Auditing BCP plans is crucial to ensuring a consistent product is being developed across the organization. Inconsistency raises the potential for failure of recovery should the plan be activated.

In our audit of BCP plans, we look for industry standard components that make up a best practice plan.  For each component, we assign a Red (Does Not Exist), Yellow (Needs Work but it’s There) or Green (it’s in Great Shape).    Components to consider are:

 

Plan Approval and Sign-Off
Activation Authority
Delegation of Authority
Plan Overview
Recovery Sequence of Critical Business Processes
Building/Area Outage Plans
Technology Outage Plans
Telecommunication Outage Plans
Loss of Resources Plans
Loss of Other Channels Plans
Regulatory Requirements and Desk Procedures
Business Unit Information:
Initiation/Escalation Procedures
Criticality Designation
BU Processes
BU Dependencies
Assumptions
Workflow Input/Output
Manual Operating Procedures
Deviations to Standard Procedures or SLAs
Approach to Returning to Normal Ops/Location
Appendices
Critical Contacts: Internal and External
Alternate Site Information
Vital Records
Work Area and Equipment Inventory
      Other Hardware, Tools and Supplies
Certification and Exercise Record

 

At the end of our assessment, we provide our client with a “heat map” summarizing the state of each plan and its adherence to industry best practice components.  We look for common themes across the plans to aid the customer in identifying quick opportunities for improvement.  Detailed findings and opportunities are also documented and presented to the client.  Remember, no checklist is perfect and DOES NOT mean a plan with a clean bill of health will execute seamlessly!

About MHA:  MHA Consulting, with its decade-long track record, is a proven leader in business continuity planning, disaster recovery planning, IT best practices and data center moves and relocations. Every day, MHA helps protect trillions of dollars of global-market assets and top companies around the world rely on MHA services for the continuity of their business. For more information on MHA, contact Michael Herrera at herrera at mha-it dot com.