Assumptions can be the downfall of even the best Business Continuity Plan (we’ve addressed that issue in an early blog). Sometimes it’s not the overt assumptions we make (“All critical IT systems will be available within 4 hours of the disruption.“) but the ones we don’t realize we’ve made that may jeopardize our ability to recover – or sustain a recovery.
Chief among these, of course, is the unspoken assumption that our Plan will work, everything will be restored in short order and our business will be back to ‘normal’ within hours – or at worst in a day or two. It’s a common assumption. Even if it’s not written into the Plan, that short recovery horizon may be implied -simply because we don’t plan for what we may need if the recovery takes longer (a week or a month or more). It is curious that many organizations don’t plan for prolonged disruptions – especially when the majority of Business Impact Analyses (BIA’s) ask about impacts over extended time periods. Why ask a process owner what resources they’ll need 4 weeks after the disruption – then only require them to plan for a 48-hour recovery?
One could argue that failure to plan for a prolonged outage isn’t an assumption. It could be an acknowledgement that there will be plenty of time to plan ‘on the fly’ for a longer disruption. But there’s no magic tipping point where a crisis suddenly becomes a long-term outage. After the initial adrenaline-fueled rush, the impact on resources – especially human ones – will begin to degrade the effectiveness of the response. Why not plan to deal with at least that single factor (people)?
On the other end of the spectrum are those who plan in great detail for what they believe will be needed and what they will do a week, two weeks or even a month following a disruption.
I’ve long believed in the mantra: “I don’t know what’s going to happen, when it will happen, how severe it will be, or how long it will last – but I can be prepared”.
It is difficult (perhaps impossible) to plan accurately for 4-6 weeks when you can’t anticipate what will happen. You can plan for “loss of building, but you don’t know how severe is the impact will be. Will you be able to reoccupy in 24 hours – or 2 weeks? Or will you need to find and outfit a replacement building? Will critical team members be unavailable? Will all or some portion of your supply chain also be disrupted? You don’t know; and you can’t know. So there’s little of any value to planning out for a month or more.
There’ no BCM industry-standard ‘tipping point’ (the length of planned recovery time after which the benefits decline steeply). You’ll have to find your own. You can start by recognizing that it’s better to be ‘over prepared’ (too much detail over too long a period) than underprepared (a very short – and extremely hopeful recovery horizon).
Regardless of your recovery planning horizon, do at least one thing to plan for the long term: understand and document the people you can call on if the recovery drags on (not just those you want to call on). You might have time, but you always have limited human resources. Plan how you’ll deploy them, how you’ll track them, and how you’ll treat them. You can buy anything else you might need.
