Step 3: Develop a BCP Framework

Develop BCP Framework

Many organizations that I have reviewed have told me that their BCP policies are an enhancement or hybrid of several other organizations‟ policies. I strongly encourage this approach as it minimizes the need to re-invent the wheel. I must however caution that although most organizations share common basic BCP policies, it is essential for each organization to tailor its policies to specifically meet its own unique corporate requirements. The start of the framework development begins with a clearly defined strategic vision for the BCP.

 Here is a simplified approach to developing the BCP framework.

Identify Strategic BCP Mission

The strategic mission differs for each organization and here are some examples:

• Fulfilling fiduciary responsibilities
• Compliance
• Risk reduction
• Readiness

This is usually derived from a brainstorming exercise with the Executive Management.

The entire framework is directed by three key components: Policies, Processes, and People. All three components should be directed towards one agreed BCP strategic mission. The example that I will be providing is “BC Readiness” or how the organization strives to keep itself prepared for any outages.

Key Components of BCP Framework

Framework Components

This is a description of the key components for a BCP framework.

People

In this component, you will attempt to identify the key committees that will manage the BC planning effort. They are the BCP Steering Committee and the Working Committee. The various key personnel such as the Chief Executive Officer, the Organization BCM Coordinator, and the BU BCM Coordinators will be included.

Policies

Additional policies will be generated under this component. The key BCP policies identified should aim to:

• Create awareness of BCP
• Sustain its effectiveness
• Reinforce its importance within the organization

Processes

• Reduce
• Respond
• Recover and Resume
• Restore and Return

“Drill Down” of BCP Framework

 Using any one of the key components as a start point, identify a PEOPLE-, POLICIES-, or PROCESSES-related requirement that you have considered for your BCP implementation which is directed towards the BCP strategic mission.

Key Components of BCP Framework

• Mission
  When the strategic BCP mission is to ensure “BC READINESS” within your organization, you will ask, “How does the “PEOPLE” component ensure “READINESS”?
  
  
• People
  Let us use the “ability to contact your staff members (PEOPLE) during an activation of a BC plan.”
  
  
• Policies
  What is the policy to ensure this step is designed to lead to “READINESS”? The policy is to ensure that the “notification procedures are adequate.”
  
  
• Processes
  What is the process to ensure that the notification procedures are adequate to meet the mission of “READINESS”? The process will be to ensure that each member has an updated notification list and is contactable.
  
  
• People
  How does each staff member hold an updated list and remain contactable after office hours? Each staff must have an updated list in his or her wallet/purse and also a copy at home.

This is an iterative process and it continues with asking the questions in the areas of “PEOPLE,” “POLICIES” and “PROCESSES.”

The key components of a BCP Framework: People, Policies and Processes, will be documented as policies, standards and guidelines. The definitions of these terms are as follows:

Policy

 A policy is a broad statement of principle or intent that presents the Executive Management's position on a particular issue or indicates a strategy, plan, or course of action. Policies are interpreted and supported by appropriate standards.

Standard

 A standard is a rule or regulation that specifies conduct, a course of action, or a response to a given situation. Standards are mandatory directives for implementing the Executive Management's policy and ensuring uniform compliance. Standard denotes the benchmark or key performance indicators (KPI) that the business units are expected to meet as part of the overall organization's requirement.

Guideline

 A guideline is a statement that recommends or suggests conduct, a course of action, or a response to a given situation. Guidelines should be considered when implementing a new business function, when moving to a new facility, or when dealing with a set of circumstances that, although outside the scope of a standard require a prudent response.

Policy Types

The BCP “policy” I refer to in this book is specific (or functional) and not “organization-wide policy.” The policies generally refer to those that are distinct from the BCP standards and guidelines. Figure 7-2 is the policy hierarchy chart, which provides an overview of the types of policies that many Organization BCM Coordinators often find difficult to implement.

Hierarchy of Policies, Standards, and Guidelines

I strongly recommend that policies be considered the first and highest level of documentation, from which the lower-level elements of standards, guidelines, and procedures flow. This order does not imply that policies are more important than the lower elements.

The higher policies, which are the more general policies and statements, should be created first in the process for strategic reasons, and then the more tactical elements can follow.

The first policy is the Statement of Policy from the Executive Management. This is generally a high-level statement of a policy that contains the following:

• An acknowledgement by the Executive Management of the importance of BCP
• A statement of support for BCP throughout the organization
• A commitment to authorize the definition of the lower level of statements and guidelines

Example of Policies, Standards and Guidelines

This is to illustrate a sample of the outcome of a drill down in the framework to develop policies, standards, and guidelines. A policy statement will provide the reasons, the organization's goals and expectations, and the assumptions and parameters for BCP.

Policy for Notification Procedures

• To ensure the effective and timely notification of staff in the event of BC plan activation, each BC plan will contain notification procedures.

Standards

• Each business unit will maintain an updated notification call tree list of home and office telephone numbers (mobile/cellular telephone and pager numbers, if applicable) for all employees.
• The list of telephone numbers will be included in the business unit's BC plan.
• The list will clearly indicate the calling sequence and the individual responsible for making each contact. The list will include designated alternates if the primary person cannot be contacted at the time of the disaster situation.
• The list will include names and telephone numbers of any individual outside the business unit whose notification initially and/or on an ongoing basis are the business unit's responsibility.
• Each BCP team member will have an updated notification list at home.
• The notification procedure will include instructions to contact a member of the corporate crisis management team.

Guidelines

• In creating the notification list, consider the availability of individuals and their transit times.
• The notification list should identify individuals who have specific recovery responsibilities and those who are to delay reporting to work.

Develop Corporate BCP Policy

The development of the BCP Framework is immediately followed by a policy directive, stating their commitment to BCP in general, and this project in particular. If they agree to this request, the BCP project will have gained a great deal of credibility. If they would not agree, you will at least have been forewarned that the Executive Management's support for the BCP project is lukewarm at best and that you should proceed cautiously.

Conclusion

 A policy statement from the Executive Management is the most important indication of support to the appointed Organization BCM Coordinator and the organization's commitment to the BCP Program.