Why business continuity planning should deal with processes, not technology

This is a story of what can happen if your business continuity planning is focused too narrowly.

Business continuity developed from the IT focused world of disaster recovery and there is a tendency to focus on the technology too much. Business continuity should be focused on the business processes rather than the technology because an over concentration on the latter can be short sighted, as I hope this story illustrates.

My story concerns a medium sized company that delivers out-sourced services to a number of larger companies. Being dependent on their IT systems for the delivery of their services they have spent a great deal of time and effort ensuring that their IT and telephone infrastructure is resilient and capable of delivering the service levels demanded by their customers.

When swine flu was threatening us all last year, one of their clients asked what their pandemic planning looked like. Luckily they did have a plan of how to deal with this. Their plan envisaged that their head office building might become untenable for a period of time and allowed for key staff to be issued with laptops and then work from home.

In the event, this plan was never invoked; however, you may recall that at the start of this year we had rather a lot of snow, and that some of it came rather suddenly. The result was that staff couldn’t get into the office. Unfortunately, the laptops that would have allowed them to work from home were in the office. Luckily for them, the client’s staff couldn’t get into work either so there was no service delivery impact, but that was luck, not planning.

The problem was that although they had seen a potential impact, the loss of the office, and had developed a strategy for dealing with that eventuality, they only planned for an incident that gave them plenty of notice to invoke the plan, whereas in the event they had no notice. Also, they had focused on the technology that could solve the problem rather than the business process that used the technology. If instead they had modified the business process so that, for example, the laptops were stored in the staff members’ homes they wouldn’t have had this problem.

Referring back to pandemic planning: many business continuity plans adopted a phased approach with triggers for each of the phases. For example, the stage 1 plan was triggered when WHO moved the pandemic threat level from 1 to 2. Another phase was triggered when WHO went from two to three, and so on.

What do you think?

What would happen to your ability to service your customers if your head office was inaccesible, for any reason? Do let me know by commenting on this article.

Related posts:

1. Business Continuity mustn’t depend on technology The recent extended outage of RIM’s BBM Instant Messaging service...
2. What motivates companies to introduce business continuity planning? I was prompted to write this blog post as a...
3. Monday Tip – Make Business Continuity Planning part of Business As Usual Planning for the continuity of your business after a disaster...
4. Succession Planning and Business Continuity People can be your greatest asset, and your biggest weakness....
5. Will Business Continuity Planning reduce my insurance premiums? Business Continuity Planning should be seen as an investment in...