[BCM] [PD] Develop the Plan [2a]: Procedure Development

 

Procedures are a series of steps conducted in a specific order to accomplish a task. Business continuity procedures are often grouped into corporate-level and business-unit-level procedures.

Corporate-level Procedures

Corporate-level procedures are those that apply across the organisation, like evacuation procedures during a fire.

Every business unit in the organisation is expected to follow the same procedure during a fire.

Corporate-level procedures may include incident response plans and recovery logistics.

If the organisation has already developed separate incident management, emergency response, or crisis management plans that address immediate response procedures, this step of the business continuity plan development cycle may be omitted.

Otherwise, the corporate-level procedures should include a section on incident management and emergency response, clearly outlining what should be done in the event of a significant disruption or disaster.

It would be helpful to include in this section how to identify a crisis event, the appropriate protocol (e.g., evacuation procedure), an assembly area, and a suggested route to reach it. When multiple documents/plans exist, it is crucial to align them so they harmonise seamlessly.

In contrast to incident response plans, which focus exclusively on how the organisation responds during a crisis, recovery logistics plans look at how the resources required for business recovery might be activated and deployed upon disaster declaration, e.g., by activating and preparing an alternate site.

Business Unit-level Procedures

Business unit-level plans are recovery plans specific to individual business units and functions. The focus of these plans would typically be on recovering tasks that are deemed to be ‘critical’ (see blog on business impact analysis).

Both corporate-level and business-unit-level procedures work hand in glove to achieve business recovery.

Inter-dependencies Considerations

When developing business continuity plans, it is essential to consider how the actions of one business function/unit affect other business functions/units.

For instance, Department A provides information crucial to Department B's critical business function.  Suppose Department A’s Recovery Time Objective or RTO were to be greater than that of Department B.

In that case, there is a distinct possibility that Department B would miss its RTO and not be able to resume its operations until Department A is back online. 

This dilemma arising from the inter-dependency between business functions/units should have been identified, and the choice of which option to go for should have been made during the strategy development phase.

To address this inter-dependency problem, Department A could reduce its RTO, or Department B could increase its RTO.

Alternatively, a temporary operating procedure (TOP) could be developed to bridge the time gap until Department A is up. Details of such methods must be carefully thought through and documented in the plan.

Also under consideration are interactions with external parties, such as customers, vendors, service providers, and regulators.

Since crisis communication is often covered under a separate crisis management plan, planners might want to concentrate more on the operational aspects of interactions in the business continuity plan.

 

For instance, who to notify for what types of disruptions, communication modes, workarounds or advice to customers, response times, types of reports to be submitted, and charges.