More Than Meets the Eye: The Hidden Benefits of BC Planning %

Everyone knows business continuity planning can help organizations prepare for emergencies. Less well known is the fact that BC program elements can often be leveraged to support day-to-day operations and help with non-BC projects.

Related on BCMMETRICS: Don’t Give Up the Ship: Demonstrating the Benefits of Rigorous Crisis Management Training

Benefits That Go Beyond BC

The main purpose of a business continuity management (BCM) program is to help an organization get through disruptions with the least possible impact to its operations, reputation, stakeholders, and bottom line. That is certainly a significant contribution, especially considering how unstable the world is these days.

However, it is not necessarily the full extent of what a BC program can do for an organization.

Just as the phones we carry to talk to other people can be used to send emails, play music, and give directions, the elements of a good BCM program can sometimes perform beneficial services that go beyond their primary purpose of protecting the organization from disruptions. Such a program delivers more than meets the eye.

In today’s post, I want to share five examples of situations where clients of ours were able to leverage elements of their BCM program to benefit non-BC aspects of their organizations. We’ll look at examples pertaining to incident management, the business impact analysis (BIA), third-party vendors, risk assessments and exercises, and time and effort.

Incident Management

This first example holds true for several of our clients. It has to do with the activation and use of the incident management team. Many clients activate their incident management teams once a year, when they conduct their annual tabletop exercise. There’s nothing wrong with that—but some of our clients have picked up on the fact that the team is good for a lot more than that.

Some organizations we work with utilize their incident management team whenever there is a potential issue or non-DR outage. They often tell us something like, “By the way, we activated our incident management team due to X outage.” Our clients find that using the team in these situations helps them address potential risks and coordinate their efforts better than if those tasks were performed ad hoc. Activating the team can prompt an organization to consider many items that might otherwise be forgotten. It also allows for more rapid action to restore services.

Business Impact Analysis

The purpose of the BIA is to help an organization identify and prioritize its most critically time sensitive business processes, so it knows which deserve the most protection. But the BIA has additional capabilities that a smart organization can use to its advantage.

We recently worked with a healthcare organization that used its BIA to tie each of its business processes to a strategic core service (e.g., shared services, clinical, research, etc.) it supports. This provided a seamless way for them to quickly identify the processes, systems, and dependencies tied to each core service of the organization as they embarked on a continuous improvement effort.

Third-Party System Interfaces

One of the most important parts of the disaster recovery plan process is performing a vendor assessment. Such assessments typically focus on how critical the vendor is to the client and how robust the vendor’s DR program is.

Recently, one client of ours, in performing such an assessment, learned that, for several of their critical vendors, system interfaces in place for the production systems had single points of failure. These interfaces were key to mission-critical applications for our client; the vendor assessment thus uncovered single points of failure in the client’s arrangements in another area.

Risk Assessments and Exercises

Organizations conduct risk assessments to learn which threats are most likely to occur and which would cause the greatest impact if they did occur. They use this information in devising recovery plans. They conduct mock disaster exercises to help them identify gaps in their recovery plans and train their staff. Sometimes these activities uncover gaps that lead to improvements that are of benefit to the organization overall. Here are a couple of examples:

Recently, we conducted a risk assessment for a client that uncovered gaps in its physical security. The assessment found that the security guards were unable to clearly see the visitor entry gate in addition to the gate providing a weak defense against unauthorized access.

Another client, a shipping port, made a significant discovery while we were there conducting a cyber exercise. The scenario required team members to manually perform several business transactions that were necessary to move containers in and out of their port. The exercise uncovered the fact that, for these workarounds to be feasible, the organization needed to start making additional point-in-time backups of key system data for several key business areas.

Time and Effort

Sometimes BCM program elements create benefits that have positive ripple effects across the organization in terms of time and effort. We recently helped one client of ours, a large organization, create a tiered service approach to systematically allocate its resources to the business units based on the relative criticality of that area. The BC office would provide the most critical business areas with full-service support across the full range of BC functions, from the BIA to plan development to testing to maintenance. Less critical units would receive reduced degrees of service.

This approach ensured that the BC office spent most of its time and effort helping the units whose well-being was most important to the organization as a whole. It also allowed the organization to do more with less, freeing resources that could be utilized in other parts of the company.