Anyone can write a business continuity plan. In fact that’s the easy bit. And it’s just as easy to make the plan look very convincing. A few names and contact details, a smattering of checklists and a bit of blurb at the start about how seriously we take business continuity in our organisation can work wonders.
But it’s also very easy to write a business continuity plan with no substance to it. One that basically says “we’ll get a few key people together and then make it up as we go along”! And, sadly, there are any number of business continuity plans in existence that essentially say this.
But what about the underlying strategy and solutions? What’s actually in place to ensure that we can meet our continuity objectives if we ever have to invoke our plans for real? How will we recover our critical business functions or our accommodation or our plant and equipment or our IT or whatever else is important to us?
And what about the education and awareness? Do the key players know what’s in the plan and what’s expected of them?
And what about the exercising and testing? Can we be sure that our assumptions are valid and that the plan might stand a chance of actually working if we ever have to use it in anger?
The business continuity plan is one thing but the strategy and solutions (not to mention the testing and exercising and awareness and education and ongoing review and maintenance and so on) that turn a plan into a business continuity capability are quite another.
A plan can look great on the surface, but if that underlying strategy and the solutions that underpin it, or the assumptions on which the plan is based, are flawed it’s just a cosmetic exercise.
To quote an experienced business continuity practitioner with an interesting turn of phrase, “it doesn’t matter how much perfume you put on a pig, at the end of the day it’s still a pig!” (apparently, there are some people who’d rather put lipstick on their particular pig, but that’s entirely a matter of personal preference!).
But don’t just perfume the pig. A proper business continuity plan needs a bit more than that if it’s to have any real appeal.