View threads

Business Continuity > The Conundrum of Keeping Business Continuity Plans Up-to-Date -By: Jessica Blond, ABCP-

Every BCP Manager and consultant knows that no matter how well developed a Business Continuity Plan (BCP), it experiences diminishing returns based on change in staff, organizational structure, or operations. It is imperative to keep plans up-to-date, but the difficulty lies in “how.”

Depending on the size of your organization there are numerous methods that can be utilized. I often help my clients develop “Plan Maintenance Schedules” that are based along industry standards including a BIA update every two years, personnel contact update quarterly, etc. How many consultants, however, have reviewed an organization’s plan and been surprised to find data that is more than 3 years old? Likely, not many!

It isn’t laziness on behalf of an organization or its management, but simply a reality of the BCP industry. Unless plans are considered a live and integral part of an organization’s operations and culture and are therefore updated and tested regularly, they quickly become less useful during an emergency, and eventually completely obsolete. While likely any BCP, even if slightly out-of-date, is better than nothing, having a ready to use plan, with up-to date information and data can make the difference between an organization’s ability to continue operations with minimum downtime, and a corporate catastrophe.

Identifying “Trigger Points:” Developing a Plan Maintenance Schedule should involve identifying “trigger points” within an organization’s BCP strategy. One obvious “trigger point” is a change in an employee’s status. Every time an employee leaves the organization, changes department, or moves to a new address, it is generally tracked by Human Resources. A natural solution to a “staff change trigger point” therefore would be arranging with HR to inform the BCP manager anytime there is a staff change within the organization. This might be done on a per case basis for smaller organizations or on prescribed a schedule for larger entities.

The BCP manager can then review whether this change is important to the organization’s strategy, or not. In my experience it is not uncommon that plans are not updated timely, even after the departure of key emergency management personnel critical to BCP efforts. Other “trigger points” might derive from an organization’s Information Technology (IT) department or Records upkeep. If, for example, a business unit’s alternate site strategy is currently based on procedures that have recently been automated, then this part of the BCP likely requires updating. Similarly, if Vital Records storage procedures have changed, this will very likely influence specific data in the BCP.

I therefore recommend that every BCP Manager or Consultant develop a Plan Maintenance Program that lists identified “trigger points” and lists solutions. Putting in place the apparatus to easily update a BCP increases the odds that should disaster strike, the organization will be ready to act.

Posted by Gaston Boisson on Oct 22, 2009 at 12:29 pm