Business Continuity Planning: An Ounce of Prevention

Certain things aren’t so fun to write. Wills, for example, are one thing that people tend to put off. After all, few people like to think about their own mortality. Plus, death always seems so far away -- there will be time in the future to deal with it, right?

From a corporate perspective, disaster recovery plans fall into the same category. First off, the whole exercise can feel morbid. And, secondly, it’s never really going to happen to your company, will it?

Recently two events within this organization prompted some overall business continuity planning thoughts and validated some of the work that we’ve done to “prepare for the worst, but hope for the best.”

The first: Construction and major roadwork. As you may know, Digital Echidna is currently surrounded by construction. On three sides, we have roads and sidewalks torn up, foundations being dug, and buildings being repaired (and on the fourth side? No exit.) So there’s an increased risk for something going wrong. Over the past couple of weeks, we’ve lost power a couple of times -- and the gas-powered generator kicked in both times to keep lights on, doors open. Everything was up and running as it should.

The second event? Half our staff leaving to attend the annual DrupalCon event. The event is always in another country and takes quite a bit of planning to pull off. We have a communication plan in place during this time, ready to triage issues that might arise while our group is either on the road or a visitor in another country. 

When thinking about disaster recovery as part of a larger business continuity plan, you want to focus on a few key ideas:

• Prevention -- how do we prepare for potential disruptions and try to mitigate the damage?
• Discovery -- is there a plan in place to detect potential issues in and around your workplace?
• Mitigation -- if something happens, how can you fix the situation?

Business continuity is a pretty cold term. The implied focus is on getting the business up and running and keeping our customers happy. And while business is important, the first thing you’ve got to think about is people. Buildings and equipment can be replaced; people can’t.

We’re focused on our employees’ safety. We have an active health and safety committee, we have an AED on site, we run fire drills (more or less successfully, admittedly), and we’re always trying to improve our processes and procedures to ensure people are safe.

But there are broader issues that need to be addressed. At a previous job, I was responsible for writing a disaster recovery plan -- and there’s a lot to think about:

• Travel: Must multiple senior managers or staff travel together, through the same airports or on the same train or car?
• Triage: who controls the message? How do you effectively share information if, say, the building needs to be evacuated? This is important not just for media, but also for the worried families of staff.
• Training: do people know what to do or where to go if they do have to leave the building? How are new employees onboarded with this information? Do they know who the contacts are in case of an emergency? Who to call?
• Accessibility: what procedures are in place for staff with disabilities? Are there assigned supports? Are there any barriers that can be removed?
• Local hazards: are there chemicals or equipment on site? Are there increased risks for certain situations (electricity goes out etc.) that need to be addressed based on the type of business you are?

It can be a process to go through every potential risk that you have -- and it can be time-consuming. Many of the discussions centre around, “how do we deal with mass carnage?” which can either be very stressful or encourage gallows humour (depending on who you are). And it can feel overwhelming.

There’s also a balance. You can write a 300-page disaster recovery plan that meticulously details every potential instance and eventuality, but will your staff read it and memorize it? Will the important details that they need to know be undermined by the volume of content.

One of the key tenets of first aid is that doing something is better than doing nothing. Whether you’re a company of two or 202, starting somewhere and documenting plans, getting first aid training, and walking through scenarios with your team is a great place to start.

You don’t have to solve all the potential problems in advance, but getting a handle on what is most likely and putting in place controls that mitigate those risks, can help you deal with challenges when they arise.

And remember, disasters don’t have to be catastrophic. After all, losing power may not seem like a catastrophe, but it can be critical to your customers. Having a fail-safe in place can minimize those risks.

Hopefully, you’ll never need to use a business continuity or disaster recovery plan. But, like a will, after the fact is too late to get started. We may not like to talk about accidents and injury, but planning for the worst can help make the best of a bad situation.