Recovery Strategies

Ian Charters
Continuity Systems Ltd

It is a pity that the term ‘recovery strategy’ was ever coined. It gives the impression that an organisation has one high level recovery strategy which will provide a response to all BC issues and around which all recovery plans and procedures will be based. For example – “in the event a disruption the organisation will move priority staff to operate from its recovery centre at...” which is seen as a solution to all problems.

Instead the ‘recovery strategy’ of an organisation is likely to be a whole raft of measures put in place before an incident occurs that will, hopefully, give it some workable options for response when an incident occurs whatever the circumstances.

'Recovery strategy’ is also used to describe an approach to disruption management – such as subcontracting delivery, withdrawing the product or internal recovery. It can also be used to describe approaches within the organisation such as ensuring the delivery capacity is always available at more than one site – so it can easily be transferred.
 
Perhaps the term ‘recovery options’ is a better description ; a comprehensive set of recovery options needs to cover all the resources required to undertake activities. Therefore it is going to include measures to provide:

• Alternative staff: Through cross training and documentation
• Alternative premises: Making duplicate or standby locations available
• Alternative technology; Back-up IT facilities or alternative sources of equipment
• Alternative supplies: By sourcing from more than one supplier or maintaining stocks of materials

It may also include measures to reduce the damage an incident may cause such as insurance, salvage and a reputation management plan.

Lastly you could include in the recovery strategy portfolio a number of measures that are not about ‘recovery’ but may reduce the likelihood or impact of a disruption affecting the most urgent activities – such as scheduled maintenance, monitoring systems, generators etc.

Therefore when an incident occurs there may be a number of options available to manage the disruption and the choice of which depends on the circumstances. For example, if there is widespread flooding but your building is operational, do you want to relocate your business and staff elsewhere or stay put as this is less disruptive to your staff’s home lives – or do you do some of both? This clearly identifies the need for a tactical level response team who can identify the available options following the disruption and select the optimal one.

The main parameter that will identify what responses need to be available, and which will be used in the response, is time. Each product, each process and each activity should have a documented ‘Recovery Time Objective’ (RTO) set less than the Maximum Period of Disruption (point of no return) identified in the Business Impact Analysis. The RTO is set at the estimated optimum point that balances the damage that may be done before it is recovered (as this will increase with time), against the ongoing costs of maintaining the capability to achieve it (which usually decreases with time).

So recovery strategies are a complex ‘kit bag’ of possible responses – not a single strategy.  As such senior management as well as those involved at the tactical response level should be familiar with all the options. A manual describing these options and how they can be used should be written and be required reading. It can also prove a useful ‘sales’ document to show (redacted) to potential customers or insurers when they asked to see your ‘BC plan’ – as the individual recovery plans may mean very little without a context of the overall recovery strategy. It may well begin “If we experience an incident then this is what we do...”

Ian will be discussing this and the issue of design within the 'BCM Lifecycle' stream at the BCM World Conference on Thursday 7th November, starting at 10:35.