Business continuity planning (BCP) is the ongoing process of creating, testing, and maintaining the policies and procedures to follow in the event of disaster. It's the natural response to recognising that you cannot operate without your critical applications for more than 48 hours – far fewer for some companies – without suffering serious financial and business consequences (Source: Article reprinted with permission from SunGard Recovery Services Inc, The Journal of Business Continuity, Issue No 14, April 1999).

The process of developing a plan is commonly referred to as contingency planning, disaster recovery planning (DRP) or from a holistic point of view – business continuity planning. Irrespective of size, all organisations should, as part of their risk management processes, have a formal and comprehensive business continuity plan in place to lessen the effects of any potential disasters or disruptions.

Does your organisation have a plan?

Unexpected disruptions or disasters of any kind have the tendency to be viewed in a negative light. For example, the water contamination crisis that plagued New South Wales, the power cuts that practically crippled Auckland for two weeks, the gas crisis in Victoria or the 'I Love You' virus and the Ansett debacle. All these events have in common the upsets, customer dissatisfaction, losses, reputation and publicity problems etc. After the event, the ostensibly obvious questions are always asked:

• How could they have let it come to this?
• Why were they not better prepared?
• Where was the backup plan?
• Why were there no effective preventative measures in place?
• Why were our interests not protected?

Unfortunately although many organisations are aware of the many risks that may impact their organisations and generally have good intentions to develop plans to mitigate such risks, they never seem to actually get these plans done. The most common reasons relate back to – 'it's just too hard' and 'we just don't have enough resources to do our day-to-day tasks let alone prepare plans for the unexpected.'

In some instances the effects of a major disaster or disruption on a business can never be overcome, but generally being prepared for such events can lessen the overall effects and can help in the recovery process. With an increase in the number and frequency of natural disasters and the many economic, financial, legal, technology and other related disruptions that afflict organisations these days, management has to take appropriate steps to plan for such events. Furthermore, the existence of such a plan can also aid in minimising the threat of possible negligence claims, insurance, legal and other such disputes that commonly arise after major disruptions or disasters occur.

How does one go about compiling a business continuity plan? Because of the diversity of organisations, there is simply no one predefined way. However such a plan should be developed within a formal and consistent framework and should be geared towards attempting to answer the big 'what if' questions in a well thought out and systematic manner.

For example, what if, due to a natural disaster, there is no electricity or phone service for several weeks? What if, for an unforeseen reason, a primary supplier cannot maintain supply of a key input for an indeterminate period of time? What if, through the action of a disgruntled employee, the central computing facility was set alight and the fire suppression system was disabled?

Depending on the nature of the organisation, some methodologies require BCP or risk management specialist assistance while others can be prepared by the organisation without any external assistance or intervention. There are also some methodologies that are software based and that tend to ease the cumbersome tasks of planning, organisation, maintenance and dissemination.

Summary

Preparing for the unexpected and planning to minimise risks in an organisation is a difficult task but one that is becoming increasingly important. The biggest hurdle to overcome will be procrastination and the simplest thing to do to get that BCP under way is to simply get started.