In many cases, projects are well under way before the business continuity staff is aware of them. This may be because in a large organization it is difficult to find out if a new project has been started, or the project leader fails to notify the BC staff, or the BC staff is spread very thin. Whatever the reason, new projects, particularly small ones, can go live without the business continuity staff being aware of them. The BC staff might become aware of the new project when a disaster strikes and the users are clamoring for recovery.
The organization can benefit when the business continuity staff is brought into the project process as early as possible. The BC people can:
- Start assessing risks. For example, if the business is planning to build a new facility, the BC staff can look for possible natural threats such as floods or tornadoes, or check with the local police to see if the facility is in a high crime area.
- Start implementing controls to reduce the possibility of a disaster, or mitigate its impact.
- Start reviewing and updating the plans, saving time and effort later.
- Assess the impact of the new project on the rest of the organization’s ability to recover. Will extra resources be required to recover the results of this project – resources that might be used to recover other functions?
- Assess the impact of the project on the emergency response or crisis management functions.
This article offers some suggestions on how business continuity should be involved in new projects, and offers suggestions on gathering information about new projects that enable business continuity planners to assess the impact of the new project.
New projects generally go through five basic phases – planning, requirements, design, test, and implementation. Other project management models may use different names, have more phases, or they may sub-divide these stages. I suggest five phases is sufficient for this discussion. The design and test phases might be combined, given the interative nature of some projects (build, test, revise, based on test results … test again).
What should business continuity’s involvement be in these different phases? Business continuity needs to be aware of the project, the changes it is introducing, and the needs to get started on updating plans, planning exercises, and possibly updating emergency response and/or crisis management procedures. The following table suggests business continuity activities that should be carried out during the different phases.
The above business continuity actions might be carried out by the business continuity planning staff, business partners who support the plans, or a coalition of the two. It depends on how business continuity is implemented in your organization.
How can business continuity be aware of, and become involved in, new projects? If there is strong commitment to business continuity from senior management, the executives can issue directives that business continuity be notified of all new projects. Of course, this will not catch all new projects. A better method is for the business continuity staff to establish and nurture contacts with managers and others across the organization. To be effective, the business continuity staff should be doing this already.
What kinds of information does the BC staff need to assess the impact of the project? Basically, they must determine if the business functions added or impacted by this project are recoverable. Find out if new or changed technologies will impact existing recovery plans or need new recovery plans.
The BC staff should also try to make their fact-finding as painless as possible for the project team. The form on the right may help the BC staff gather the information they need to assess the project’s impact.
How should the BC staff use this information? There are many possibilities. For example, a major project could mean that business continuity should devote significant resources to it. Changes to RTOs might imply change to recovery strategies and technologies. A project that will be visible to customers could mean that the public information and crisis management responses will be critical so customers can be reassured. A project involving organizational changes may mean that call trees, contact lists, and contact information will change. It could also mean new players on the business and technology sides will have to be trained and become familiar with the business continuity plans.
Projects that will result in new equipment may have implications for relocation sites? New or changed upstream or downstream dependencies could mean changes to RTOs and/or contact lists. New technology could mean substantial changes at relocation sites, network, traffic and to any high availability solutions.
Early involvement in projects can help an organization be better prepared to deal with disasters, and can save a great deal of valuable business continuity time.
Chris Rohrs, CBCP, is a business continuity coordinator and project manager. He has more than seven years of experience in business continuity and more than 20 years of experience as a technical project management/team leader. Rohrs lives in Wilwaukee, Wisc., and can be reached at firstname.lastname@example.org.