Business Continuity Failure: What Are the Consequences?

When the unexpected strikes, businesses need to take action fast. Take these steps to build a business continuity plan and be prepared for anything.

When it comes to classic disaster recovery planning, organizations may need to redefine what this really means to the actual day-to-day running of the business - when things go wrong.

IT professionals always hear the phrase, “plan for the unexpected”, but this ends up making us too overwhelmed to actually plan for those unlikely, ominous events.  What we should be doing is planning for the ‘expected’.

For example, last year, the Northeast was hit by Super Storm Sandy and many businesses were out of commission for days and in some cases, weeks. Could those businesses have predicted the consequences around such a unique event? Maybe, but it would have been more of a lucky guess. For example, sections of lower Manhattan that flooded have never been flooded in recorded history. So was it logical in terms of risk management to have placed data centers in basements in those locations? Yes… because, ‘who’d of thunk it?

Historic storms like Sandy are few and far between. During events like this, there will be devastating casualties no matter how well the planning. Big catastrophic events are not your probable threat to business continuity.

While it is easy to imagine movie-like devastation, smaller and more likely events can also cause the same damaging effect. Imagine a gas leak near your business, an isolated tornado, a railway accident, HAZMAT incident, plane crash, or local act of terrorism. Even though your business may not be directly damaged, it could have been in close proximity to the event that you and your employees are not allowed to access your facilities for several days. Your organization is now set back and suffering from customer loss, project delays, significant unplanned expenses, employee issues and the list goes on.

All of these events are indeed possible and can be expected and therefore planned for. They happen daily around the country and all over the world. It can happen to you, but you can also be ready. This is business continuity planning. It includes people, essential processes and technology.

To start off, ask yourself one easy question that will surely have a very complicated answer:

What if you and your employees could not get into your facility, buildings, plant or offices for just a few days – what would happen to your business?

  • Without access to the building, could you have communicated with customers, employees and vendors?
  • If you possess critical systems, could you have maintained them remotely?
  • For your IT infrastructure - the ‘must have’, not the ‘like to have’ systems - could you have kept them up and running?
  • For things like your web sites, payment processing and ecommerce systems, healthcare information storage, ERP systems, email, backups, electronic records, file shares, etc., could you have accessed these systems in whole, in part, or at all?

When you take the unique aspects of your business into consideration, you will ask yourself other questions - important questions - that will help you identify what you really need to prepare for, given just a few days of a business continuity failure.

Consequence-based planning

When putting together a business continuity plan use real, consequence-based planning for this exercise. This is where you ask yourself, for example, “What would we do if our building were hit by a tornado?” Be realistic and be specific for your location. There is no sense doing a consequence-based plan for a tsunami in Kansas City. Make a list of things that are important right away (within the first few hours), and another list of things that will be important later on.

Make and use a Checklist

Here is a framework for a sample checklist/questionnaire that will get you thinking in the right direction:

  • Are we safe from harm?
  • Who is my first call to?
  • Do I have a way to conference together key decision makers?
  • If I can’t get access to my building is there a way I can contact those employees that may be inside?
  • If I have to evacuate the building, who goes where?
  • Do I have a physical administrative ‘meet’ point, and an alternate?
  • Do I have a location I can use as a temporary operations site? Can you make a mutual deal now with another business owner a few miles away?
  • Which employees are key decision makers?
  • Which employees are key tactical assets?
  • What is my plan to bring in additional people to help run the business?
  • Are we able (and set up) to telecommunicate and operate remotely?
  • What contracts, covenants, compliances or laws might I breech during this situation?

Business Critical Functions

Be sure you identify your business critical IT functions. These are those most basic systems or processes that must continue or be restored first to keep your business functioning. These may include a customer facing website or application, your email systems, or accounting and customer systems. Once you identify what technology must be maintained, you can begin to design, prepare and test a cost effective fail-over solution.

The term “fail over” is used to describe the process of switching from your main systems to your backup systems. It can be a manual or automatic system, and it can be kept as current as you need it to be. Talk to your managed hosting provider, they should be experts in this area and able to provide you with options to fit your needs. They should also be willing to participate in your testing, drills and verification processes. In other words, they should be a partner, a trusted advisor and a technical asset.

Ready for the expected

When you have a business continuity plan in place that is constantly being retested, you will feel much safer should your business be struck by disaster. Along with feeling confident, your business will survive and not lose productivity, profit and all of the hard work you and your employees have put into it every day to get it to where it is now.