Once the decisions are made what to implement and a budget is set up to this, the implementation time line needs to be fixed in concrete. Anything more than 6 months out should be ignored in the response planning.

Why? Experience shows that unless something is sufficiently critical to rate immediate attention, something else always comes up that will have a higher priority.

When all else fails

Some risks simply cannot be avoided or totally mitigated. The most obvious are weather-related: hurricanes, tornados, earthquakes, nor'easters, floods.

Before, the focus was on risks or threats.

Now the focus moves to impact. We have done everything financially and reasonably possible to avoid or mitigate the risk; now it's time to assume the worst – the risk occurs and we have to recover from it as expeditiously, economically, and efficiently as possible (else our competitors will take away our customers).

Start with the proverbial "worst case" scenario. You come to work (assuming you don't actually live where you work) and there is nothing there. Why this scenario? Because it includes all lesser scenarios. (Don't like “scenario?” Try "event" instead. Consultants – which is what I am – need to be flexible.)

"Everything is gone" is a big chunk to chew, so break it down into manageable bites.

Let's say you have your accounting on the computer and the computer is useless.

YYou need to replace the computer with a compatible one (that is, one that runs the same software and has the same type connectors), and you need to reload (or have loaded) your applications that you carefully stored off site or at least in a data safe (possibly buried under tons of debris – you KNEW you should have taken everything to the bank vault). Then you need to restore information (data) from the back-up media – tape, CD, external hard drive.

Here's an "unadvertised" benefit of creating response plans. You see now what should be done, rather than later and what should have been done. Hindsight in advance – an oxymoron, but it works for me.

OK, the computer issue is resolved. Move on to the next issue.

How about the facility?

Unless your business IS a facility (e.g., lodging, catering hall) where can you go to keep doing what you do? You need to look for something as close as possible to your present - “former”? - location so people can find you.

While looking for a new facility, think about duration. Planning to rebuild on the damaged site (is it worth it?); how long will it take to rebuild (or restore). Should you ink a short-term (90 day) lease and anticipate a move to "somewhere" at the end of the lease or should you go for a longer term?

Take each process – including communications: telephone, email, courier, etc. - and isolate it to determine what it takes to restore the process.

While doing that, consider who will be restoring the processes. Be careful not to overload anyone. Going all out for more than a little while will cause burn-outs with slow recovery. Time off is important even when recovering from a disaster event.

If the Mom-and-Pop has employees, management needs to consider policies and procedures to cover disaster events. Will staff be paid, how much, how will they get their pay, for how long if work cannot be resumed quickly? What about insurance, benefits? Just because the income goes away doesn't mean payments stop.

Back to the lists.

This time, make a list (the spreadsheet software is good for this, too) of all the processes that can be impacted. You can start from “everything is gone” or from the other end, one process is gone.

Once again, this exercise is best performed with a group so nothing is missed.



As the list is populated, make sure to include ALL necessary resources, even if some are listed for several processes. All resources for a truly high priority process need to be restored before resources for lower priority processes, unless of course the processes share the resource(s).

Document, document, document"

Each process to be restored needs to be completely documented. Never assume something is obvious (e.g., plug in and then turn on the system).

Keep the documentation simple; use theKIS(S) process: Keep It Simple (Stupid) the last word of course is optional.

List each step in order. I like tables, others prefer by-the-numbers text. Use whatever method works for you and the people who may have the recovery function, remembering that these people may NOT be the people who do the job day in and day out and that the recovery process may be different that the day-to-day operation.

As a former tech writer, I encourage you to have each restoration process validated by someone who is NOT familiar with the process and who has only the documentation to use.

Exercise the plan

No plan is perfect the first time out. If it is, it is flawed.

In more than a Baker's Dozen years, I never have seen a plan 100% on the first exercise. That's one of the reasons to have the exercises.

Start off simple – gather the troops and “walk-through” the documentation. Was anything missed? Is a process out of order? Are all processes complete? Are there any proven-to-work shortcuts? This is a two-part exercise. Part 1 is to review the total documentation. Part 2, with the group, is to share with the documents author any necessary changes – clearing up ambiguities, for example - and to review the processes to assure completeness.

Finally, maintain the plan

Maintaining the plan, keeping it up to date, may be the hardest part of the whole process.

The plan needs to be updated each time there are personnel, procedure, process, product, provider (vendor), and other changes to the operation. It's a nasty job, but someone's got to do it. The best person to do it, and assure the job is done right, is Mom or Pop.

Planning on a budget

Creating and maintaining a viable Enterprise Risk Management plan need not be a budget breaker nor need it become a full-time job for someone with “better” things to do.

On the other hand, it does require some budgeting of money and time.

Developing a plan, playing the "what if" games and challenging each other to make certain all the Is and dotted and the Ts crossed can be both challenging and fun.

The end results can mean surviving a disaster event or going out of business (and taking employees and possibly vendors under with the business).



 

---

John Glenn, MBCI, has been helping organizations of all types avoid or mitigate risks to their operations since 1994. Comments about this article, or others at http://JohnGlennMBCI.com/ may be sent to Planner @ JohnGlennMBCI. com.