When businesses first became dependent on computers it was recognised that the computer room was a critical risk exposure. This led to the development of Disaster Recovery Plans. Some of which were quite expensive incorporating costly duplication of systems or the lease of hot sites to provide immediate recovery of computer services.
Whist computer dependency has continued to increase, the cost and size of computer systems has significantly reduced allowing easier duplication of systems and data and comparatively inexpensive disaster recovery plans.
There has been a plethora of BCP methodologies introduced to the market. Many are based on the completion of an exhaustive Business Impact Analysis which identifies almost every risk imaginable. Each identified risk is then listed in an order of priority according to its likelihood and severity. An emergency response and business recovery plan is then developed for each identified major risk exposure.
This results in a BCP which looks more like a telephone book which is unwieldy, difficult to use, very expensive and time consuming to produce and equally expensive to maintain. Invariably this type of document remains on the shelf as a dust catcher and rapidly diminishes in value.
However, there is a much better way.
CRM - Business Continuity Planning Methodology
Our methodology is to focus on the identification of the business operation’s critical activities, such as computer systems, communications, financial operations, intellectual property, office functions and human resources. A BCP is then developed for each critical business activity or module.
Working on this principle we can focus our energy on what should be our main concern to not only survive but to be able to recover and still meet the expectations of our stakeholders and maintain our market share. The BCPs will include:
- Emergency Response – this covers the immediate actions to be taken following a serious incident or major loss. The correct action taken during an incident can greatly affect the severity of loss;
- Internal and External Resources – this section provides brief details on the company’s important resources to help recovery including within the company and external resources including competitors;
- Communications – immediate notification to proprietors, insurance consultants and senior executives is critical to provide a prompt and accurate press release to minimise adverse media or other improper and potentially damaging reporting. The names and phone numbers of all major clients, customers and staff should be kept available by senior management of critical operations;
- Short Term Recovery Phase – this phase covers the immediate needs for the business and its customers to protect market share and the financial viability of the business. It is usual that short term procedures will involve uneconomical business results (in the short term). This phase is not concerned so much about making a profit as it is in protecting the market share of the business and keeping clients and customers satisfied with their needs being met.
- Full Recovery Phase – this phase sees the business operations returned to 100% pre-loss capability with full restoration of any property damage. Full recovery plans may require complete reconstruction of buildings and replacement of major equipment items and may take in the order of 12-24 months.
As the BCPs are in a modular format under each critical operation of the business, the crisis management team are able to start recovery procedures as soon as the damage reports have been received. The BCPs need to be pre-approved by the Board to ensure managers have the confidence to take the prompt actions required.
The costs involved for short term recovery and full recovery phases can be used to tailor the business interruption insurance to properly fund the BCP and survival for the company. In most cases the funding of the BCP will be less than the limit of liability for insured business interruption. As the underwriter also stands to preserve an appreciative client, BCP is very much a Win –Win risk treatment solution.
The main benefit of the BCP is that the hard decisions for business survival have already been made and can be financed by the insurance program.
