the planning focus from contingency to consequences. In planning for response, recovery and rehabilitation, companies are less concerned with the cause of the interruption and more interested in the consequences for their operations. What services, operations and systems are affected? Which of these are critical to the core corporate mandate? How do we mitigate our losses? These are the questions facility managers should ask immediately after an interruption.

The answers will be found in your business continuity plan, which describes what functions are critical, what resources are needed and how the recreate operational units, along with details that otherwise might be lost in the chaos. Without a plan your organization is rudderless, left to the whims of uncontrolled events and the wits of survivors.

Yes, some companies may survive a hit without a plan and continue to prosper, but it is risky to depend on luck! The global economy is much less forgiving than the regional marketplace, with vast sums of money moving at the slightest hint of trouble. For example, remember the Asian financial crisis and the taming of the “Eastern Tigers” near the end of 1996.

A business continuity plan is not a guarantee. It is a process and a means to understand in detail how an organization operates and how it can successfully cope with major unplanned interruptions. Through development and implementation of business continuity planning concepts, a new attitude to risk management will become embedded in the organizational culture.

Viability can be assured only when the business continuity process has been integrated throughout the corporate entity. Every manager and employee has a part to play—from the maintenance of accurate contact numbers to the assurance that alternate facilities continue to meet the needs of rapidly changing organizations.

Understanding the consequences of interruptions to critical business functions will be essential to determining the most appropriate and cost-effective recovery strategies. Moreover, once designed and implemented, these strategies will require testing through simple and eventually more detailed exercises. Your company can reduce its vulnerability and improve its chances of surviving with a logical series of plans and actions.

Companies advanced in business continuity planning apply their generally accepted vulnerability criteria to a wide range of business decisions—from relocations to mergers. Decision makers must be confident that their decisions have addressed continuity issues and appropriate safeguards. Every day executives make well-researched management decisions without assessing the potential consequences for the viability of the company. Don’t let your organization be blind-sided!

The potential consequences of the Y2K date problem were a disaster waiting for all businesses. Determining critical functions, a key aspect of business continuity plans, has become particularly important for applying limited resources to address issues like Y2K. Knowing which business functions or processes are most important to the survival of a business will be crucial for organizations just beginning to their compliance program.

Be prepared

With a plan you are prepared; without one you are vulnerable. In today’s rapidly changing world, each business decision is considered carefully so you and your company’s shareholders can feel confident about the future. With a business continuity plan, everyone sleeps better knowing actions have been planned for the safety of your business data and protection of the complete business operation.

When disaster occurs, insurance can cover your physical assets and some business losses, but it cannot replace customer loyalty or guarantee the continued flow of new business and critical investments. Detailed action plans prepared by management and staff enable you to reassure existing clients and accept new business with confidence.

These plans document who does what in a crisis, cutting through the chaos to direct key people and resources to the continuity of critical functions. Plans should address key elements such as resource requirements, voice and data needs, space and equipment, transportation and communications.

Your continuity plan will be unique to your organization. There is no “standard” fill-in-the-blanks continuity plan. Look closely at how your organization functions and work from that vision. Ask questions about the consequences of interruptions and begin to develop a continuity mind-set. These are practical steps you can take today rather than waiting for a disaster to uncover your organization’s weaknesses.

If you’ve developed a plan already, don’t stop there. Ask your third-party suppliers if they have a plan because you depend on their services. Will they be there in a crisis when you need them most? Consider making continuity plans a requirement for all outsourced contracts.

Key people can’t function without a workplace, access to critical data and all the systems, services and basic supplies often taken for granted. In business continuity planning, the facility manager plays a significant role in ensuring people have the necessary tools to continue working after a crisis. Moreover, the facility manager will lead the salvage and recovery activities, as well as the “return home,” which can be as psychologically taxing as the initial disaster. For this reason, make sure you are part of the business planning team.

Remember: these plans are for total business protection; they must focus on the consequences of a disaster and involve everyone, and therefore, will become embedded in tomorrow’s business culture.

SIDE BAR

Ten Key Activities
The Business Continuity Institute (BCI) and the Disaster Recovery Institute (DRI) have recently concluded discussions that led to the identification of the 10 key activities professional practitioners should perform to design and implement comprehensive continuity plans. To be thorough and complete, a plan for your organization will require all of these activities, which are presented in logical sequence, though some can be undertaken concurrently.

1. Project Initiation and Management
2. Risk Evaluation and Control
3. Business Impact Analysis
4. Developing Continuity Strategies
5. Emergency Response and Operations
6. Developing and Implementing Business Continuity Plans
7. Awareness and Training Programs
8. Maintaining and Exercising Business Continuity Plans
9. Public Relations and Crisis Communications
10. Coordination with Public Authorities

Of course, your organization changes—as it will constantly—plans and procedures must be reassessed and revised to reflect new operating structures, adjustments of internal and external dependencies like new technologies and outsourced services. Your plan will never be perfect, but it will be better than no plan at all, and may make the difference between bankruptcy and survival.

FMJ
About the author: John Newton is the principal of John Newton Associates, a business continuity consulting and research firm based in Toronto, Ontario, Canada. He is a registered professional engineer and holds a doctorate in environmental geography with specialization in coping with hazards. He also has a master’s degree in urban and regional planning and a bachelor’s degree in civil engineering. Newton also is an associate member of the Business Continuity Institute, a member of the Canadian Centre for Emergency Preparedness, and director of the Disaster Recovery Information Exchange in Toronto. Reach him at +1-416-929-3621 or jnewton@interlog.com.