The New BCM Manager: Develop the Plan

Plan development is the phase in the BCM Planning Methodology that follows strategy development. What is the difference between a strategy and a Plan?

A strategy is a general plan intended to achieve a goal and the means (a.k.a resources) to achieve it. A plan, on the other hand, focuses on laying out the details comprehensively and coherently.

This article focuses on planning, assuming that a strategy already exists. There are  three levels of planning:

1. Implementation plans
2. Procedure development
3. Plan writing

In the earlier BCM strategy phase (see blog on BCM strategy), we developed three strategies: mitigation strategies that focus on reducing the organisation's risk of catastrophic events and strategies that focus on how the organisation would respond to a disruptive incident.

Finally, recovery strategies focus on restoring critical business functions after a disruption.

These strategies may need to be consolidated for better management and coordination.

For example, several business units may require alternate site seats for business recovery; instead of allowing individual business units to search out their alternate sites, the Organization BCM Coordinator may need to consolidate the total number of alternate site seats required by various business units and set up one site to house all recovery teams. 

The BCM team would then have to turn these approved strategies into reality upon management approval. This is when Implementation plans are drawn up. 

Examples of implementation plans and documentation include terms of reference for BC teams and nomination of team members, coordinating and arranging for plan writing workshops, consolidating requirements for alternate sites and evaluation criteria, and plans for implementing an automated staff notification and accounting system.

Depending on the size and complexity of the organization, each of these may constitute a project in itself.

Procedures are steps to accomplish a task in a particular order or manner. Business continuity procedures are often grouped into corporate-level procedures and business unit-level procedures.

Corporate-level Procedures

Corporate-level procedures apply across the organization, like evacuation procedures during a fire. Every business unit in the organisation is expected to follow the same method. Corporate-level procedures may include incident response plans and recovery logistics.

Suppose the organisation has developed separate incident, emergency, or crisis management plans addressing immediate response procedures. This business continuity plan development cycle step may be omitted in that case.

Otherwise, the corporate-level procedures should include a section on incident management and emergency response, clearly stating what to do during a significant disruption or disaster.

It would be helpful to include in this section how to identify a crisis event, the appropriate protocol, e.g. evacuation procedure, an assembly area and a suggested route to reach it. In the case of multiple documents/plans, it is crucial to align the disparate plans to harmonize seamlessly.

In contrast to incident response plans, which look exclusively at how the organization responds during a crisis, recovery logistics plans look at how resources required for business recovery might be activated and deployed upon disaster declaration, e.g., activating and preparing an alternate site.

Business Unit-level BCM Plans and Procedures

Business unit-level plans are recovery plans specific to individual business units and functions. These plans typically focus on recovering critical tasks (see blog on business impact analysis).

Corporate and business unit-level procedures work hand-in-glove synergistically to achieve business recovery.

When developing business continuity plans, it is essential to consider how the actions of one business function or unit affect other business functions or units.

For instance, Department A provides information crucial for Department B to perform its critical business function. 

Suppose Department A’s RTO were greater than Department B's. In that case, it is possible that Department B would miss its RTO and be unable to resume its operations until Department A is back online. 

This dilemma arising from the interdependency between business functions/units should have been identified, and the choice of which option to go for should have been made during the strategy development phase. To address this interdependency problem, Department A could reduce its RTO, or Department B could increase its RTO.

Alternatively, a temporary operating procedure (TOP) could be developed to bridge the time gap until Department A is up. Details of such methods must be carefully considered and documented in the plan.

Interactions involving external parties like customers, vendors, service providers, and regulators are up for consideration.

Since crisis communication is often covered under a separate crisis management plan, planners might want to concentrate more on the operational aspects of interactions in the business continuity plan.

For instance, who to notify for what types of disruptions, communication modes, workarounds or advice to customers, response times, types of reports to be submitted, and fees.

In this final stage, the plan is assembled as a document. Before documentation, it is essential to structure the plan to be comprehensive in its content, readable, and easily referenced.

Aim to make the plan concise and action-oriented, and avoid overloading it with policy statements, risk assessments, and BIA data. 

I want to divide my plan into three parts.

• Part A introduces the plan, how to use it, and information that affects the organization, such as the locations of evacuation assembly areas and alternate sites.
• Part B details the corporate procedures chronologically, referencing other policies and procedures, if necessary.
• Part C is where individual business units will document their recovery procedures, specific to their critical business functions.

Every business unit plan will have a common Part A and B but a Part C specific to that particular business unit. Different organisations may format their plans differently depending on their size and structure.

Nothing is wrong with this - the critical thing to remember is to document the plan as appropriate to the organization.

I like to encourage planners to write their plans fairly detailed. By documenting procedures in detail, one can better visualize the process and detect inconsistencies and misalignment in time and space. The final plan is likely to be more realistic.

We want to be careful about over-documenting the plan, as it can become voluminous and unwieldy and lose its effectiveness in a disaster.

Need to Upgrade Your BCM Competency?

To learn more about the course and schedule, click the buttons below for the  BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].

 

	Please feel free to send us a note if you have any questions.