return to samples

Why doesn't anybody plan for business continuity?

By Dan Derby

Unplanned emergencies (floods, fires, supplier failures, intellectual property loss, customer lawsuits, etc.) take down businesses regularly. Yet methodologies abound to prepare for such crisis and financial auditors often enthusiastically document the lack of them. A few observations about the real world and what makes thinking (and doing) about the unreal future so hard.

  • Everyday alligators. Day to day battles keep resources and attention away from the swamp of planning for tomorrow. This is the world's most popular excuse. Marketing roll outs, new product developments, new factory capacity. All upbeat, all forward looking, all contributions to the bottom line. Those initiatives get the resources.

Only when the enterprise feels threatened will it redirect resources. Making a case for that threat before the fact may be the single most challenging yet important task of future proofing a business.  It's your "JOB ONE".

  • It's a swamp. Swamps have hundreds of intimidating tributaries and lots hidden dangers. What risks? How likely? How bad? No one wants to go there since the potential is mostly downside. It's hard enough to stick your neck out on something you know is a problem. The murky regions of the future are just too high a risk. New BCP teams often get lost in this swamp.

This is actually relatively simple and not rocket science. You don't try to think of all risks, you focus on only your most important business processes and then look for their exposures. Worry about the big alligators. Try the article, "One Percent Solution" at Continuity Planning & Management magazine's web site .

  • It's an unpleasant vision. Thinking about something that may never happen is near impossible and, sometimes, seen as irrelevant and defeatist. This is not how you get points on the corporate scoreboard. No rewards are typically listed on HR's performance ranking sheets for thinking about future problems. More important, your boss is not measured on it.

In the midst of rah-rah promotional programs and the management idea de jour, the "you better watch out" cautionary tales of BPC won't gain popularity.

  • Lack of organizational will. Particularly over extended time. A bedrock requirement for success is sustainability of business continuity planning processes. It is are hard enough to keep at the stuff that's in your face today, much less "might happen". Management trend de jour last less than six months, how can this subject be sustained?

The key is to build it into to the charter of the key organizations and into the reward system the company uses. You tell me how I'll be graded and I'll tell you how I will act.

  • It's new and hasn't found a home. Both DRP and ERP (above) have been around a long time and are traditionally part of some organization's charter. BCP is an orphan and, therefore, without executive sponsorship.

See above. If you don't have an executive sponsor your program is a "no starter". Take a look at the article titled "How to Sell Business Continuity" in the Disaster Recovery Journal's 2001 Spring issue.

  • Hands-on subjects are easier to understand. And more aggressively marketed by the large service consultants. For example, Disaster Recovery Planning for IT processes, for example, is a favorite of Financial auditors. You can go out and just buy a backup package. It's self contained and easier to understand than subtle, cross functional business processes. Same for Emergency Response Planning, which typically lives in Health & Safety departments.

This is a conundrum. You want DRPs and ERPs but you don't want anyone to think they are the answer. Good examples of realistic threats that these don't cover are your best bet for getting the right people's attention. Particularly if you can dollarize the consequences without being hysterical.

  • Crisis management is rewarded. Crisis prevention is often not. This is irrespective of some crisis being enabled by the team's lack of planning. Our gunslinger culture loves heroes, not planners. I've worked with a boss that I'm convinced created crisis because he was so good at dealing with them. A facilities manager once told me that he love emergencies because it was the only time the rest of the organization noticed his team, at least in a positive light.

See above. You're going to be in sales and marketing to succeed in getting the planning process underway. Of all people, the financial auditors may be your best friends. They are professional worriers and often, the only ones crying in the wilderness. Get to know them.

These hurdles can be overcome if you know what to expect and have given some thought to them. Recent terrorists attacks will increase attention to think about the unthinkable. This may bring continuity planning to a point where it is rewarded, maybe.

If predictions of the experts are to be believed, the deadly spiral of attack and reprisal in asymmetrical warfare is likely to escalate,. This will certainly encourage "hardening" of business processes. Failure of marginal companies due to minor crisis will become more visible. Recessionary pressures will increase fears about what can happen.

These are tough times but tough times focus and clarify what's important. Being prepared is indeed a hallmark of business survival and coherent thinking about the future is the only way to get prepared. You can make it happen.

Dan Derby