Business Continuity Planning

PlanB Consulting consultants have considerable experience in writing Business Continuity Plans for different organisations, from SMEs to multinational corporations. They also have considerable experience in writing plans at different levels throughout the organisation: operational, tactical and strategic. 

We focus on ensuring that our plans are short, succinct and practical documents, which are designed to be as easy-to-use as possible. Plans developed by PlanB Consulting have been used in several live incidents across a range of sectors. See the incidents tab on the website to see our experience.

The following article was published on Continuity Central.

 

The 10 most common mistakes people make when writing Business Continuity Plans

The following are the 10 most common mistakes PlanB Consulting find in plans when they are asked to review them.

1. Compliance with ISO22301
Many of you may not be going for the Standard or even aligning with it, but if you are writing a plan you should at least comply with the items the Standard says should be in a plan. In Part 2 of the Standard you only have to comply with just over one page of items. If the Standard says in the plan there should be ‘a method by which each plan is invoked’, make sure that there is a section on this in your plan. I have seen lots of plans where large chunks of what should be in a plan are left out.

Action
Make sure all the items in Section 4.3 of Part 2 of ISO2230 are covered in your plan.


2. Connect to the BIA
Business continuity managers spend ages on their BIA, gathering lots of detail and perfecting it. Then, when you look at their plan there appears to be no relationship between the two. All of the conclusions reached in the evolution of the BIA and development of the strategy get lost before getting into the plan. The plan should be the tip of the iceberg; it contains 10% of the information. The other 90% of the information is developed and produced as part of the business continuity life cycle, which informs the development of a plan.

Action
Make sure the BIA information is reflected in the plan.


3. ‘Samey’
This often happens to organisations that go for a standard plan template. It occurs when someone has produced a reasonable plan template, or people have copied it occasionally from lazy consultants. The issue is that it is almost impossible to distinguish between the different plans in the organisation. They are almost all identical apart from minor details such as recovery numbers and the name on the front. It is fine to use a standard template and even some standard paragraphs but ensure that some thought has gone into the plan, thereby bespoking it to the organisation. 

Action
Ensure that your plans are written for the organisation and are tailored to its requirements.


4. Telephone numbers
Almost all plans will contain names and telephone numbers. Often, these are to be found at the heart of the plan or in an appendix at the back. Usually they are out of date because of a turnover of people or people have not updated their plan. Numbers should never be in the middle of the plan as they are difficult to update without printing a whole new plan. This either uses up vast amounts of paper or people just don’t bother to do it. If the numbers have to be in the plan put them as the final appendix and then this is easy replace. Better still, many organisations already have telephone lists, updated by admin people, for operational reasons. Find out if these lists exist and then cross reference them in the plan and let someone else keep them up to date.

Action
Review the best way to hold your telephone numbers.


5. Names in plans
As with telephone numbers, the second most likely thing to be out of date in your plan are people’s names. Plans, I believe, should never contain actual names because as soon as the plan is published someone will move or leave and the plan is out of date. Use job titles as they change less often than the personnel.

Action
Change all the names in your plans to job titles.
 

6. Thickness
There is nothing wrong with a plan 2 inches thick if it is dealing with a highly complex and technical recovery. A plan for a 10-person department is unlikely to need to be this thick. A plan’s bulk should be commensurate with the complexity of the recovery and the organisation being recovered.

Action
If your plan is too fat slim it down.


7. Quality Assurance (QA)
QA is essential to making sure that you have the up to date version of the plan. Too many plans make a half-hearted attempt at quality assurance. Good practice is to give details of the following:

Amendments (Version, Date, Author, Description, Status)
Assigned personnel (Authoriser, Reviewer, Author)
Review/Approval (Version, Date, Approved by, Comment)
Date of next review (Date, Responsible Person)
Distribution list (Copy Number, Job Title, Method of Distribution)

Action
Review your QA details. Are they adequate?


8. Flow
If your plan is going to be used on the day of an incident then ensure that there is a flow to the plan. Too many plans have information in no logical sequence. Keep all the background information together at the back or the front, if it needs to be in the plan at all. Have invocation at the front and long-term recovery at the back and ensure that all the information is in a logical sequence.

Action
Work through each section of your plan to ensure it is in sequence.


9. How to do it
Too many plans lack essential detail, which on the day could thwart or delay the recovery. If your plan requires the invocation of a recovery centre then put in the essential detail such as the telephone number to call, your reference number, what information is required and who is on the list to invoke the plan. Only by getting to this detail can you ensure that something as critical as invoking a recovery centre can be carried out.

Action
Get someone who doesn’t know your plan to read through it and point out any detail or information they would need to implement the plan.


10. It’s the planning, stupid!
The plan is a useful document for reminding you of what is meant to happen in responding to an incident. A lot more important is the thought that has gone into developing the plan. This planning work is often short-circuited by people ‘just wanting a plan’. Plans can look beautiful but if they are planning for recovering the wrong things or they wouldn’t work on the day, the plan is a waste of time, effort and paper.

Action
Review to see if you are really satisfied with your plans and that sufficient thought has gone into them.