10 ways to improve Business Continuity Plan Exercise, Audit, and Maintenance – tip 10 maintenance plan

Your organization has now invested valuable time and money developing business continuity plans. As a professional business continuity planner, you know that the next steps – exercising, auditing and maintaining the business continuity plans – are all important to successful resilience in the event of a disaster. In this article, I will provide 10 tips to advance your business continuity plan exercise, audit and maintenance program.

MAINTENANCE PLAN

If a proper maintenance plan is not in place, your plans could become outdated quickly.

Tip #10 Arrange to review and update the plan just prior to audits and annual exercises

If the results of the exercise and audit are given the appropriate attention by the organization, those involved in the plan will be motivated to prepare for these events by updating business process information.

If you schedule one minor exercise per business section, an annual major exercise and an annual audit, it translates into three major updates of the plan per year. Add in some method of determining turnover in key business continuity roles and your plan will continue to be relevant year after year. One simple suggestion is a monthly business continuity plan e-mail newsletter sent to everyone named in the plans. When an e-mail bounces back, you should follow-up with your other contacts in the unit for a staffing update.  When other colleagues find themselves in a new role, they will often contact you to redirect the newsletter.

Also try to work with your organization’s Project Management Office and other change managers to play an advisory role in meeting the organization’s business continuity standards before new projects “go live”. The upfront time investment is much less when compared to working on plans and strategies after the project is operational.

Following these ten manageable tips will have a constructive impact on your business continuity plan exercise, audit and maintenance programs. Please speak with us for further information on any of these ideas.

(For more information on DRI’s professional practices please read Professional Practice Eight – Business Continuity Plan Exercise, Audit, and Maintenance DRII Professional Practices June 1, 2012 Version 1)

‘When planning for war, I have always found plans to be useless, but planning to be invaluable.’ General Eisenhower

Advertisements

10 ways to improve Business Continuity Plan Exercise, Audit, and Maintenance – tip 9 Audit

Your organization has now invested valuable time and money developing business continuity plans. As a professional business continuity planner, you know that the next steps – exercising, auditing and maintaining the business continuity plans – are all important to successful resilience in the event of a disaster. In this article, I will provide 10 tips to advance your business continuity plan exercise, audit and maintenance program.

AUDIT

Tip #9 Arrange an Audit

An audit in the private sector can be powerful for obtaining senior management support for business continuity upkeep and improvement. Executives are familiar with the audit process and are likely to see the merit in the recommendations of an auditor. You can also successfully argue that an audit should be presented by the sponsor to the Board of Directors.

Audits can also be high-profile in public sector organizations. Some have mandatory audits. Your department may post the results publicly, or details of any audit may be requested through Access to Information legislation. Certainly any audit could receive media scrutiny. It is vital that you prepare well in advance for the assessment, given its overall importance.

Understanding what the auditors or reviewers are looking for will help the audit run smoothly. It will also help you to enrich the business continuity management program in your organization in the process. Ideally, the plan should be audited by an independent auditor to ensure objectivity. During the engagement process, you should review plan expectations with the auditor and determine what set of standards will be used. Together with the auditor, you should set audit objectives and scope, and assess and select the audit method. The audit process should examine the administrative aspects of the BCM process, the plan’s structure, contents and actions sections, and the plan’s documentation control procedures. An audit should be conducted at least annually.

(For more information on DRI’s professional practices please read Professional Practice Eight – Business Continuity Plan Exercise, Audit, and Maintenance DRII Professional Practices June 1, 2012 Version 1)

‘When planning for war, I have always found plans to be useless, but planning to be invaluable.’ General Eisenhower

10 ways to improve Business Continuity Plan Exercise, Audit, and Maintenance – tip 8 hotwash

Your organization has now invested valuable time and money developing business continuity plans. As a professional business continuity planner, you know that the next steps – exercising, auditing and maintaining the business continuity plans – are all important to successful resilience in the event of a disaster. In this article, I will provide 10 tips to advance your business continuity plan exercise, audit and maintenance program.

