David Drury asks if your business continuity plan is good enough

You have written your Business Continuity Plan (BCP) and the Board is satisfied that it will meet your needs. Everyone is happy that costs have been minimised by the use of in-house staff you can now get on running the business. After all, a disaster or adverse incident will probably never happen. If it does, you have plans in place to react to the situation.

While the above may be true, plans prepared entirely in-house without specific expertise or experience are more likely to be flawed in key areas. Without realising it, over familiarity with the company results in assumptions being made without the required discussion, and processes fail to be subjected to the appropriate level of scrutiny.

To the uninitiated, the plan can seem plausible. But how was it prepared? Was it treated as a project with a formal impact analysis? Was it given appropriate business support? Were all issues/options properly assessed? Were all business interdependencies, constraints and links with the support services, especially IT and Third Party contracts, properly established? Ultimately, your Company needs to be certain that the whole plan is co-ordinated, practical and workable.

What attention has been paid to meaningful testing? Testing typically raises several issues which, unless corrected, render the plan ineffective. Consequently, preparation time will have been wasted and, more importantly, the business will remain at risk. Furthermore, it is easy to make assumptions about staff availability and the way things will happen.

Remember also that staff may be in a state of shock. They must know what is expected of them, including knowing who will contact them and whom they in turn have to contact. And, if it is an event that affects a whole area, other companies may be vying for the same resources and movement may be restricted. You need to be assured that the test has been effective and any changes are reflected in the plan.

To remain effective, a properly tested BCP must be maintained. Unless it is a `living' document, embodied within the culture of the company and part of governance, it will simply gather dust and as the business evolves. It is important that the BCM processes are in place to ensure that it is kept up to date with further periodic tests.

To provide you with a greater level of objectivity, you might consider a short audit by an experienced, independent consultant. If you do, remember that the audit must be carried out with your team and build on the work already done. This is because each BCP is specific to the individual company and must be owned by it.

It is your team that will action it in the unfortunate event that it has to be initiated. It is imperative that your staff remain committed to the plan, understand it and, most importantly, are sure that it will work.