Picture IDs are required to get in, and a second ID is required to get into classified work areas.

Some of the employees are Federal employees, most are long-term contractors.

Typical government operation, both "civilian" and military. Federal employees, including senior military personnel, may be making the decisions, but contractors are doing the work. For the government, it's "cost effective."

Because "The Feds" recently realized the value of Business Continuity - in Fed-speak it's called Continuation Of Operations Planning or "COOP" (as in chicken coop) - the installation has a Business Continuity plan.

It's even been exercised at a level somewhat greater than a desktop simulation.

Everything is certain to work when needed.

Murphy's law

It may be Murphy or Finnegan or someone else, but the "law" states that "if something can go wrong, it will."

Let's have a Nor'easter blow through the area and cause the installation's commander to declare an emergency.

All essential personnel are called in.

The essentials, mostly managers, report to work, but nothing gets down.

How can this be?

"Essential" was poorly defined.

Remember that most of the "rank and file" are civilian contractors. Most are not considered "essential."

Translation: the non-essentials can't get in to work.

On the other hand, if the "essential" government managers fail to show, no decisions can be made.

(If a choice must be made between "non-essential" workers or "essential" managers, opt for the workers.)

Moving target

There are "essential workers" and then there are "essential workers."

Many Business Continuity response plans are based on normal operations.

Unfortunately, response activities usually are something other than "normal operations."

Personnel who perform "essential" functions during normal operations may find those functions cancelled during some or all of a response action.

That does not necessarily mean the people who perform the now non-essential functions can go home. It can, and usually should, mean that these people have different assignments for all or part of the duration of the response.

True story - and the basis for this exercise.

There is a Federal agency which is staffed largely by contractors.

The agency had an emergency.

Critical workers were instructed to report to work.

When they showed up, Security refused to allow them entry since their names were omitted from a list of "essential workers."

Even if they had been allowed in, they could not have been as effective as possible since the Federal managers were the only authorized decision makers.

The problem encountered by the Federal agency is not limited to government. It can happen in any large organization with fragmented Business Continuity. planning.

(Once again, enterprise planning is the only way to protect the organization. Have many mini-plans - a mini-plan for each functional unit - and an umbrella or enterprise plan to pull all the mini-plans together.)

Managers or workers?

Earlier I suggested that if a choice must be made between managers and workers, take the workers.

This only works if the workers have the authority to do their work.

Anticipating the actions which may - may - be required of the workers needs to be incorporated into the response plans along with the Standard Operating Procedures, those ubiquitous "SOP"s.

While response plans must document, "by the numbers," what is expected of the responder, they also must anticipate what might - operative word is "might" - be required to meet the response requirements, particularly in the absence of management or other decision makers.

Accomplishing this means whomever is developing the response plan needs to watch response actions being performed and to toss in the proverbial "monkey wrench" at every opportunity. Playing the "what if" game is an absolute necessity to develop a response which anticipates the unexpected.

This also takes confidence on the part of managers who may have to surrender some of their decision making authority to the people being managed. On the plus side, the manager knows he or she can go on vacation and not have to worry that the operation will fall apart in the manager's absence.

More than documenting what "workers" are allowed to do beyond their immediate response functions, decision making - including making expenditures in defined areas - must be formally delegated, even if only with the caveat "in the absence of the manager."

The US military was famous for allowing enlisted personnel and junior officer ranks a great latitude in tactical decision making. Allowing, encouraging, non-managers to exercise some managerial freedom within a defined and documented area can mean the difference between a efficient recovery or a delayed recovery.

It may seem inappropriate to allow contractors decision making authority, but if managers' presence cannot be guaranteed, that authority must be shared.

Last thought

One final thought about staff managers and contractors.

Contractor Business Continuity responsibilities must be defined at the beginning of the contract.

Just as union contracts must have Business Continuity responsibilities defined by contract if conflicts are to be avoided.

Just as Business Continuity-related policies and procedures must be created before they are needed.

Having responsibilities defined "up front" may seem like a "pre-nup," a pre-nuptial agreement that could dampen the suitors' ardor, but it is the only way to assure that everyone will know, and be able to meet, expectations in the event of an incident.

Photo from Prints and Photographs Division, Library of Congress, Washington, D.C., 20540-4730; LOT 4172-C

 



 

---

John Glenn, MBCI, has been helping organizations of all types avoid or mitigate risks to their operations since 1994. Comments about this article, or others at http://JohnGlennMBCI.com/ may be sent to Planner @ JohnGlennMBCI. com.