The Neglected Side of Business Continuity: Problems Not Related to IT

Have you ever noticed how people, when asked to draw a map of the United States, will draw a shape with sections sticking out on the right-hand corners for Florida and New England, a curve on the left for the West Coast, and a wedge on the bottom for Texas? If they are ambitious, they might even draw some indentations at the top for the Great Lakes. However, there are two parts that almost always get left out: Alaska and Hawaii. Everyone knows they exist, but they frequently get overlooked, even though Alaska is as big as the Eastern Seaboard.

We’ve noticed that the same thing often happens in business continuity management when it comes to the IT side of BCM versus all the other parts of BCM.

IT issues tend to get a lot more notice and press, not to mention attention from management. Sometimes people assume that if you can recover your IT, you can recover the business, forgetting that you need facilities to work in and people to operate them.

People focus most of their attention on their high-tech worries, giving short shrift to their low-tech or no tech worries. This is a natural oversight in light of our dependence on IT, but it can also be a costly one. Most of the crises we see are not IT-related when you look at the major business disruptions caused by emergency events. So if we don’t plan and prepare adequately for the non-IT types of problems, we are leaving ourselves vulnerable to many problems that are not all that rare.

There are many different types of events. While identifying potential scenarios is important, common impacts or needs should also be addressed as that will often provide the most protection or planning insights. To help you come to grips with your organization’s non-IT-related business continuity problems, we are going to discuss the two main types of these problems.

They are staffing shortages and relocation issues.

We’ll take them one at a time.

Staffing Shortages

Staffing shortages are when you don’t have enough people on hand to do the work that needs to be done. This could be caused by weather conditions that prevent people from getting to work, health problems such as flu outbreaks, or even the unexpected departure of key people such as we’ve recently seen as a result of sexual-harassment investigations. Also, the rate of absences does not necessarily have to be high to cause problems. If a few key people are missing from one department, there could be a mini-crisis within that department which could ripple out and impact the organization overall.

If your processes rely on your having a full staff, you are highly vulnerable to the impacts of the staffing shortage.

For these reasons, your business continuity plan needs to include a plan for what to do if you don’t have sufficient staff to cover your processes.

How are you going to handle it if you have 50 percent of your staff unavailable?

Could you bring in temporary help? Even if you can bring in temps, what type of training will be necessary or required? Could you bring in people from other departments, who have similar skill sets or knowledge to the people in the understaffed department, and have these substitutes perform some of the more basic tasks, so staff in the department can focus on department-specific or proprietary tasks?

You can’t make sure that all your people are always available, but by making plans ahead of time for how you would handle staffing shortages in various departments, you can increase the chances that when you are faced with such a shortage you can adapt intelligently, minimizing the impact on the business.

Relocation Issues

The second common type of non-IT-related business continuity problem is facility or relocation issues when you are unable to use part or all of one of your primary work locations. In such cases, you must either find alternate places where the work can be done or shut down. There will be IT needs during relocation, but those will likely be support issues needed to ensure the relocation area has the necessary technology and are not considered an IT-related event.

At many if not most organizations, the alternate-facility plan is to use a work-at-home or work-remote strategy. That can work well, but there are a number of questions that should be asked and answered ahead of time, to make sure such a plan goes smoothly:

• How are you going to communicate to the staff what specific tasks need to be done?
• Do you have all of the technology in place in the alternate location? Do the people know how to use it?
• Do all the individuals have the appropriate equipment at the location?
• Can they access the needed resources using their home computers?
• If you’re counting on your staff staying home and using their company laptops, will they actually have their laptops with them? (Around 50 percent of staff never take their laptops home. You can address this ahead of time by making changes to your policies and procedures.)
• If people are supposed to work from home using their own computers, do they have the necessary software? Do they know the procedures for obtaining network access? Do they have the appropriate virus protection?
• Does everyone have a suitable computer and internet connection?
• What’s your remote telephone solution? Forwarding phones to cell phones or home landlines? If you can’t access the building, can you still forward the lines; will your solution still work?
• Do your staff need access to any physical documents, such as procedure manuals or customer phone numbers which they wrote down on a piece of paper? Are there other ways of obtaining that information, or of working around not having it?
• Are there task or personnel oversight requirements that should be addressed?

Most organizations whose alternate-facility plan is to have their staff work at home assume that people have the needed technology. Often these assumptions are unjustified. It’s best to do an inventory with your staff ahead of time to learn exactly who has what capability.

Is your disaster response hurting you? Don’t learn the wrong lessons during a disaster, read our post on overreacting.

Other Challenges

The above relates mostly to offices. The challenges are different in the case of manufacturing and laboratory facilities and warehouses.

The questions you should think about for these types of facilities include:

• What are you going to do if you can’t get the product out?
• Do you have enough product on hand to meet your needs for a period of time?
• What if you have a manufacturing function and you can’t use your equipment? Do you have equipment elsewhere? Can you get it set up? Can you source equipment elsewhere? Often the answer is no. What is your plan?
• If you can access your original facility for a brief period of time, could you go in and quickly remove needed portable equipment (such as tabletop test or monitoring equipment), taking it to an alternate location?
• If part of the facility is available, what is the best use of the area? Do you know which departments or individuals could work remotely versus those that need to be collocated with others?
• Does your plan include being able to move teams or groups as needed to various areas of the facility (for example, turning the office space into a quality assurance space or the management offices into a temporary loading or receiving space)?

Many types of events, ranging from natural disasters to leaks of toxic gas to incidents of workplace violence, can prevent your organization from accessing part or all of a facility. Through careful planning, combined with creativity, you can minimize the impact of these incidents on your business, if and when they occur.

There’s more to the United States than just the lower 48, and there’s more to business continuity management than just IT.

Make sure your program is ready for the whole range of possible problems your organization might face, including not only high-tech problems affecting your systems and applications but also the low-tech ones that can impact your staff coverage and physical facilities.