Tip # 8 Debrief the participants after a short break

At the conclusion of the exercise scenario, it is always good to allow the exercise participants a short break before proceeding with the exercise debrief. This allows for time needed to get minds and thoughts out of the exercise scenario and focused back in the ‘real’ world.

The purpose of the exercise debrief is to seek feedback regarding:

  • What was learned during initial incident response?
  • What was learned during the operational relocation, restart and recovery?
  • Feedback from observers:
  1. What happened?
  2. What went well?
  3. What could we improve?
  • What have you learned about exercising?
  • What are the next steps?

Get this information while it is fresh in the minds of participants. You should also follow-up the next day. People will have valuable things to add after a night’s sleep.

(For more information on DRI’s professional practices please read Professional Practice Eight – Business Continuity Plan Exercise, Audit, and Maintenance DRII Professional Practices June 1, 2012 Version 1)

‘When planning for war, I have always found plans to be useless, but planning to be invaluable.’ General Eisenhower

10 ways to improve Business Continuity Plan Exercise, Audit, and Maintenance – tip 7 research injects

Your organization has now invested valuable time and money developing business continuity plans. As a professional business continuity planner, you know that the next steps – exercising, auditing and maintaining the business continuity plans – are all important to successful resilience in the event of a disaster. In this article, I will provide 10 tips to advance your business continuity plan exercise, audit and maintenance program.

Tip # 7 Prepare well researched problem sets or injects

Create injects (a set of problems or complications) that the team may encounter as the scenario plays out. They can be used to create realism or to guarantee certain areas of the plan are tested. If the team seems well prepared to handle the initial complexity of the scenario, injects can create a more challenging exercise. They can also be used to bring the exercise back on track if it seems to be slipping. Have a few extra up your sleeve and use as necessary.

There is no substitute for thorough research prior to the event. Reference material may be required wherever you introduce any aspect of a scenario that may be challenged. If the scenario includes responding to damage caused by a letter bomb, you must be prepared with an authoritative response to any number of questions, including how the bomb was prepared and delivered and the extent of the damage it would have caused. Without an appropriate response, you will lose the attention and support of participants. A good exercise script will also require thorough research on the language and terminology to be used in any given scenario.

You may need to develop checklists, along with reference materials, to support the script. Checklists are a convenient way of collecting data in order to avoid relying on memory alone to cover each detail of the exercise.

(For more information on DRI’s professional practices please read Professional Practice Eight – Business Continuity Plan Exercise, Audit, and Maintenance DRII Professional Practices June 1, 2012 Version 1)

‘When planning for war, I have always found plans to be useless, but planning to be invaluable.’ General Eisenhower

10 ways to improve Business Continuity Plan Exercise, Audit, and Maintenance – tip 6 create realism

Your organization has now invested valuable time and money developing business continuity plans. As a professional business continuity planner, you know that the next steps – exercising, auditing and maintaining the business continuity plans – are all important to successful resilience in the event of a disaster. In this article, I will provide 10 tips to advance your business continuity plan exercise, audit and maintenance program.

Tip # 6 Create Realism for the Participants

Realism can make a positive lasting impression on the participants increasing their knowledge retention as well as your credibility. Add authenticity by creating news broadcasts, radio weather warnings, or video footage. Be imaginative in injecting details through actual telephone calls or e-mails, or even an interactive web portal. Hold mock interviews with journalists, emergency services personnel, suppliers, customers or other interested parties. Realistic details will make things easier and more relevant to your teams.

