Develop the Plan [2a]: Procedure Development

 

Procedures are a series of steps conducted in a certain order or manner to accomplish a task. Business continuity procedures are often grouped into corporate-level procedures and business unit-level procedures.

Corporate-level Procedures

Corporate-level procedures are those that apply across the organization, like evacuation procedures during a fire. Every business unit in the organization is expected to follow the same procedure during a fire. Corporate-level procedures may include incident response plans and recovery logistics.

If the organization has already developed separate incident management plans, emergency response plans, or crisis management plans that address immediate response procedures, then this step of the business continuity plan development cycle may be omitted. Otherwise, the corporate-level procedures should include a section on incident management and emergency response, clearly stating what needs to be done in the event of a major disruption or disaster.

It would be helpful to include in this section how to identify a crisis event, the appropriate protocol, e.g. evacuation procedure, an assembly area and a suggested route to take to reach it. In the case where multiple documents/plans exist, it is important to align the disparate plans such that they harmonize seamlessly with each other. In contrast to incident response plans which looks exclusively at how the organization respond during a crisis, plans for recovery logistics look at how resources required for business recovery might be activated and deployed upon disaster declaration, e.g. activating and preparing an alternate site.

Business Unit-level Procedures

Business unit level plans are recovery plans specific to individual business units and functions. The focus of these plans would typically be on recovering functions that are deemed to be ‘critical’ (see blog on business impact analysis). Both corporate-level procedures and business unit-level procedures work hand-in-glove synergistically to achieve business recovery.

Inter-dependencies Considerations

When developing business continuity plans, it is important to consider how the actions of one business function/unit affect other business functions/units.

For instance, Department A provides information crucial for Department B to perform its critical business function.  If Department A’s Recovery Time Objective or RTO were to be greater than that of Department B, there is a distinct possibility that Department B would miss its RTO and not be able to resume its operations until Department A is back online. 

This dilemma arising from the inter-dependency between business functions/units should have been identified, and the choice of which option to go for should have been made, during the strategy development phase. To address this inter-dependency problem, Department A could reduce its RTO, or Department B could increase its RTO.

Alternatively, a temporary operating procedure (TOP) could be developed to bridge the time gap until Department A is up. Details of such procedures must be carefully thought through and documented in the plan.

Up for consideration are also interactions involving external parties like customers, vendors, service providers, regulators. Since crisis communication is often covered under a separate crisis management plan, planners might want to concentrate more on the operational aspects of interactions in the business continuity plan.

 

For instance, who to notify for what types of disruptions, communication modes, workarounds or advice to customers, response times, types of reports to be submitted, fees and charges.

 

Read more about the specific topics:

More Information About BCM Blended Learning

 

To know more about our blended learning program and when the next course is scheduled, feel free to contact our friendly course consultant colleagues via sales.ap@bcm-institute.org.  They are the BL-B-3 Blended Learning BCM-300 Business Continuity Management Specialist Implementer and the BL-B-5 Blended Learning BCM-5000 Business Continuity Management Expert Implementer.

Please feel free to send us a note if you have any of these questions to sales.ap@bcm-institute.org