What is a Business Continuity Plan?

Many years ago, there was a British TV show called “Blackadder”. It starred Rowan Atkinson, more well known for his role as Mr. Bean. He played the title character and found himself in a duel with the Duke of Wellington. The Duke explains to Blackadder that using pistols and swords is old fashioned and no one does that anymore. The Duke then reveals the cannons that he will be using to duel. Blackadder picks up the instructions for the cannon and starts to read. He has barely gotten through the introductory obligatory congratulations message on such a fine purchase when the experienced Duke has already loaded, primed and is about to fire his cannon. This scene is played for comedy but if in real life we are faced with a time sensitive situation, potentially hazardous and unfamiliar, we would love to have a set of instructions on what to do next.

Even in modern day life, how many of us ever review the emergency instructions on a flight or pay attention to the flight attendant giving those instructions? Complacency is the enemy of preparedness. If indeed we were unlucky enough to find ourselves needing to put out a fire using a fire extinguisher or put on a life jacket on a plane, I can imagine a swell of panic trying to hastily react while not being prepared. So how does this tie into a business?

In our world we buy insurance to protect us from a variety of events and allows us to replace objects in the event of loss of destruction. However, it gets more complicated with dealing with a business, which provides a livelihood for our staff, product that people may depend upon, or services that may save lives. We cannot just easily replace lives, prevent injury, rebuild infrastructure, replace lost knowledge or data, or continue the services or product that people may depend upon with just an insurance check. So, ensuring we have a plan of what to do and how to do it to make sure we can survive and effectively continue the business after an event, is important for all the above reasons.

But where do we start? How do we plan and what do you need to put in a plan?

We can answer that simply by understanding what it is we do, and how we do it. The process of doing so is called a business impact analysis. Through this we can figure out the fundamental building blocks or processes that we perform as a business. We analyze what risks could cause these processes to fail and how bad the damage would be. How do measure the damage? Damage can take many forms, but most common are:

Financial
Operational
The perception of the company, or reputation, after the damage
The risk to lives
The legal risks and implications

Measuring scenarios by the risk of occurrence and the damage they will cause helps us to figure out what is most important to our business. Then break it down to:

What do these processes need to work properly?
Who needs to do it? And what if they are unavailable?
What tools/supplies/equipment do they need?
What is the order?
How quickly does it need to be done, and how quickly can it actually be done?

These building blocks serve as a base for us to develop a recovery strategy, or instructions for the person recovering and a list of all the information they might need. What software applications do they depend on? Who is on what team and how can I contact them? (Remember, I might not be in my building or have access to the information I normally have!) And step by step instructions on how to recover. This makes up the main part of the business continuity plan.

Going back to the scene in question from Blackadder. The scene always makes me think how when any of us get a new item of technology that we are unfamiliar with, it normally comes with a set of instructions and a quick reference guide. But how many of us actually read the full instruction manual before using the new piece of equipment? If you are like me, you probably use the quick reference guide. None of us want to sit and read a manual in the event we need to do something quickly. Continuity is time sensitive and the quicker and more succinct we can make our procedures, the more successful they will be, whether you are recovering a complex banking operation or trying to fire a cannon!