Many a sound recovery strategy has been derailed by overoptimistic assumptions and overlooked details. To make sure they can recover when it counts, organizations need to define the small practical steps their strategies depend on and ensure they have the means to carry these out.Related: Casual Assumptions: The Flaws That Can Sink Your BC Plan
Summary
Business continuity methodology can get complicated, but one of the most common reasons recoveries fail is simplicity itself: people don’t think through their plans in sufficient detail. They think up the general approach they will use to recover (the recovery strategy) without defining the details needed to implement this approach and ensuring they have the means to implement them.
Imagine a motorist thinking, “If I get a flat tire while I’m crossing the desert, I’ll simply jack the car up and throw on the spare.” This is a reasonable strategy, but if the person hits the road without first checking to make sure they have a working jack and an inflated spare, they are rolling the dice in terms of their ability to recover from a flat.
As consultants, we at MHA routinely encounter organizations that proudly tell us about all the recovery plans they’ve prepared. “Okay, great,” we’ll say. “Let’s see them.” Those plans frequently turn out to be loose sketches of what the company will do rather than what’s really needed: plans that go through recovery activities step by step, with the key details investigated and worked out in advance.
A sound strategy is only half the battle. Stating what the organization intends to do is not the same as being prepared to do it.
To create a recovery plan worthy of the name, the organization needs to work through such details as whether the necessary data, equipment, and supplies are available and whether the employees know what to do and have practiced doing it. Planners should ask themselves questions such as: Have we considered all the steps involved, including the less obvious ones? What assumptions does our strategy depend on?
If those assumptions prove false, the recovery effort may stall just when the organization can least afford it.
Sometimes, the problem is more fundamental: the strategy itself may not work. An alternate location may lack the capacity or resources to take over the affected operation. A supposedly independent backup may depend on the same infrastructure as the primary system. A workaround that sounds straightforward in a planning meeting may prove impractical under the pressure of an actual disruption.
Often the result is a plan that looks good on paper but requires employees to solve problems on the fly. This certainly keeps things interesting for everyone involved. It also opens the door to problems that can significantly delay recovery.
Many organizations think that when they come up with a recovery strategy, the job is done. Really, it’s just beginning. Once a strategy has been identified, planners need to work through what executing it will actually require.
They should start by asking a basic question: If we had to implement this tomorrow, what would we actually do?
Planners need to work carefully through the steps, identifying the people and resources needed and determining whether they will be available during the disruption. They also need to make sure employees understand their responsibilities and have the instructions, tools, and training required to carry them out.
Next, the planners should examine the assumptions underlying the strategy. Does it depend on a supplier, facility, technology, transportation route, or other resource remaining available? Could the same event that disrupts the primary operation also affect the proposed alternative?
If the strategy depends on a workaround, has the organization established how that workaround will function in practice?
The appropriate level of detail will vary. A business function that can continue remotely using familiar applications and established procedures may require little additional documentation. A manual workaround for a complex warehouse or retail operation may require specific instructions, prepared forms, data extracts, equipment, and training.
The business impact analysis (BIA) helps determine which functions must be restored, how quickly they must resume, and therefore how much preparation their recovery strategies warrant.
Not every problem can be eliminated. An organization may have to accept that recovery depends on an outside party or an event beyond its control. But that should be a conscious decision, made with an understanding of the risk and its potential consequences, rather than an unexamined assumption buried in the plan. Management may need to fund an alternative, accept a longer recovery time, or establish how customers will be informed of delays.
The objective is not to document every conceivable action. It is to identify the practical requirements and vulnerabilities that could prevent a recovery strategy from working, and address them before a disruption exposes them.
Let’s look at a few examples, starting with payroll. A plan might specify that, if the payroll system becomes unavailable, the organization will use the previous payroll file to pay employees. That sounds like a reasonable starting point, but the previous file won't reflect new hires, departing employees, overtime, or changes in pay rates. Union agreements or other payroll requirements may introduce additional complications. The organization also needs to know whether its bank can process payments using the proposed method and what information the bank will require.
The strategy of using the previous payroll file might still be viable, but it will only be effective if all the intermediate steps have been considered in advance. Planners might need to establish procedures for handling changes since the last payroll run, prepare the necessary data, and confirm the bank’s requirements. Otherwise, a plan intended to get employees paid could leave the payroll team scrambling to resolve basic questions while a pay date approaches.
Warehouse operations present a different challenge. Suppose an organization plans to transfer order fulfillment to an alternate warehouse if its primary facility becomes unavailable. Does the alternate site carry the required inventory? Does it have enough space, staff, equipment, and processing capacity to absorb the additional work? Can its systems support the operation? What happens if the alternate warehouse is affected by the same disruption?
Even if the strategy of transferring operations is sound, doing so may require advance arrangements, access to current inventory records, and procedures for redirecting orders. Without those preparations, the organization may have designated an alternate facility without ensuring that it can actually take over.
The same principle applies to manual workarounds. A warehouse might plan to continue picking and shipping orders without its usual systems. But employees will need accurate information about inventory quantities and product locations, along with a way to record picks, track inventory movements, and reconcile transactions when normal systems return. Without that information and those procedures, employees may spend valuable time searching for products and trying to determine which orders have been filled. The decision to work manually is only useful if the organization has prepared the means to do so.
Some vulnerabilities are less obvious because they involve dependencies that appear to be independent. An organization might have two internet service providers and assume that losing one will not interrupt connectivity. But if both providers use the same physical fiber connection into the building, damage to that connection could take both offline. Similarly, several trucking companies may provide alternative transportation, but all may rely on the same road to reach a critical facility. Multiple providers or arrangements do not necessarily offer genuine redundancy if they share a point of failure.
These examples illustrate why recovery planning must go beyond identifying alternatives. Planners need to understand how those alternatives work, what they depend on, and what could make them unavailable when needed. They also need to decide what to do if a critical assumption fails, or explicitly recognize the risk if no practical alternative exists.
The details will differ from one organization to another, but the question remains the same: what must be in place for the proposed recovery strategy to work when the normal way of doing business is no longer available?
A recovery strategy is only as good as an organization's ability to carry it out. By working through the practical steps, resources, and assumptions behind each strategy, BC planners can identify and address the gaps that might otherwise derail recovery when a disruption occurs.
The goal isn't to anticipate every possible problem or document every action in exhaustive detail. It’s to make sure that recovery strategies are realistic, workable, and supported by the preparation needed to put them into practice.
MHA Consulting helps organizations develop BC plans that address not just what they will do, but how they will do it. Contact us to learn how we can help ensure your recovery strategies will work when you need them.
A strategy may identify what an organization plans to do without addressing the practical steps, resources, and preparation needed to carry it out.
Planners should work through the steps required to implement each strategy, identify the necessary people and resources, and verify that employees have the instructions and training they need.
The level of detail should reflect the complexity of the recovery strategy and the needs of the business function. A simple remote-work arrangement may require little additional documentation, while a manual workaround may need detailed procedures, prepared forms, data, equipment, and training.
Gaps can include outdated payroll information, insufficient capacity at an alternate warehouse, missing information or procedures for manual workarounds, and backup providers that share a point of failure.