We need to understand what may happen as a result of different risk events, and we also need to forecast what the impact of those consequences may be on the business. We also need to stay on top of how this can change as a result of introducing new processes and services. Among the major reasons for BCP failures is that of not keeping the plans current, so that in response to a disaster event people implemented the wrong remedial actions. That is to pile confusion on top of chaos, and there is no reason for that to happen. From a PM4HIRE.COM perspective we think that the best approach is to manage the BCP out of a Project Management Office, where all new projects get introduced and reviewed before they are prioritized. This way, the PMO can assess if and how the new projects affect the BCP and make sure that the BCP is updated to reflect the new projects. Some companies try to repeat the BCP analysis every so often, but due to the cost and effort involved the timeframe known as "every so often" tends to get stretched to the breaking point.

PM4HIRE.COM uses a proprietary methodology as outlined below that focuses heavily on the analysis of consequences and on the business impact assessment in order to make sure that your company is prepared to deal with most disaster events:

RECIPE

The proprietary B.I.R.P. methodology of PM4HIRE.COM is a 6 stage program for the development of a Business Interruption Response Plan. The following table summarizes these 6 stages and provides a summary of the B.I.R.P. methodology:

R = Risk Identification

Things can happen that may affect our ability to continue business as usual. These risks may not be specific to our business: most risks affect all businesses in a given area. We need to focus on those risks that cannot easily be mitigated.

E = Exposure Analysis

This analysis explains how selected risks may impact our operations. These are the risks we want to track, we want to know the frequency and likelihood of these risk exposures to determine the potential costs and to prepare for mitigation initiatives.

C = Consequences

Actual risk exposures will have certain consequences on our business operations that must be analyzed to find out what we can or should do to minimize those consequences. We need to develop specific mitigation plans where possible.

I = Impact Analysis

This analysis validates the potential mitigation alternatives to check on the ripple effect of a disaster response. This establishes the realistic alternatives (if any) for dealing with a disaster event so that the total business disruption is minimized.

P = Prevention

In the course of the above analyses we will learn a lot about what can be done to stop a disaster from affecting our business operations (or to minimize the impact). Prevention may not eliminate risk but it will make that risk easier to manage.

E = Execution

When a disaster actually strikes we need to have a response plan in place that will take minimal effort to invoke, and that can be implemented by designated people without close supervision, so that more senior management is free to deal with the aftermath.

It is not difficult to see why you need to revisit steps 3 and 4 regularly, to do an impact analysis of changes to your operating environment that may have compromised (or improved) your BCP. Before you can do an impact analysis you have to revisit any changes to the possible consequences of disasters. Sometimes things have improved so that you can reduce your on-going vigilance, at other times things have become more critical and they require more attention to make sure that risk events do not turn into disasters for your company. This must be part of an annual planning exercise, so that you do not let steady increases in production volumes take you by surprise. You do not run out of capacity, you are cought off guard. Even with an annual review there are no guarantees that things do not change fast enough to compromise the BCP. So consider the following steps as a part of your annual budgeting process:

The third stage of our 6-stage RECIPE methodology is the analysis of possible consequences of the different risk events that we think can affect the company, which begins by looking around at processes.

It is important to acknowledge that by simply implementing a basic response process you cannot mitigate all possible consequences, and that many consequences may be itemized not only for financial exposure reasons but allso for personal injury reasons. It is difficult to estimate the value of an injury, so we will presume that all such injury exposures will lead to a prevention analysis by default. What this leaves us with is to analyze the potential financial exposures of all systems and processes that are not already accounted for. Annually you should try to confirm that the assumptions embedded in the plan are still valid.

Listing all the things that can happen to the company in the event that a risk materializes from a disaster or even from normal operations gone awry helps you to build an inventory of loss exposures and/or cost increases. If it is an unlikely event then the "insurable cost" is relatively minor, but you still need to consider the effort involved in resuming business operations afterwards. You need an inventory of all critical systems that is up-to-date so that your recovery efforts will have the right focus if you are called upon to do so. You can create a complex or simple list of criteria, even down to critical = recovery within 4 hours, necessary = recovery in 2 days, other functions = recovery in 2 weeks, for example. Do not forget that it is one thing to restart your I.T. systems on a backup site, it is quite another thing to have workspace for people that need to access that backup site in order for you to run a company. Many I.T. focused BCP strategies overlook this operating personnel dimension and are impossible to actually put into effect.

