- by Edith Burns, MBCP

The Business Continuity industry has changed since I wrote my first article on Business Resumption Planning. The title of the article, “Surviving A Disaster Takes a Plan, Not a Miracle!” (Disaster Recovery Journal, Vol. 7, Issue 3 1994). Business Continuity was still a new concept, since most planning was limited to recovery of the data center. Advances in technology and changes in the way business is done, has spun the growth of this industry and planning has expanded to cover the entire organization.
In the aftermath of Y2K activities, and the emerging of e-commerce for business processes, we have been overwhelmed with new products, changing concepts and new terminology. The terms Business Resumption and Business Continuity were often used interchangeably. Our planning detailed how and where the critical business processes would continue operations after a major disruption. The concept meant resuming business operations within a pre-defined time period. This could include manual workarounds or an alternate processing procedure. Business Continuation (new terminology) is quickly developing into a planning concept to meet the requirement for shorter recovery times. Understanding what is being provided and how to incorporate the concept into your planning will be important in the success of your overall program.
To define the concepts, Business Continuity Planning vis-a-vis Business Continuation I have used the process of insuring your personal property as an analogy. A Business Continuity Plan is like an insurance policy. Most businesses will recover from a disaster, but they may not recover in time to survive, without a plan. Businesses can mitigate known risk, purchase business interruption insurance (which covers only expenses directly related to a disruption) and insure specific high dollar resources. All are recommended steps in the planning. Mitigate the risk, buy insurance that will provide the money to replace damaged resources, but there is still a void. Insurance will not protect your market share, customer confidence, or your reputation if critical business operations cannot be restored quickly. The Business Continuity plan gives an organization the ability to maintain business continuity or to regain it in a timely manner, and that ability is an asset that the plan protects (insures).
Business Continuation, in this context, implies 100% availability for business processes. To achieve this, duplication in some form is required for both the systems that support critical processes and the business unit . The requirement for some critical processes may be 100% availability, but that’s the exception. As defined above, the Business Continuity Plan is insurance, and with insurance there is what I call “The Acceptable Deductible”. The critical business processes that cannot be out for any period of time will require duplication or “full coverage”. In reality, the majority of critical business processes can carry “The Acceptable Deductible”. Few organizations could afford to stay in business if all business processes required 100% availability. This is the same reasoning used by the average person when purchasing insurance. We may insure some high-risk items under a no-risk policy, but the greater part of our personal property is insured with “The Acceptable Deductible”. Business Continuation Planning is for the high risk, “no outage” critical business processes on which the organization’s survivability depend. Business Continuity Planning is insurance with “The Acceptable Deductible”: allowing an organization to maintain business continuity or to regain it in a timely manner and survive.
Business Continuity Planning is a methodology used to develop detailed plans that will minimize the decisions to be made at the time of the disruption. The plan includes the emergency response process and procedures, the damage assessment process, external and internal communication procedures and detailed resumption procedures for each major entity across the organization. The plan identifies recovery locations, team members and their alternates. Human resource considerations are also included. Since it is impossible to address every possible disruption, a well documented integrated corporate plan can be used to develop actions plans to meet each situation.
Business Continuity Planning provides some flexibility in strategies and investment decisions and the cost is considerably less than the costs associated with Business Continuation. Additionally, major cost avoidance could be an added benefit. Under the Business Continuation concept, the cost for continuous operation is incurred up front, even if a disruption never affects the operation. In Business Continuity Planning, pre-identified work arounds, manual processes or routine troubleshooting during the resumption window, could keep the business process limping, but operational. It is also feasible that the situation may not develop into the major disruption as predicted, thus avoiding the high cost of declaring a disaster and activating the plans. Business Continuity Planning is the insurance with “The Acceptable Deductible”. The organization carries a certain amount of risk, the risk is the interruption of the services and products you provide, “The Acceptable Deductible”.
As Business Continuity Planners, our goal is to limit the financial impact that a major disruption could have on an organization. As the industry continues to evolve, so will planning concepts and the responsibilities that goes along with our jobs. It is important as a Business Continuity Planner to find alternatives to meet business requirements while avoiding the risks of creating a financial impact with the solutions. Continuous operation is not achieved by providing 100% system availability, the business units will also have to be operational. The need for continuous operations as a viable solution will require careful planning.

Edith Burns, MBCP, is a Business Continuity Planner for Information Systems at United Services Automobile Association (USAA), in San Antonio, Texas. She has been in the field of Business Continuity Planning since 1990, and has earned the professional designation of Master Business Continuity Professional. Ms. Burns currently serves as a member on the DRI International Certification Board.

«BACK to the Articles Index