The 10 Commandments of Business Continuity Planning

The Philippines is the sixth most vulnerable country to climate change and one of the most vulnerable to natural hazards, the Asian Development Bank (ADB) reported. The country lies at the Pacific Ring of Fire which is home to more than 75% of dormant and active volcanoes in the world. The archipelago has dozens of fault lines and more yet to be discovered by the PHILVOCS. An average of 19 storms a year are expected to enter the Philippine Area of Responsibility, two of which wreaked havoc worth P19.6 billion in economic damages three years ago. Floods regularly submerge Metro Manila and with the rising sea level, both the public and private sectors do not expect it to stop anytime soon.

The Philippines is, unfortunately, located at the central point of the fork of disaster prone areas. Nonetheless, that doesn’t commensurate to economic disadvantage. Business Continuity Plan (BCP) is one effective and proven way to minimize, if not totally avoid, the damages caused by similar events. By implementing ways to continue business operation despite a catastrophic setting, losses are minimized. BCP includes disaster recovery, business recovery, contingency planning, crisis management, emergency management and everything that spells business.

The country was the most frequently hit by natural disasters in 2011, claiming more than 10% of all cases in the world. The stat is higher than the preceding year and still can get worse in 2012. Yet in a study by the Asian Disaster Reduction Center, only 27.5% of Philippine companies have existing Business Continuity Plan. Alarmingly, almost half of all businesses in the country are not even aware of it.

Being disaster conscious is good but not enough. Embracing the whole concept and adopting it as a concrete business item is the best start.

Here are the 10 commandments of a guaranteed Business Continuity Planning meant for small to large businesses.

1. Anticipate worst-case scenario                      

The key to exerting solid efforts in business continuity planning is to anticipate the worst disasters a business can face. Planning for maximum damage will give higher ground to execute the contingency plan and implement the normal operation come business rehabilitation time. Hoping for the best is closer to reality if the company is prepared for the worst.

2. Prioritize the customers

Safeguarding the interest of the customers is safeguarding the company. Customers are the very reason behind business continuity. Many vital businesses during disasters, such as banks, remittance centers, grocery stores and drugstores, are expected to offer continuous availability of information, products and services. Prioritize the customers’ needs to avoid cutting connection to the public.

Resort to manual operation if electronic transactions are unavailable. Operate from the main office if satellite branches are closed. Sell items on limited quantity if supply is insufficient. One disastrous experience can ruin a relationship developed by years of excellent customer service transactions, with the clientele. Impressing customers on untoward situations gains bigger impact and finer impression than regular advertisements, so make sure you highlight the brand’s reliability and resiliency.

3. Design your Business Continuity Plan for immediate recovery

The real success of a BCP lies on the duration of its activation: the shorter time it is used, the better. The primary target is to restore normal SOP as quickly as possible. Continuing with the operation through back-up facilities in times of disaster and minimizing the damages are secondary. BCP should be resilient, not keep you hanging.

4. Embrace Business Continuity Plan’s lifecycle

Keep in mind the stages of a reliable BCP: analysis, solution design, implementation, testing and acceptance, and maintenance. Analysis is proactively identifying all possible disasters and crises, their impacts and corresponding solutions. Solution design is formulating the most effective protocols, back-ups and fallback positions to be invoked in times of need. Through implementation, all existing critical systems and components will have duplicates. Testing and acceptance is assessing the plan’s effectiveness and how the organization understands it. Maintenance is the continuous updating of the finalized BCP.

Skipping a stage or interrupting the cycle will cause even an intricately done BCP to fall apart.

5. Identify the company’s critical components

Classify components into two—physical and system. Physical components are necessary equipment, facilities and manpower to go on with business operation without interruption. What hardware should be duplicated? What positions are vital to the core function of the organization?

System components are the running systems and databases that guarantee availability of information, internally and externally. Where can the data be stored? What are the systems holding the operation together?

The next step…

6. Set a disaster recovery site with an assigned disaster recovery team

Plan where the critical components should be duplicated, to what extent the disaster recovery site operates, how much system backing-up and access should be done and who should man the site. This is the most expensive (and sometimes, unconvincing to the management) stage, but investing on this is more practical than losing money from a day’s lost operation. Think of it as an investment and not as a cost.

Setting a disaster recovery site and team need not be new. Systems and programs are licensed and often allow duplicates. IT staff and skeletal force personnel are the same as the existing employees. The location and actual facility are meant for core functions so they can be less elaborate than the normal set-up.

The team is essentially composed of the finest staff in the company. These are the people with the highest skills. However, note that the implementation of the team’s extra rights is for limited time only. They may be accessing the company’s final back-up. A problem that will occur here may be irreversible and can cause permanent damage.

7. Document all procedures

Documentation is backing-up critical business operation procedures to be used by the assigned disaster recovery team. Temporary disorientation is common during the onset and aftermath of disasters. Having a reference to consult is always handy especially when members of the disaster recovery team are not available themselves. The new facility should also be mapped out.

8. Conduct disaster recovery testing and training

To detect design flaws, a company-wide examination and technical testing, at least bi-annually or annually, are advised. Employee training in crisis response, survival techniques and contingency procedures will elicit proper workflow under adverse conditions. Explaining the expected impacts and downtime will also prepare them for what may come. Reacting to man-made and natural calamities is better if they know what to expect and are mentally prepared.

Tapping an external group with proven expertise in Business Continuity Planning is recommended in this regard. Specialized training programs for emergency response and their subsequent evaluations are designed and interpreted more effectively by experts.

9. Complement your Business Continuity Plan with Communication Plan

A BCP’s activation revolves around employees; thus, a comprehensive Communication Plan is an imperative. It consists of protocols for coordination across the whole company, escalation procedures and processes to mobilize all resources. The organizational flow may be disrupted during dire situation; a Communication Plan will pull it together

10. Partner with the expert

Not all businesses have existing BCP or are even capable of coming up with an infallible one. Admitting inefficiency in that department and doing something about it is self-assurance and avoidance of future meltdown. Choosing a trusted partner to seek help from is of utmost importance in creating reliable BCP and giving the company quick resiliency.

One of the emerging entities in Business Continuity Planning is Black Pearl Consultancy under Business Profiles Incorporated, one of the country’s premier security groups. With specialization in security and risk management, risk mitigation, disaster recovery and specialized training programs, a partner like Black Pearl Consultancy is sure to work with any business synergistically to deliver the most suitable Business Continuity Plan.

Business interruption is the direct opposite of business continuity. In the Philippines, where no business continuity certifying agencies and mandatory compliance are available, partnering with an expert is a great help in facing disastrous situations and setting the bar high.

A day of downtime results to millions of lost revenue. A few more days can lead to loss of customers, which in turn can cause closure of business. The crippling effects of disasters may not be totally avoided even by the biggest corporations in the world. Natural calamities are unrelenting and can be greater than any technology can handle. The least businesses can do is to prepare for the worst and keep a well-designed BCP to minimize the looming damages.

Competition during disasters is dictated by resiliency and business continuity. The first to bounce back wins. A great business gives no excuse for business interruption, so be prepared as soon as now.

An ounce of prevention is still worth a pound of cure. ###

 The roughly edited version of this article was published in Malaya Business Insight on May 10, 2010

(James Henry Abrina is an editor, writer and business development professional. Click here to visit the EzineArticles page of the author for more quality articles.)