Our company has 15 separate offices. We are trying to develop a recovery strategy for each office. I know that one strategy cannot apply to all offices since we are spread out across the US.
How detailed should a recovery plan be? I am trying to make it as detailed as possible, but I realize that you cannot account for all disaster events.
Those within my company believe the recovery plan should be just a general overview and most decisions should be made at the time of the disaster. I believe we should provide different options or ideas for temporary offices, such as a portable office, telecommuting, or sending employees to other office locations. Again, my peers say we should make that decision at the time of the disaster.
Another example is that I would like to create a list of items that need to be remembered to be taken care of at the time of recovery, such as mail, UPS deliveries, phone calls, a list of office supplies that will be needed immediately. Others are saying, again, that we should be able to identify those issues at the time of the disaster.
In your professional opinion, am I trying to put too much information in the plan? Are they trying to put too little information? Do we need to meet somewhere in the middle?
Thanks Dr. Dan. I appreciate your response.
Nancy
Business Continuity Planner
"A Leading Nationwide Architecture Firm"
Hi Nancy,
Thank you for your questions. They are all well founded and must be resolved in order to develop an effective, multi-site business continuity program.
Here's the short of it...
- Every office faces unique threats and, therefore, requires unique response and recovery plans. Relying on a generic recovery plan is analogous to using a Seattle street map to navigate Chicago.
- We humans don't think so well on our feet when facing a threat, especially if it's life-threatening. Waiting to figure out what to do until disaster strikes can be, well, disastrous.
- Your desire to create a list of recovery issues and items for each site is not only wise, but critical to a quick and full recovery.
Think this way: Every company office is unique. The people, the basic office function, geographic location, and - more appropriately in this realm - its vulnerabilities and threats differ. For example, an office in Los Angeles must prepare for earthquakes while an office in Houston has to deal with hurricanes. That's not to mention the risks that your next-door neighbor (e.g., chemical plant, airport, hazardous cargo route, etc.) may introduce into the equation.
In this examples, how can a generic recovery plan suit both environments? Well, it can't.
As Benjamin Franklin once said, "if one doesn't plan for the worst, then the planning will be futile." His advice aligns with "if we fail to plan, we plan to fail." Cliches aside, when we plan for the worst, we've covered all the little things. That doesn't mean we need to be paranoid. We DO need to be aware and prepared.
Each office has it's own unique, worst-case scenario. If we don't accommodate that in our recovery plan, then how are me meeting our mission? How are we serving our customers? Investors? Employees? And other stakeholders?
After all, the word "plan" - according to the Merriam-Webster Dictionary - means "a method for achieving an end." In the case of business continuity, the "end" is to continue as a solvent and viable business enterprise. That's not to mention the fact that your downstream customers want to continue; If you don't, they may not.
Now let me cover the issue related to "on-the-fly disaster recovery decisions." Not to be condescending, but we humans are not usually good at thinking on our feet, especially under extremely stressful or dangerous conditions. Most tend to panic and hope that someone else knows what to do.
If we wait until "we're in deep kimchee" to identify our recovery actions, then the disaster's impact could worsen and full recovery may be impossible.
Worst case, how do we recover after experiencing fatalities in the workplace? In that scenario, there are psychological issues for the survivors. How do you account for the lost resource, skill sets, and knowledge assets? That's not to mention the lawsuits that are sure to follow from family members, especially when they discover you didn't have a plan.
One more thing: Be sure your constituents understand the difference between a response plan and a recovery plan. The response component of your BC plan is designed to stop the threat. Recovery involves repairing the damage and bringing the business back on-line as quickly as possible.
For example, if your office is threatened by a fire, then the response plan includes evacuating employees to safety, extinguishing the blaze, treating the injured, and protecting the surviving assets from further damage from exposure to the elements. Recovery activities include resolving the cause of the fire, removing debris, and repairing the damage. In most cases, some or all employees will have to office elsewhere in the meantime.
It's absurd to believe that implementing a single generic disaster recovery plan for multiple office sites is wise. As you can see, there are many, many issues that must be identified and considered for each office.
I hope this helps. Thank you again for such important questions.
DR Dan
