10 Items which should be in a BCP (and are often forgotten!)

What should a business continuity plan contain? It's important to keep it concise and manageable, but I'm sure we all have our own ideas as to what the 'must have' items are. Charlie Maclean-Bristol of PlanB Consulting takes us through what he thinks the top ten features of a good plan are:

1. Scope. On many of the plans I see it is not clear what the scope of the plan is. The name of the department may be on the front of the plan but it is not always obvious whether this is the whole of the department, which may cover many sites, or just the department based in one location. It should also be clear within strategic and tactical plans what part of the organisation the plan covers. Or does it cover the whole of the organisation? Where large organisations have several entities and subsidiaries it should be clear whether the tactical and strategic plans cover these.

2. Invocation criteria. I believe it should be fairly clear what sort of incidents should cause the business continuity plan to be invoked. I also believe that this invocation criteria should be “SMART”, so as not to be open to interpretation. The criteria should be easy to understand so if you get a call at 3am in the morning and informed of an incident it should be fairly obvious whether you invoke or not. Focus should be on the loss of an asset such as a building or an IT system, not on the cause of the loss. There needs to be a ‘catch-all’ in the invocations criteria which says 'and anything else which could have a major impact on our operations’ so that the criteria is not too rigid if we need to invoke for an incident we have not yet thought of.

3. RTOs. Defining and agreeing your Recovery Time Objectives is one of the most important items you set during the analysis and design stages of the business continuity lifecycle. There should be a list of RTOs relevant to your plans within the document so you can make sure that you are going to recover your operations at an agreed time.

4. Strategy. I have looked at lots of plans which have lots of detail within them but having read them I am no wiser to the organisation’s recovery strategy or even whether they have one at all. I like my plans to have a written strategy which tells the story of how we are going to recover, containing details of outline activities, locations and timescales. Then it is clear to anyone implementing the plan what your recovery strategy is and how it will be implemented.

5. Information from the BIA. I have seen lots of organisations which do very detailed BIAs and collect lots of information. This information, which could all usefully be used in the recovery, does not make it into the plan. It looks as if two separate activities have been carried out - the BIA and the plans - yet there is no visible connection between the information collected in one and the information in the other. If you cannot use the information in the plan then why collect it in the BIA stage at all? There should be a clear relationship between the information collected in the BIA stage and the information within the plan.

6. Items not needed on the day. Many plans I see are a cross between a plan containing information needed on the day of the incident and policy information. During an incident you do not need information on how often the plan needs to be exercised or the responsibilities of the Business Continuity Manager. My suggestion is to go back through your plan and move to a separate document any information which you do not need on the day of an incident.

7. Telephone numbers. I think telephone numbers should not be contained within the plan. You may wonder how that can be so, as surely you need the numbers to communicate with your key interested parties. Having telephone numbers available are important but I think it should be a last resort to put them within the plans. As soon as you put numbers within a plan you create a monster, which needs to be constantly fed. Every time a number changes you have to change the number in the plan and then send out the amendment to all those who hold a copy of the plan. This creates a huge administrative task, if you give out copies of the plan in hard copy this kills loads of trees, as you will have to reprint a number of copies of the plan. If you just send out the relevant section or page of the plan what you end up is an unamended plan stuffed full of amendments.

If possible, make use of existing lists within your organisation. There are people whose responsibility it is to update telephone lists. The CEO’s PA may keep all the senior management team’s details up to date on a laminated card and send the card out to all executives. Get yourself on this distribution list for the card and instantly you have a list of the telephone number of all senior managers. If HR keeps a list of all home telephone number and mobiles ask for the list to be made available to the incident team on the day of the incident. Often people are happy to give HR their details but may be reluctant to give the details to anyone else in the organisation. My suggestion is to, wherever possible, avoid putting the telephone number in a plan and try and make use of existing lists which are maintained by others.

8. Your plan should have a logical sequence. Too often plans have lots of good information but it is difficult to find. Perhaps on the first page of the plan you could have an immediate action list rather than have pages of background information, scope objectives and quality assurance information. These are all important and should be in the document but why not put them at the end so they can be referred to only if necessary.

9. Details of the medium to long term recovery. Many plans only concern themselves with the short term recovery and the immediate actions to be carried out after an incident. They go into great detail of how the first 10 members of the call centre will get to the work area recovery centre within the RTO of 24 hours. What the plan does not mention is the strategy for recovery of the 90 other members of the call centre who need to be recovered within one week. Yes there can be some hot planning on the day but I believe there should be some detail within the plan of how to recover the “second wave” of staff to be recovered.

10. A team to manage the incident. Often at the operational level a plan contains lots of good information on the recovery of the department but does not contain any information on who will manage the recovery. Will their representative on the Tactical Team manage the recovery or will it be the departmental managers who will get together and implement the plan? The Good Practice Guidelines 2013 says that every recovery plan should have a team to manage it.

Charlie Maclean-Bristol is a Director at PlanB Consulting in Scotland.

