As Published in the March/April 2010 Issue of Continuity Insights Magazine
It seems as though a growing number of organizations are finally getting around to assessing their critical suppliers’ business continuity capabilities.
The most common approach used to perform this activity is a survey. Unfortunately, surveys often go unanswered, especially long ones. And in many cases, survey questions are written in such a way as to be open to interpretation.
Considering ever-present time and resource constraints, it is essential that surveys – or even interviews – be streamlined. And here’s how to do just that. The following table summarizes these five questions you should ask your suppliers, as well as high-quality answers you should expect, and possible follow-up questions for each topic.
||The Answer You Should Expect
||Possible Follow-up Question(s)
|1. How have you handled the scoping of your program and how it impacts the recoverability of the products/services you offer to my organization?
||We performed a business impact analysis (BIA) that aligns our internal business operations to each of our customers’ products and services. For the products/services we deliver to your organization, we are performing risk mitigation and recovery planning.
||Specific to the scope of your preparedness efforts, are you addressing all aspects of recoverability, meaning your facilities, people, technology, suppliers, and equipment/resources?
|2. Please describe your strategy to recover aspects of your business that deliver my products/services.
||The answer to this will be situation-specific, although the reply should describe how and where key business and technology processes are recovered, as well as supply chain risk management activities.
||When will these capabilities be available following a disruptive event and at what level of performance?
|3. How have you validated that your business continuity strategies work as designed?
||We perform annual exercises (tests) of our business continuity strategies and involve those that will be leading the response and recovery efforts. We set exercise objectives, success criteria, and compare results to pre-determined objectives.
||What is the scope of your exercises – a loss of primary work locations, a loss of technology, other?
|4. How is management involved in reviewing and improving your business continuity program?
||We employ a steering committee that meets on a quarterly basis to offer input on scoping and objectives, as well as feedback on our business continuity management system/program.
||Does our account manager participate on this steering committee, or does he/she also receive program performance reports?
|5. How do you tackle improvement opportunities in order to ensure your organization is best-prepared to address my organization’s needs?
||We track corrective and preventative actions in a list that is reviewed and re-prioritized monthly by our business continuity team and quarterly by our steering committee.
||What are the sources of the corrective and preventative actions (exercises, audits, business impact analyses, risk assessments, management reviews)?
In the end, the answers to these five very basic questions will vary. Depending on the answers – and your level of comfort with your business partner’s processes and solutions – work with them to optimize their preparedness measures.
But you must do more than simply administer a questionnaire. Follow up and coach! Invest your time in creating a two-way dialogue to share preparedness techniques and expectations. To ensure readiness, work with your supply chain management team to craft an enforceable service level agreement (SLA) that can be used to evaluate your suppliers’ preparedness efforts over the long-term.
Do you have a great idea to share with Brian Zawada? Are you in search of a great idea to put to use in your organization? Care to comment on this article? Contact Zawada at [email protected].
Brian Zawada, Director of Consulting Services
Avalution Consulting: Business Continuity Consulting