(For more information on DRI’s professional practices please read Professional Practice Eight – Business Continuity Plan Exercise, Audit, and Maintenance DRII Professional Practices June 1, 2012 Version 1)

‘When planning for war, I have always found plans to be useless, but planning to be invaluable.’ General Eisenhower

10 ways to improve Business Continuity Plan Exercise, Audit, and Maintenance – tip 5 credible scenario

Your organization has now invested valuable time and money developing business continuity plans. As a professional business continuity planner, you know that the next steps – exercising, auditing and maintaining the business continuity plans – are all important to successful resilience in the event of a disaster. In this article, I will provide 10 tips to advance your business continuity plan exercise, audit and maintenance program.

Tip # 5: Choose a scenario that is stimulating and vivid, yet credible

The scenario needs to explore the exercise objectives and to engage your people. Begin by reviewing your threat and risk assessment and choose a scenario that has a medium to high probability of occurring. If you choose an implausible event such as a meteor impact you will lose credibility and team discussions may centre on the unlikelihood of the event versus realizing the objectives of the exercise.

Like any action-packed Hollywood blockbuster, an exciting scenario will draw the participants in. In order to create a challenging exercise for the crisis communication team, the story should be one that the media would pick up on. However, the scenario should not be overwhelming and should not contain obscure or technical implications which might confuse the team or open the way for you to lose control or credibility. It should set up a challenge which is likely to stretch the team’s capabilities.

You might want to create your own database of possible scenarios. Research famous events or track unique current incidents. Take note of reported details and understand the effects on the organization, so that you can incorporate realistic details.  Follow the story over several days and note how the organization responded.

Finally, do not forget to use both your reason and imagination in developing the plot of the exercise.

(For more information on DRI’s professional practices please read Professional Practice Eight – Business Continuity Plan Exercise, Audit, and Maintenance DRII Professional Practices June 1, 2012 Version 1)

‘When planning for war, I have always found plans to be useless, but planning to be invaluable.’ General Eisenhower

10 ways to improve Business Continuity Plan Exercise, Audit, and Maintenance – tip 4 start simple

Your organization has now invested valuable time and money developing business continuity plans. As a professional business continuity planner, you know that the next steps – exercising, auditing and maintaining the business continuity plans – are all important to successful resilience in the event of a disaster. In this article, I will provide 10 tips to advance your business continuity plan exercise, audit and maintenance program.

Tip #4: Start with a simple straightforward exercise

Effective exercising is about learning to ‘walk before you run’. It is important that the type and scale of exercise is in line with the organization’s Business Continuity Management maturity. Participants should come away with a positive feeling, believing that they have reached a challenging goal. Raise the bar over time as the skill set of the organization develops.

Construct exercise scenarios using several different levels of complexity. Jim Burtles, FBCI, of Automata Global Business Continuity Services, identifies five distinct levels of exercise complexity:

Level One – Single site; simple scenario involves a single location which is affected by one impact on its premises, infrastructure or systems.

Level Two – Single site; complex scenario involves a single location which is affected by more than one impact on its premises, infrastructure or systems.

Level Three – Multiple site; simple scenario involves multiple locations which are affected by the same single incident or its ramifications. More than one target team is likely to be involved at this level.

Level Four – Multiple site; complex scenario involves multiple locations, which are affected by the same complex set of impacts or their ramifications. Several target teams are likely to be involved at this level.

Level Five – Multiple site; multiple scenario involves a number of separate incidents occurring at a number of sites during the period of the exercise. These incidents may occur more or less simultaneously in different countries and in differing time zones. Many teams are likely to be involved in an exercise of this scale.

As your teams progress through each level, their confidence and their understanding of their role in the business continuity plan will grow.

Mastering Exercise Development”, Jim Burtles, Automata Ltd, March 22, 2005, Continuity Central

(For more information on DRI’s professional practices please read Professional Practice Eight – Business Continuity Plan Exercise, Audit, and Maintenance DRII Professional Practices June 1, 2012 Version 1)

‘When planning for war, I have always found plans to be useless, but planning to be invaluable.’ General Eisenhower

  • Be Prepared

  • Professionals

  • Categories