The professional footpath for business continuity practitioners

As Business Continuity continues its growth as a profession, the idea of certification and the membership of professional bodies are more frequently discussed at all levels of the organization – from those starting out their career in the industry, right up to the Board Room.

As an individual you will be looking at the long term development of your career while those at Board level need to consider the long term growth of the organization. Of course the two of these are not mutually exclusive and many managers will tell you that the best way to grow an organization is to invest in its people.

The first step on the professional ladder is certification. Certification gives you an outward facing verification of your knowledge in that discipline. Attaining this level of qualification will set you apart from those who are not certified, who would only have knowledge of BC in their current environment.

Once you have become certified and embarked on your career in business continuity you need to think about what your next steps will be.

Like with any good BC Plan, you wouldn’t just write it and place it on a shelf to gather dust. It is a continual process of planning, learning, assessing and adapting to ensure that the plan is effective and can be relied upon. The professional development of anyone working in the BC industry is no different. You don’t take your newly earned certificate and hang it on a wall only to forget all that you have learned. You would, or at least you should, continue to develop yourself as a professional by testing your skills and adapting your skillset to suit the needs of the job.

Mentoring allows those who are new to the profession to be guided along the early stages of their career and offer great scope for improving their knowledge, understanding and the practical application of good practice.

For those at any stage of their career, Continuous Professional Development provides an opportunity to reflect on their academic and professional experiences to see how they can apply what they have learned to their own work. Where certification tests your base knowledge of a set subject matter, CPD requires a detailed demonstration of this knowledge and evidence of its implementation.

Increasingly employers are asking for evidence of professional development when employing people to work on their BC programme, so to find out how you can take advantage of the opportunities available, develop your skills and progress your career, visit the BCI website. With Education Month coming up in September, it is the perfect opportunity to do so.

Preparing for the Commonwealth Games

Two years on from the London 2012 Olympic Games, the UK is set to play host yet again to one of the largest sporting events in the world – the Commonwealth Games, hosted by the city of Glasgow in Scotland. Glasgow 2014 may not quite be on the same scale as London 2012, but the crowds will still be high.

On the 23rd July, and over the following two weeks, 6,500 athletes from 71 different countries will be taking part in 17 different sports for the right to win a gold medal. 2,500 journalists will be attending the events and with more than a million tickets sold, the number of additional visitors to Glasgow is expected to exceed 100,000.

So what does all this mean for business continuity planners? For many organizations events like this are a dream come true. Investment in the city in order to rebuild infrastructure over the past few years has been high with many local firms reaping the benefit. During the Games, retail outlets will do a roaring trade as the visitors spend their money on souvenirs, food, drink and, seeing as it’s the west coast of Scotland, probably a few umbrellas and rain coats.

For some organizations however, whether getting into the spirit of the Games or not, there will possibly be some disruption during the two weeks.

If you’re an employer then it’s highly likely that a few of your staff will want to attend some of the events or take leave during what is normally the holiday period. Have you taken this into consideration and made suitable arrangements?

Transport networks will be stretched to the limit as trains and roads become busier than normal. Have you made suitable arrangements to ensure your staff can get to work or perhaps work from home instead? If you work in the transport industry, are your customers or suppliers aware that there might be some delays? For such high profile events, security is always an issue and this can slow things down even further.

If you’re a retailer then the increase in visitor numbers means your stock may go quickly (that’s a good thing) but how quickly can you replace it in order to take an even greater advantage of the circumstances? With international events such as the Commonwealth Games, language can often be a barrier. English may be the common language for many of the countries competing, but there will be many other languages spoken too, do you have the ability to communicate with non-English speakers?

Let’s not forget the extra strain that will be placed on the communications network, do you rely on your mobile phone, and can you guarantee it will work when so many other people are trying to use theirs? There may be a similar issue with broadband if the network starts to reach capacity.

Of course, with all the excitement about the influx of new customers, businesses mustn’t forget their existing customers, those people who will (hopefully!) still be there long after the Games are over. Do they know what your arrangements are during the Games and have you considered ways to reduce the disruption to them?

A major event such as the Commonwealth Games brings plenty of opportunities to the host city and the surrounding area, but everything comes at a cost. If you prepare properly however, and consider what disruptions could affect your organization, then plans can easily be put in place to ensure that this cost is not high and is far outweighed by the positives.

Andrew Scott is the Senior Communications Manager at the Business Continuity Institute who joined after a brief stint working as the Press Officer for a national health charity. Prior to that he had over ten years at the Ministry of Defence working in a number of roles including communications and business continuity. During this time he also completed a Masters in Public Relations at the University of Stirling.

Practice makes perfect

I used to do the Telegraph crossword years ago, after my mother-in-law got me into it (one of the two things for which she is to be applauded – the other being her daughter, obviously). Whilst I wouldn’t claim to be an expert, I did go from not having the faintest idea what most of the clues meant to the point where I managed to finish it more often than not. But for one reason or another I stopped doing it and, until recently, I hadn’t had a go for donkey’s years.

