Business Continuity - is it a
waste of time?
Frank P Aue, General Manager, Enterprise Data Corporation
Margins are tight, business is slow and customers are demanding more and more.
Sounds familiar? Time is money, so why spend money on something that hopefully
you will never use such as a Business Continuity Plan (BCP)?
Most potential situations are not as dramatic as September 11, but what
September 11 did was highlight that the improbable is probable. Just ask anyone
who has ever been involved in a fire or some other disaster, "Could it have
happened?" Well the answer before the disaster was probably, "No, not to me!"
Disasters are not isolated to just the other person or the other company.
Disasters are non-selective.
Risk versus Consequence
Planning for business continuity means looking at the risk and weighing up what
resources you cannot do without and what the consequence is if those resources
are not available. For example, how can you get access to that data or
computing power or to those employees, furniture or other facilities should
something happen?
For some organisations, a detailed BCP may not be required. What will dictate
the degree of planning required, is the risk profile. Risk is defined as risk =
likelihood x consequences, and the interaction between likelihood and
consequence is shown in the following diagram.

If there is a low likelihood of disaster and low consequences for the business
if a disaster occurs, then the business is bullet proof and you probably don't
need to consider Business Continuity. This is the type of business that you can
walk away from if a disaster occurs.
If the likelihood is low to the business and the consequences high, then you
probably need to consider Business Continuity.
If the likelihood is high but with a low consequence, then again you probably
will need to consider planning for Business Continuity.
If however the likelihood is high and the consequences for the business high,
then developing a BCP is non-negotiable; it's a must-have.
It's commercially astute to accept some level of risk. There will be a point
however where the risk profile is such that it is unreasonable and uneconomic
to accept it. At this point organisations often take out insurance to spread
the risk, i.e. to lessen the financial consequence. Conversely, it's
unacceptable commercially to develop a million dollar Business Continuity
strategy in order to protect a revenue stream of a few thousand dollars.
Key to a successful BCP strategy is identifying what the acceptable level of
risk is. There is no such thing as zero risk.
IT or more?
IT has a business supporting function, and BCP should be considered part of the
whole organisational strategy. The recovery of IT alone will not ensure other
business functions operate, therefore it's essential to consider IT as part of
the total organisation and develop a BCP accordingly.
It's likely that the IT department is already well disciplined in terms of
backups for data, documentation and after hours contact procedures. Utilise
this knowledge base when developing the organisation-wide BCP.
Suppliers
Ask your key suppliers (including your Telecommunication supplier) about their
Business Continuity strategy. The questions asked will be the same ones you
have asked your own organisation. What scenarios have they planned for? What is
their fallback position? In line with their responses, you should work out how
long your organisation can operate without the key supplier. What will the
affect be if you don't have supply from them for one day, one week, one month?
What strategies do you have in place to select another supplier if you need to
replace your key one?
Conclusion
So, is Business Continuity a waste of time?
For some organisations in low-risk, low-likelihood environments, the answer may
well be yes. In reality however, not many organisations can claim to be as
fortunate as existing in this type of environment. September 11 has proved that
the inconceivable is now conceivable. Without BCP, it's certain that a lot of
time and resources will be wasted trying to work out what needs to be done
after the disaster with a greater degree of failure. It may be more apt to say,
not having considered and evaluated your business for BCP is instead a waste of
time.
return to top
|