We recently completed a business continuity refresher project for a large London-based customer, and were reminded how easily a well-made plan can fall into disuse and disrepair.
It was particularly interesting picking up the residue of previous Business Impact Assessments and plan-writing exercises, in paper and electronic format. Some parts were really well done. There had been hundreds of hours and many meetings spent producing these plans, which were expertly crafted, authoritative and beautifully produced in files at least 5cm thick (2″ in old money).
The problem was what to do with this excellent material? Unfortunately we followed on from two-and-a-half previous business continuity projects, each with subtly different perspectives, which had not been well aligned. It turned out that parts of each were still in circulation! There was extremely mixed knowledge of the alternative plans among the people on the ground. That’s not particularly unusual, of course. Well…a bit worse than usual which is why I’ve picked it out as a cautionary tale.
With the miracle of modern Optical Character Recognition techniques it was really easy to scan the paper documents and get them into Word: a massive time-saver. We harvested and re-used as much of the plans as we could. The pain came from having to let go of the old stuff, but it was always destined for the shredder. Who knows whether we succeeded in hunting down and disposing of all the old copies? Hard to say.
Of course the real lesson of this exercise was obvious: the embedding and training process had flaked out. The effort which had previously gone into analysis, strategy and document production had not been matched by the training, exercising and testing. The people who had the plans on their shelves hadn’t read them for a long time, if at all.
The other lesson was how badly can document distribution go wrong!
The upshot was that the organisation wasn’t especially prepared for an incident or crisis which fell outside of the normal envelope. Business continuity in practice was falling back to normal operational processes, call-outs and ad hoc management escalation.
This is of course very common. Atrophy over time is one of the hardest problems to combat. Making business continuity “normal” too often hinges around an annual exercise (no knocking that!) but nothing else in-between.
One of the key aspects we introduced in the project was a Business Continuity Management System, designed so there is an auditable process for embedding and maintaining business continuity properly throughout the organisation. There is still quite a lot of effort to implement it and make it work, but it was one of the clearest cases I’ve seen recently of some of the problem consequences which can arise without it.