PlanB Consulting can help your organisation develop their strategy as part of the business continuity life cycle. Once your organisation agrees the findings of the BIA then PlanB Consulting can develop a number of strategy options for submission to senior managers. PlanB Consulting pride themselves on being able to suggest a number of low cost options as well as those costing more.
The following article published in the Emergency Planning publication Blueprint was published in 2009 and looks at a number of low cost options for developing business continuity and contains a number of low cost business continuity ideas.
Can business continuity be done on the cheap?
In these days of credit crunch, recession, and reduced spending can organisations carry out business continuity without incurring little or no cost? In recession, this can be as relevant to large organisations as SMEs. This article hopes to explain a number of low-cost options that organisations can use to implement business continuity.
The reasons for implementing business continuity can vary. It may be that the organisation has to carry out business continuity for regulatory reasons or to comply with the law. Financial institutions, regulated by the Financial Standards Authority, must have business continuity in place while the emergency services and local authorities have to comply with the Civil Contingencies Act. Having business continuity in place may be a requirement of organisations’ insurers or the organisations may want to demonstrate to customers and stakeholders that they are managing their risks.
The first step organisations should take is to make themselves more resilient. Most organisations both large and small are aware of their key risks and vulnerabilities. These can be very quickly identified by talking to senior management and operational staff. In broad terms they are probably aware of the major risks to the organisation, in terms of threats (flood, fire, etc.) and know which parts of the organisation are vulnerable (building, IT, telecoms, staff , suppliers, etc.).
For many organisations their building or buildings are critical to their operation and loss of a building would create a major disruption to the delivery of their services. One of the first steps should be to check the organisation’s building insurance to ensure that it covers all buildings and that it is adequate. Check that the cost of replacing assets within the building has been properly assessed, as organisations are often underinsured. All buildings are vulnerable to fire and so the fire alarm provision should be looked at. Flood is also a major threat to an organisation’s buildings. Advice and guidance on preparing for flooding can be found on the Environment Agency and SEPA (Scottish Environment Protection Agency) websites. The websites will also indicate whether your site or proposed new site is susceptible to flooding. If the organisation loses their office alternatives will have to be found. Organisations should look at VPN (virtual private networks) and webmail which could allow staff to work from home or anywhere with a web connection. A number of companies offer furnished offices which are bookable at short notice and are available to rent for short periods. These can be used for rehousing staff.
For most organisations IT varies from being essential to absolutely critical and most cannot survive for very long without any access to their data. IT disaster recovery can be very expensive but often organisations can make themselves resilient without spending a lot of money. Backup should be the first area to be looked at. Most (although not all!) organisations back up their data. Backup on to tapes is the technology most often used by SMEs and some larger organisations. The questions to be asked when this technology is used are:
- Can you lose the hardware and tapes at the same time (both in the same building or, as I have seen before, on top of the server)?
- Is the information on the tape verified (is there is actually something on the tape)?
- Can the organisation cope with the loss of data which is not written to tape in-between backups?
- Do they know how they will restore the data if their IT hardware is lost?
- Do they know what they are going to restore the data on to?
If using an external backup vault service, do you have the passwords for accessing and restoring the data? External hosting of IT can improve resilience by making sure that if your building is lost, then your IT is not lost simultaneously. Large hosting companies can afford data centre security and robustness unaffordable by most organisations.
Changing key telephone numbers in the organisation from geographical numbers to non-geographical numbers (0871, etc.) can ensure that, if the building is lost and the organisation has to move location, their key numbers can redirected very quickly. The numbers can even be redirected to a mobile phone.
Looking at other items, critical suppliers can be contacted to enquire about their business continuity provision; strategies can also be developed such as having two suppliers. Suppliers’ business health can be monitored to ensure that the services of a critical supplier can be maintained. To prepare for possible loss of staff you can compile a list of recruitment agencies and also agencies who can supply temporary staff at short notice.
If resilience fails, keeping an up to date list of staff, key stakeholders’ and suppliers’ numbers for both in and out of hours can be critical in helping start a recovery quickly and in helping reassure customers and stakeholders that you will recover.
Carrying out the above measures will make the organisation more resilient and less likely to suffer from an incident. As suggested, many of the measures can be implemented at little or no cost. For some organisations they need to be able to demonstrate they have business continuity in place and will be required to demonstrate this to external parties. Others will go through the business continuity life cycle as it helps them to understand their risks, vulnerabilities and develop recovery strategies.
Going through the business continuity life cycle need not be expensive as the main requirements are time and having someone available to do it. For most organisations wanting to develop business continuity the difficulty is having a process to follow.
There are four ways an organisation can implement a process to develop business continuity: you can use a consultant who will have their own process; you can employ a business continuity manager; you can obtain training to be shown a process; or you can do your own research and develop your own process. All of these different ways of developing business continuity have differing costs and timescales.
Having a consultant to develop your business continuity is expensive but it has the advantage of being able to implement the business continuity life cycle quickly and the quality of the work should be good. The disadvantage of using a consultant is that business continuity is not really embedded in the organisation, as the work was not done by the organisation’s staff. Employing a consultant is usually the most expensive option. There are a number of low(er) cost ways of using consultants which make best use of their skills but obtain best benefit for the organisation. If the process has been developed in-house, the organisation can use the consultant to quality assure internal work. Where business continuity has to be rolled out over large or complex organisations, business continuity coordinators should be appointed for each area of the organisation and the consultant used to train them to develop their own business continuity documentation.
Employing a professional business continuity manager has the benefit of developing business continuity and managing it on an ongoing basis. The downside is that they are expensive and many organisations cannot afford one.
For those who want to develop their own in-house process they can attend a training course or they can do their own research and reading. Training is available from a number of providers who run courses throughout the country. Attendees should look for courses which will give them a process for carrying out business continuity and preferably some templates, rather than just being given an overview of the subject.
Those wishing not to spend money on training should look at books such as The Definitive Handbook of Business Continuity Management edited by Hiles and The Route Map to Business Continuity Management by John Sharp. Andy Osborne’s Practical Business Continuity Management also provides some good tips and ideas. Another place for help is to Google ‘business continuity plans’; many organisations, especially public ones, have their plans published on the web and they can be used as examples and provide templates. Learning to carry out business continuity and developing your in-house process is time-consuming but it allows for a tailored solution for the organisation, it embeds business continuity and it can be done at a very low cost.
In conclusion, there are a number of low cost options available to improve the resilience of the organisation which should be carried out prior to or in parallel with the development of business continuity. To implement business continuity there is a requirement for a process to carry it out. The process can be provided in a number of different ways and these need to take into account time, cost and quality of the work. During the business continuity process a number of risks and possible strategies for dealing with them will be identified. Some of the options may be expensive and some can be implemented at no cost. By understanding the risk and the consequence, spending can be on a cost/benefit basis. With imagination and experience a number of low cost or no cost options can be developed for business continuity, ensuring that an organisation is resilient and less likely to fail if a major incident occurred.
