Would Your Business Continuity Plan Work? The Need to Exercise Your Plan

What mechanism do you use to determine the viability of your business continuity plan? Do you exercise all the elements of your plan? Do you exercise the response, resumption and recovery strategies you’ve defined? If you are like 60% of those that have not taken the time to develop / document a business continuity plan you do not.

There are many stories about organizations that have taken the time to exercise their plans, only to discover that they would NOT have worked at time of a major business disruption. The exercises often revealed that the strategies, polices, practices and procedures were not adequate to allow them to respond to an event, resume their critical business functions and actually recover their business over time. The end result would most likely be something other than business as usual or no business at all. Read this successful story about AT&T in response to Hurricane Gustav and in preparation for Hurricane Hanna. 

I can not stress enough the need to exercise or test your plan at least annually. I suggest that even if you take the time to conduct an exercise – take the time to ask yourself at least several times a year “what has changed in our business and would our plan still work?” Here are some questions that need to be answered and only a formal exercise will draw out the answer, whether it’s one you want to hear or not 

• Does your staff demonstrate adequate knowledge of the plan?
• Have specific individuals been assigned specific responsibilities?
• Have the resources (people / places / things) you would need to respond to the event and to resume / recover your business been identified. Have you set them aside?
• Where would you go to resume your business?
• What about technology?
• Have you identified critical vendors or contacts you need to reach following an event?
• Have you adequately documented the above? A quick note – tribal knowledge is great, but in the absence of the individual that possesses that knowledge your shot at putting a viable recovery solution in place at time of event will fail. That is well proven!

I use a simple tabletop exercise, a building fire, to lead folks through their plan logic. You’d be surprised what you can learn from a simple sit down, a one to two hour get together playing out a fire event that lasts an extended period and ultimately ends up in the search for a new location from which to conduct business. California is testing their earthquake DR plans, in response to the Chino earthquake last month. Although there was minimal damage, it served as a wake-up call to emergency planners. This article explains the steps they are taking to prepare for the next quake.

If you have a plan and / or conduct such an exercise, make sure that all the gaps that are identified (and there will be some, if not many) are placed on someone’s action item list to be resolved. Timelines for resolution should be identified and monitored for completion.

We’ve all heard the adage that “organizations simply don’t know what they don’t know.” Therefore, I strongly suggest you exercise your plan until you feel as if “you got it right” and that you do this periodically to ensure your plan remains viable.

Take the time to test & exercise your plan – I dare you!