Potential problems can be complex or as simple as having to figure out how to restore a licensed software on a backup computer when the original is destroyed. Do you have the media safe and handy for installation on that backup computer delivered empty by the vendor? Can you install extra copies on hot standby computers without having to pay additional license fees? How much stand-by capacity do you need? Can you provide your own, or do you have to make outsource arrangements? What is the impact of providing new business systems that add more demand to an already stretched BCP environment? You cannot answer these questions once and for all, because within the year things will have changed and you will be faced with new challenges.

One of the functions of the BCP is to name those responsible for specific actions during a recovery (and to name those that should act as a backup). People change, so if you are not careful you end up with a phantom team as opposed to a "virtual team" that implies a "shadow organization" that comes into effect in the wake of a disaster. There should be periodic meetings of the teams to make sure key people will be available to put the BCP into effect, and that there is a sufficient awareness of what needs to be done. Support processes, such as backups, need to be audited from time to time to confirm that the critical data are keps in safe storage ready tor use. This is a complex project management challenge, to have a recovery project almost permanently in the initiation stage and kept up to date in the event a disaster strikes. PM4HIRE.COM offers a detailed plan of how to structure and manage a response team, and how to keep the BCP current, as part of our consulting practice.

Once we understand the possible consequences of different risk events we can start to evaluate how different consequences can be mitigated. This is the core of the PM4HIRE.COM Business Interruption Response Planning efforts, to see what can be done in order to minimize the probability of an event occurring, as well as to determine what needs to be done should an event occur anyway.

The purpose of the impact analysis is to make sure that the recommended solution will work. The analysis is performed by means of simulation tools to follow the alternative workflows under a number of different stress conditions and by calculating the resources required at each step along the way. Whenever there is a change, ranging from introducing new and improved I.T. systems to a business reorganization, you need to repeat this impact analysis to confirm that the new environment can still be supported. We tend to focus on I.T. processes. While daily backups are a good base to start from the scope of a BCP goes well beyond computer outages. It is not hard to imagine that such an analysis is a complicated venture that itself requires automation. When you have multiple sites that are designated as each other's backup site you must perform a concurrent analysis of multiple sites to see the impact of potential disaster events.

Every company is trying to do more with less resources by introducing more complex technology that is harder to replace in the wake of a disaster event. Typically companies do not carry spare capacity just in case. Whenever a reorganization takes place, valuable knowledge about the BCP can be lost. Key individuals names in the BCP may no longer be employees when a disaster unfolds. To keep the BCP alive requires a lot of retraining and updating of documentation. Not only is the BCP at risk, employee morale may plummet as people are let go, and many a company fire has been traced to arson attributed to disgruntled employees. Leaner departments that can barely sustain their normal workload are less able to take on overflow work when a part of the organization goes into disaster recovery mode. Simply driving people to work harder is not going to cut it, certainly not if the outage is of a longer duration. You should not wait for a disaster to find out how it may impact on your other sites.

PM4HIRE.COM uses proprietary tools to analyze the potential impact of different disaster scenarios and we can help you with the analysis of alternative options for responding to a disaster, from a possible site closure analysis to a more likely strategic recovery plan. We can help you to perform a detailed solution analysis to explore each consequence in terms of business continuity and to verify that the planned intervention will be adequate to deal with the expected disaster scenarios. We can help you to perform a site process analysis to see what processes can be diverted, or what accommodations can be made to accept diverted processes, and how soon a disrupted process can be resumed at any location. We can help you to perform a staffing analysis to see how you would handle increased workloads at backup sites, and we can recommend ways to make it clear to the staff that this is intended to save the business in order to set the stage for a recovery.