The longevity of your financial institution, as well as the livelihoods and safety of you and your employees, isn’t something to be left to chance. According to a recent study, 90 percent of companies who experience a disaster will fail within a year, unless they’re able to resume operations within five business days of a disaster. A disaster doesn’t have to be a hurricane, earthquake, or tornado. Often, it’s something as simple as a burst pipe, small fire, or even a utility outage.
In order to save the business you have worked so hard to build, it is critical to plan for the unlikely events. The first decision is the one you make on planning to stay in business. Start with the basics and keep it simple. Look at how your company functions and which of those functions it cannot do without. Identify potential disasters and plan for the impact and duration of the event, so that your plans will work in any scenario. The duration of the event will affect which portions of the plans you activate. For instance, a pipe burst in your building may only shut you down for days or weeks, while a complete loss of your building, such as a fire, can potentially shut you down long term. How and where will you get your employees back to work if your building is inaccessible or no longer there? When developing these plans, you need to talk to your employees about the organization’s recovery planning process, so that everyone is aware and involved in how they will participate in protecting the company and their jobs.
Planning Your Testing Process
Testing is the crux of keeping your plan up to date and increasing the resiliency of your institution. Yet, the fact remains that the majority of businesses have never tested their recovery plan. How can you be secure in your organization’s ability to function as expected during an actual crisis without first putting it to the test? Did you test at your recovery site? How did it go?
Perhaps the word “test” attaches a “pass/fail” criterion and should instead be looked at as more of a practice or drill. Most businesses who actively test their recovery plans will tell you that there is no such thing as a “failed” test, unless you fail to enact upon the deficiencies discovered during the test. These exercises are designed to bring certain realities to the surface that may not have been thought about without going through a dry-run.
Your test process should start with the creation of a recovery testing team and then determine what you would like to test and against what type of situation.
Consider phasing your experimentation:
- Phase I: Test server and communications recovery
- Phase II: Test customer service and internal process recovery
- Phase III: Test recovery of complete facility loss, such as power and location
- Determine priorities and objectives among on-site and off-site staff
- Determine realistic recovery time objectives (RTO)
- Build outcomes of your continuity plan
- Challenge all aspects of your recovery operation
- Evaluate how much generator power is needed to transition seamlessly from land power to generator power and back again
- Conduct off-site server restoration and reconstruction and measure against your RTO
- Establish workspace and workflow of your recovery site
- Improve cross-departmental and partner communication
- Confirm connectivity to your recovery network
- Simulation of real-time business transactions
- Improve upon areas that do not meet the RTO and business objectives
Testing may seem to be a monumental task, but we encourage you to test annually, ensuring your plan stays current, well documented, and effective. With staff dedicated solely to assisting members with these needs, we are constantly striving for ways to encourage businesses to test their continuity initiatives. Testing should be a vital component of your continuity plan, not an afterthought.
When developing your plan, remember these words from President Dwight D. Eisenhower, “In preparing for battle I have always found that plans are useless, but planning is indispensable.”
Exercising your plan and involving staff in the planning process will ensure you leave as little to chance as possible.
Gregory R. Tellone, chief operating officer at Continuity Centers, is a well-known entrepreneur, speaker, and disaster recovery expert in the New York area, whose illustrious career spans more than 20 years in the business continuity and disaster recovery (BCDR) field.