Have you ever noticed how people, when asked to draw a map of the United States, will draw a shape with sections sticking out on the right-hand corners for Florida and New England, a curve on the left for the West Coast, and a wedge on the bottom for Texas? If they are ambitious, they might even draw some indentations at the top for the Great Lakes. However, there are two parts that almost always get left out: Alaska and Hawaii. Everyone knows they exist, but they frequently get overlooked, even though Alaska is as big as the Eastern Seaboard.
We’ve noticed that the same thing often happens in business continuity management when it comes to the IT side of BCM versus all the other parts of BCM.
IT issues tend to get a lot more notice and press, not to mention attention from management. Sometimes people assume that if you can recover your IT, you can recover the business, forgetting that you need facilities to work in and people to operate them.
People focus most of their attention on their high-tech worries, giving short shrift to their low-tech or no tech worries. This is a natural oversight in light of our dependence on IT, but it can also be a costly one. Most of the crises we see are not IT-related when you look at the major business disruptions caused by emergency events. So if we don’t plan and prepare adequately for the non-IT types of problems, we are leaving ourselves vulnerable to many problems that are not all that rare.
There are many different types of events. While identifying potential scenarios is important, common impacts or needs should also be addressed as that will often provide the most protection or planning insights. To help you come to grips with your organization’s non-IT-related business continuity problems, we are going to discuss the two main types of these problems.
They are staffing shortages and relocation issues.
We’ll take them one at a time.
Staffing shortages are when you don’t have enough people on hand to do the work that needs to be done. This could be caused by weather conditions that prevent people from getting to work, health problems such as flu outbreaks, or even the unexpected departure of key people such as we’ve recently seen as a result of sexual-harassment investigations. Also, the rate of absences does not necessarily have to be high to cause problems. If a few key people are missing from one department, there could be a mini-crisis within that department which could ripple out and impact the organization overall.
If your processes rely on your having a full staff, you are highly vulnerable to the impacts of the staffing shortage.
For these reasons, your business continuity plan needs to include a plan for what to do if you don’t have sufficient staff to cover your processes.
How are you going to handle it if you have 50 percent of your staff unavailable?
Could you bring in temporary help? Even if you can bring in temps, what type of training will be necessary or required? Could you bring in people from other departments, who have similar skill sets or knowledge to the people in the understaffed department, and have these substitutes perform some of the more basic tasks, so staff in the department can focus on department-specific or proprietary tasks?
You can’t make sure that all your people are always available, but by making plans ahead of time for how you would handle staffing shortages in various departments, you can increase the chances that when you are faced with such a shortage you can adapt intelligently, minimizing the impact on the business.
The second common type of non-IT-related business continuity problem is facility or relocation issues when you are unable to use part or all of one of your primary work locations. In such cases, you must either find alternate places where the work can be done or shut down. There will be IT needs during relocation, but those will likely be support issues needed to ensure the relocation area has the necessary technology and are not considered an IT-related event.
At many if not most organizations, the alternate-facility plan is to use a work-at-home or work-remote strategy. That can work well, but there are a number of questions that should be asked and answered ahead of time, to make sure such a plan goes smoothly:
Most organizations whose alternate-facility plan is to have their staff work at home assume that people have the needed technology. Often these assumptions are unjustified. It’s best to do an inventory with your staff ahead of time to learn exactly who has what capability.
The above relates mostly to offices. The challenges are different in the case of manufacturing and laboratory facilities and warehouses.
The questions you should think about for these types of facilities include:
Many types of events, ranging from natural disasters to leaks of toxic gas to incidents of workplace violence, can prevent your organization from accessing part or all of a facility. Through careful planning, combined with creativity, you can minimize the impact of these incidents on your business, if and when they occur.
There’s more to the United States than just the lower 48, and there’s more to business continuity management than just IT.
Make sure your program is ready for the whole range of possible problems your organization might face, including not only high-tech problems affecting your systems and applications but also the low-tech ones that can impact your staff coverage and physical facilities.