by Don Hughey, Senior Consultant, Strohl Consulting Services

When a business entity recognizes the need to develop a prudent corporate posture to survive today’s unexpected disruptions, it’s necessary to take a fresh perspective of the company’s mission-critical operations and its individual operating units. However, the mission-critical functions of the company may not be as obvious or apparent as they once were. Taking stock of priorities before proceeding is essential in today’s world of morphing industry. Today, we find company dynamics complicated by mergers and acquisitions. Workflow that once moved independently within separate organizations now must come together in a new stream. The new organization’s processes and supporting automation may consist of many separate design and development efforts. So how does one start?

   Prior to developing and documenting a recovery program, it is wise to revisit the entire organizational structure. It is important to identify the specific areas that provide the primary financial contributions or operational controls necessary to keep the company viable.

   This process should begin with understanding and defining the recovery requirements. The most important of these requirements is reestablishing each business function with an adequate recovery time-window for each. It is essential to ensure that the correct and most cost-effective recovery strategies are chosen.

   The business impact analysis (BIA) has evolved as the recognized vehicle for defining and documenting business continuity requirements. However, the BIA, or its equivalent, should analyze the business processes needed to define the type of programs requiring implementation. In some cases, the financial loss may be so great, or the operational controls so critical, that providing for uninterrupted production is necessary.

   When establishing a business continuity planning (BCP) team, it is imperative that each operating unit assigns a business coordinator(s) and department level participants to assist the BCP team.

   The business coordinator will be expected to do the following:

• assist the BCP team to define the specific business functions within the operating unit
• assist in developing or approving a specific business unit’s BIA questionnaire
• provide work space at the operational site for the BCP team’s presentations, interviews, and workshops when necessary
• identify the proper BIA participant from each business function to assist in defining the unit’s recovery requirements
• assist in scheduling meetings with the BCP team and its participants
• coordinate the distribution, completion, and collection of BIA questionnaires
• schedule presentations of the BIA findings and recommendations to the proper steering committees 

   The BIA questionnaire should contain questions intended to gather all information listed as expectations from the participants. Questions should be designed to lead the participants through a logical thought process. The questionnaire should begin with something simple and familiar, such as describing the functions of a department. Impacts should be considered by timeframes—such as the first day, second day, first week, second week, etc.—progressing through the first potential month of disruption. 

   Participants must be knowledgeable in the operations of their business functions, including the unit’s operational impact and the financial implications of a business disruption. Disruptions may or may not include the availability of the operating unit’s location, as well as the interruption of supporting technology platforms. These facilities are obviously dependent on various utilities such as power, water, and communications.

   The participant will be asked to provide information, such as the following:

• description of the service performed by the unit
• operational controls affected by potential disruptions
• financial implications of disruptions
• staffing levels currently supporting the business function of an operating unit (both employees and contractors)
• minimum staffing levels to operate under emergency conditions, including special contracted skills
• resources required by the operating unit in normal conditions and over time, such as work space, office equipment, communications (both voice and data), computing platforms and application systems, and vital records and supplies
• critical time periods for the business function
• backlogs of work in normal course of business and backlog accumulation during downtime
• historical data relating to previous disruptions
• special skills or licensing required for staffing the business function
• dependencies on internal and external sources for the workflow of the business function
• reliance of internal or external functions and units on the information or service supplied by the business unit

   Several methods are effective for answering the BIA questionnaires. Here are two:

1. Distribute the questionnaires to the participants after reviewing their content and intent. The participants can answer the questions at their own pace and return them for review. This method should be followed by an interview with each participant to resolve any issues found in the initial review.
2. Bring the participants together in a workshop and have the answers provided by the participants. This method requires a major research and planning effort on behalf of the moderator prior to the workshop in order to move through the questionnaire in reasonable time.

   After the BIA questionnaires are completed, the process of analysis and summarization can begin. Analysis and reporting findings are the key to obtaining management concurrence and funding. 

   As we move into the next century it will continue to be important to take stock often of your BCP efforts and methodology to keep up today’s changing industry climate. It will also be increasingly important to account for flexibility when setting standards. In the next article we will touch on these issues as well as take a closer look at analysis and reporting.