When I started doing it again, I have to admit that I was absolutely useless, sometimes struggling to do more than half a dozen clues. The thing is, there’s a knack to doing crosswords and if you get out of the habit it can take a while to get that knack back again. Anyway, I persevered and, slowly but surely it’s coming back to me.

There are three things that have helped enormously:

Firstly, practice – seven crosswords a week provides an opportunity for lots of practice. Sadly I don’t have time to do it every day, but I usually manage two or three a week.

Secondly, I came across a website called 'Big Dave’s Crossword Blog' which gives the answers. More importantly though, it explains how those answers are arrived at. So for the clues I’ve struggled with (and sometimes there are lots), rather than just giving it up as a bad job, I have a quick look on Big Dave’s site and find out what they were on about.

And thirdly, I’ve put together my own little guide, which includes things like what certain words or phrases in a clue might mean, and what words might be anagram or 'sounds like' indicators or such like. I refer to it when I’m a bit stuck and it often nudges me in the right direction. (Let me know if you’d like a copy).

I still don’t finish the crossword every day (there are some really obscure clues from time to time that you’d have to be Einstein or Stephen Fry to stand a chance of solving), but I don’t do too badly now. I still have to think quite hard about things, but the basics are becoming ingrained and now when I pick up the crossword, I slip reasonably easily into the right way of thinking. I’ve progressed from seldom completing it, through occasionally to fairly regularly, and now I’m setting my sites on the dizzy heights of usually.

The point is that crosswords, as with many things in life – like juggling or playing a musical instrument or crisis management or business or IT recovery for instance – take practice if you want to be any good at them. And for most people, the more practice they get, the more proficient they become. Or to put it another way, the less you practice, the less proficient you’ll be.

So if we want our crisis management or recovery teams to be proficient and effective, we need to make sure they’re up to the job, adequately trained and get sufficient practice to keep them on top form.

Andy Osborne is the Consultancy Director at Acumen, and author of Practical Business Continuity Management. You can follow him on Twitter and his blog or link up with him on Linked In.

Football World Cup: a disruptive influence or an opportunity?

The long wait is nearly over. On the 12th June Brazil take on Croatia at the Arena de Sao Paulo in Brazil to officially kick start one of the biggest, if not the biggest, sporting event in the world – the football World Cup. Over the course of 31 days, 32 countries will battle it out in 64 games for the right to be crowned world champions.

So what does this mean for business continuity planners? Well clearly the level of disruption in Brazil is a major issue but this blog isn’t about that. It’s not about the many years of disruption caused by construction projects and the rebuilding of infrastructure. Neither is it about the disruption caused by having over half a million visitors descending on the twelve host cities. This blog is more about the disruption caused by, for most people, the antisocial timings of the matches.

When we watch our own football teams (or attend any other entertainment event), it is very often at a time that is accommodating – weekends or evenings perhaps. With large international tournaments this is rarely the case. Take England's three group fixtures for example – 11pm (expect some employees to be very sleepy the next day), 5pm (expect some employees to want to leave work early) and 8pm (okay that’s more like it). This is a problem that most of the European and African countries will have. Kick off times are even more unsociable if you’re from Iran, Japan, South Korea or Australia.

In England’s case the last two World Cups (South Africa and Germany) didn’t cause any problems as the time zones were only a couple of hours away, but the 2002 World Cup in Japan and South Korea did throw up issues with some games kicking off at 9am. Many employers chose to allow their staff to turn up a few hours late, some chose to install televisions in the office. Productivity may not have been at its highest but arguably this was a better solution than having people call in sick or just not showing up.

The timings of the games may not allow for the same solutions this time but employers still need to think about what their options are. Will their staff want to watch the games? What are the consequences of them doing so? Finally, the all-important question, what can be done to make sure this doesn't disrupt the organization?

Consider also how the World cup will impact on your organization. Will you be quieter as many of your customers will be watching the game, or will you be busier as many of your customers are the sort of people who have no interest in football and are desperate to avoid the football-mania taking place?

Of course you do not have to embrace the World Cup and you could insist that your staff are at work when they normally should be. In all likelihood this will lead to reduced morale and this will in turn reduce the overall level of productivity or service given to customers.

The World Cup is a massive event that for many countries will dictate the mood of the nation over the month that it takes place – organizations should make the most of this. Rather than thinking of it as a disruptive experience, think of it as an opportunity to enhance staff morale by allowing employees, where possible, the flexibility to watch games.

If you are allowing staff time off to watch any of the games, make it fair on all employees by creating a rota so work can still be done. You need to make sure it is fair to those who have no interest in football as they will not appreciate having all the work dumped on them.

Andrew Scott is the Senior Communications Manager at the Business Continuity Institute who joined after a brief stint working as the Press Officer for a national health charity. Prior to that he had over ten years at the Ministry of Defence working in a number of roles including communications and business continuity. During this time he also completed a Masters in Public Relations at the University of Stirling.