Once upon a time there was a senior manager called Rudolph who, on top of his myriad other responsibilities, was put in charge of the business continuity programme.
Now Rudolph was a busy chap with a lot on his plate. He didn’t have time for detail. And anyway, disasters never happen, do they? Well, only to other people.
So rather than doing any proper analysis he leapt straight into writing the plan. To be fair, he also thought about the business continuity strategy – for about five minutes. Then he took out the cheapest IT recovery contract he could find (because IT’s what the business needs, isn’t it?) and wrote some lovely looking plans based on a number of un-validated (and, as it happens, invalid) assumptions. It didn’t take him long at all really.
He didn’t bother to train or exercise the recovery teams or test the plans or even tell anyone about them. No need – after all, disasters never happen do they? Job done, a tick in the box, sorted.
Then one foggy Christmas eve, after everyone had left the office, an electrical fault caused a massive fire and the building was gutted. Rudolph was called out in the middle of the night to invoke his business continuity plan. His chance had come to shine.
The trouble was, his assumptions about recovery time and recovery point objectives were flawed, as were his assumptions about critical processes, IT requirements and vital records. As had been his assumptions about risks to the continuity of the business. In fact, had he done a decent risk assessment in the first place he might well have avoided this particular disaster.
The upshot was that the business failed to recover and early in the New Year it ceased trading. Rudolph went down in history all right…as the bloke whose recovery plans weren’t worth the paper they were written on!
Please don’t be a Rudolph. If you’re embarking on a business continuity programme, do at least try to get the groundwork right. And even if you already have a mature business continuity management system in place, do revisit the analysis and validate the underlying assumptions from time to time. And do talk to the rest of the business to get their input. Oh, and do some exercising and testing. And maybe a bit of risk assessment. You never know, you might just save yourself from a red face.
Have a very happy (and incident free) Christmas and New Year!