3. Don’t put all your eggs in one basket.
You’ve heard this since you were a child but it continues to play out when mitigating business risks. How many times has your organization strived to balance the risks with the cost savings of consolidation? The cost will always be there, it’s just a matter of timing. Pay now by spreading “vital” operations across more than one location or pay it when business is disrupted.
4. When disaster strikes, the first thing to disappear is your plan.
Have you ever seen a disaster response? The one thing you’ve never seen is anyone with their nose in a plan. Adrenalin is a natural reaction to threatening situations, and the human body doesn’t gravitate to reading in these circumstances. Ensure the organization has a “play book” when disaster strikes – a series of options that can be selected based on evolving circumstances.
5. When disaster strikes, competitors notice.
It’s a cruel world. Unless you can maintain your market presence, and reputation, after a disaster your absence can create a vacuum in the market place. This being the case, competitors will fill that vacuum, not entirely out of opportunity but out of necessity.
6. The first time your insurance policy is absolutely crystal clear is after the disaster.
Have you ever had an automobile accident, a homeowner claim, or a medial claim and then afterward learn you weren’t covered for the losses you thought you were? Insurance policies can be complicated documents and there is a reason for that. At some point you will become painfully aware of what’s covered.
7. Your home, life and automobile are insured … that should just about cover it – not.
Though we protect what affects us directly, we don’t take that same precaution when it comes to our economic livelihoods. It’s as if a disaster to the business won’t affect us, but it will. An inability to recover the business can put your entire economic future at risk. Protect your business.
8. The ‘Three Ps’ of disaster planning: People, Property, Priorities (business), and here’s three more: Practice, Practice, Practice
The first “Three Ps” sum it up. Protect your people first (see 10), protect your property because that’s where your business occurs, and then focus on your business priorities. By following this model, you’ll be sure to protect what matters most.
Practice is the only way any of us get better at anything we do. If you are not practicing your plan every chance you get then don’t expect a smooth response when disaster strikes. All professional sports teams start their seasons with an extensive pre-season – a practice period designed to bring the best players to the field when it matters most. Business continuity is no different.
9. Tailor your business continuity investments to likely threats and key priorities.
This may seem obvious but once a BC program gets started it can drift and swerve past the things that really need to be protected. Make sure that everything you protect has measured business value and an understanding of threat exposure. Enterprise priorities should be set or outlined at the executive level. For example, the company may be planning on closing facilities, relocating workers, introducing new products and services, acquiring other companies, discontinuing products, expanding into new geographies, etc. Having this information upfront can minimize waste in the BIA process.
10. Protect your people first, because if something goes wrong everything else can be replaced.
Have you ever heard interviews from people just impacted by a tornado, flood, or other disaster? Nine out of 10 times you hear the same thing. “We’re just glad to be alive, everything else can be replaced.” It’s no different when it comes to your business protection planning efforts. The loss of an employee will stay with you for the rest of your life – if it wasn’t your life that was lost.
11. Recovery is like a recipe: everything has to come together at the right time and in a useable form.
Like baking a perfect cake, it’s a process of blending ingredients at the right time and following the proper steps. Like all desired outcomes, business recovery is no different. It doesn’t help to have backup data with nowhere to restore it, or have a place to restore it but no way to connect to it, or to have everything you thought you needed to find that little pinch of salt isn’t there. For example, a company has a dedicated recovery center but it takes two weeks to pick, pull, pack, ship and re-stage the 30,000 tapes needed for recovery. See the disconnect?
12. If leaders plan on calling the plays when disaster strikes – and they will – get them to set priorities before disaster strikes.
The most difficult thing to sort out in the heat of battle is determining what is broken, what the priorities are, and what the recovery options are. Make sure leaders know what is priority before the disaster and why it’s a priority. Leaders will often change priorities in a disaster based more on the last phone call than on an integrated approach to business recovery. Make sure a triage process is established in the command center that can confirm the impact of disaster on the business (see 13).
13. If leaders haven’t been part of the planning process then don’t expect them to follow the plan.
Recovery planning – the detailed stuff – takes place at the front line of the organization. But when disaster strikes, leaders step in and run the recovery effort. When disaster strikes, managers feel responsible for recovering. In some ways it’s what makes them want to be managers. If your managers aren’t involved in the recovery planning process or aren’t tightly integrated into the initial response to disasters, you might as well throw the plan in the trash. It will be too late once you smell smoke.
14. Your employees’ first priority is their families.
Most response plans assume everyone will come to the rescue. In situations where regional disasters are likely (e.g., hurricane, earthquake, flood, etc.), add a minimum of 24 hours to your business recovery time. People first ensure their families are safe and secure and then they can focus on the business. Work to ensure that your plan can aid employee families when disaster strikes. Nothing cements the bond between employee and employer than sensitivity and aid during times of adversity.
15. Employees will do extraordinary things to help recover, but be prepared to provide direction.
As in 14, once employees are sure that their families are safe, they often do extraordinary things to help the business. Stories from the World Trade Center disaster have one thing in common – once the personal impact was understood, people rose to an extraordinary challenge to save their businesses. It’s in our nature to rise to these challenges. The biggest challenge in business recovery efforts is channeling and directing this enormous wave of human energy. Make sure that your plan is prepared for what people are willing to do.
16. Disasters have a way of sorting out your friends.
You’ve been in a bind in the past and you know whom you can count on. Make sure those relationships are nurtured.
17. Regional disasters have a way of mandating priorities you weren’t even aware of.
You would be surprised at the assumptions that people put in their plans when it comes to the role of local emergency response organizations during emergency response. When the fire department shows up, or the police for that matter, you are no longer in control. Make sure that you meet these people before you have disaster, this way there won’t be any hurt feelings later.
18. Recovery planning software manages your plan data, it won’t plan for you.
Ah, the magic bullet. A piece of software that will direct everyone through the process of creating a plan. Don’t get me wrong, I think there is a role that recovery planning software can play in managing a lot of data and integrating recovery plans but you need to understand what it won’t do. It won’t pick your recovery strategy, it won’t mitigate your threats, and it won’t replace the human side of business recovery. Plug the software in at the right time in the recovery planning process.
19. The title says ‘20 Truths.’ Never believe what you read, particularly in a disaster recovery plan.
Always expect proof.
Gerard Minnich is a Master Business Continuity Professional. He has a degree in emergency administration and planning from the University of North Texas and works as a consulting business continuity program manager for Electronic Data Systems in Plano, Texas.
