Edition No. 11

Planning Business Continuity Across Multiple Locations

There is no question that business continuity planning (BCP) is a business process issue, not a technical one. While each critical component of the enterprise must participate during the development, testing, and maintenance of the BCP process, it is the results of the business impact assessment (BIA) that will be used to make a case for further action. This is especially true when organizations have multiple locations.

Also in this Issue...

Increasing the ROI of Your Ergonomics Program

Mold Management: A Proactive Overview

And the Survey Says…
Results from the Priority Press Industry Survey

All too often, recovery strategies, such as hot-sites, duplicate facilities, and material or inventory stockpiling are based on emotional motivations, rather than the results of a thorough business impact assessment. The key to success in performing BIAs lies in obtaining a firm and formal agreement from management as to the precise Maximum-Tolerable-Downtimes (MTD), also referred to in some circles as Recovery-Time-Objectives (RTO), for each time-critical business process. The formalized MTDs/RTOs must be validated by each business unit, then communicated to the service organizations (i.e., IT, Infrastructure, Facilities, HR, critical virtual third party relationships, etc.) that support the business units. This process helps ensure that realistic recovery alternatives are acquired and recovery measures developed and deployed.

The Importance of a Business Impact Assessment

The intent of the BIA process is to assist the organization's management in understanding the impacts associated with possible threats. Management must then use that intelligence to calculate the maximum-tolerable-downtime for time-critical support services and resources. For most organizations, these resources include:

Personnel
Facilities
Technological Platforms (traditional and eCommerce-related systems)
Software
Data Networks and Equipment
Voice Networks and Equipment
Vital Records
Data
Supply Chain Partners

A properly conducted and communicated BIA is valuable to an organization because it: 1) identifies and prioritizes time-critical business processes; 2) determines MTDs/RTOs for these processes and associated supporting resources; 3) raises positive awareness as to the importance of business continuity; and 4) provides empirical data upon which management can base their decision for establishing overall continuous operations and recovery strategies and acquiring supporting resources. Therefore, the significance of the BIA is that it sets the stage for shaping a business-oriented judgment concerning the appropriation of resources for continuity planning, crisis management, and/or continuous or highly available operations.

Different Challenges for Small versus Large Companies

Small companies with one location approach BCP differently than organizations with multiple facilities. Single location companies have all of their eggs in one basket, so to speak; all time-critical business processes (TCBP) are centralized and a disaster at the location will affect them all. But for organizations with multiple locations, the BIA will determine which TCBPs are located at what facility.

It's critical to remember, not all mission-critical processes are time-critical. In any company, one third to one half of business processes are usually considered time-critical. An effective BIA will therefore eliminate up to one half of business processes so that the BCP is more streamlined. The practicality of doing a BCP across all processes in every location it just not cost-effective.

Working Globally

Figure 1 below presents a visual on how one might envision TCBPs across multiple locations. Categorizing business processes (technological platforms, data and voice communications, third-party virtual organizations and facilities) are represented by the horizontal blue bars. Vertical business units (locations) are represented by the vertical green bars. You can determine at which location time critical business processes exist. Then concentrate the BCP on those locations and processes.

Figure 1: Vertical and Horizontal Business Units

The goal of the BIA is to assist the management group in identifying time-critical processes and determining their degree of reliance upon support services. By mapping these processes to supporting IT, voice and data networks, facilities, human resources, third party business partners, etc. helps the identification. Time-critical business processes are prioritized in terms of their maximum-tolerable-downtime/ RTOs, so that executive management can make reasonable decisions as to the recovery costs and time frames that they are willing to fund and support.

EORM can assist organizations with multiple locations determine which TCBP are critical to their BCP process. For additional information, please click here.