Business Continuity Strategy Design: An Overview of BCI Professional Practice 4

BCI_GPGs_SeriesThis article provides an overview of Professional Practice 4 (PP4) – Design, which is the professional practice that “identifies and selects appropriate strategies and tactics to determine how continuity and recovery from disruption will be achieved”. Strategy design activities are essential to translate outputs gathered during the analysis phase into actionable strategies that the organization can implement and refine over time to improve the ability to respond and recover from a disruption. Continue reading

Treating the Causes of Bad Business Continuity Training Programs

Faults & Fixes SeriesFaults & Fixes: Bad Training

As business continuity professionals, we tend to gravitate to the activities where we think we can deliver the most value. This often takes the form of the business impact analysis, helping management come up with strategies that minimize risk, and documenting these strategies into plans. Ensuring that a business continuity program employs effective training approaches and engages business process owners, unfortunately, often plays “second fiddle” to other activities. One only needs to browse any of the top business continuity and disaster recovery related publications to see this disparity. Searching for “business impact analysis” or “business continuity plan” yields substantially more results than “business continuity training.” Yet without effective training, all that hard work will likely either fail or not perform to desired standards during a real disruptive incident. Continue reading

Treating the Causes of Bad Business Continuity Plans

Faults & Fixes: Bad Plans

Developing strong business continuity plans characterized as actionable, relevant, and simple to execute can be a very difficult task for many organizations. In other articles, Avalution examined the different types of business continuity plans, what information should be included, and how organizations can focus on the basics to develop effective plans. One trend that our consultants see across industries is that as business continuity programs mature, planning approaches inevitably change, often (and unfortunately) becoming more complicated and burdensome over time. As plans become overburdened with complex requirements, simplicity, quality, and effectiveness suffer.

This perspective examines the six typical symptoms of “bad plans” and their common root causes, and provides suggestions on how organizations can develop plans described as actionable, relevant, and simple.  Continue reading

Business Continuity Plans 101

In previous articles, Avalution has espoused the value of using a management systems approach to business continuity and articulated the notion that business continuity is more than just a collection of plan documentation. This approach is reflected in many different standards, including ISO 22301.

Even though business continuity plans represent just one component of a larger business continuity planning effort, they are what guide the organization through all phases of response and recovery following the onset of a disruptive incident – from the initial response and assessment to the eventual return to normal operations. Effective planning is meant to ensure that response and recovery efforts align to the expectations of all interested parties and provide a repeatable approach to minimize downtime.

This perspective explores the different types of business continuity plans that Avalution finds to be the most effective for organizations and examines their purpose within a wider business continuity strategy. Continue reading

Using the Results of Your BIA to Develop Disaster Recovery Requirements

So you’ve just completed your business impact analysis (BIA) – identifying recovery time objectives for a variety of processes and functions throughout your organization and captured the names of applications and systems that business owners state they just can’t live without. In addition, the IT department heard you were conducting a BIA and mentioned on a few different occasions that they were excited to see what the final results would be to help with their planning. You’ve taken all the applications and their reported recovery time and recovery point objectives and crammed them into a very lengthy spreadsheet, and then the inevitable happens… you realize that everything you have collected is a huge mess.

But, don’t worry, this is a common issue! This perspective will explore the process of taking that seemingly disorganized pile of data and organizing it into something that can be utilized by IT disaster recovery planners to help meet continuity goals. So, let’s get started! Continue reading

How to Perform Effective Management Reviews

Part of Avalution’s Conforming to ISO 22301 Series

This perspective takes a look at one element of Clause 9.3, the management review (a process that Avalution feels is one of the most valuable elements of ISO 22301). Continue reading

Crisis Communications: An Organizational Balancing Act

For an organization experiencing a crisis, the ever-persistent nature of our 24/7 global society means that impacts extend well beyond the location of the crisis. Organizations that successfully manage and respond to disruptive events do so because they are able to balance the operational activities associated with the disruptive event while concurrently managing the expectations of stakeholders and the general public. Organizations are able to accomplish the task of managing stakeholder and public expectations through effective, accurate, and timely communications. Continue reading