BCP…Regulations…Real testing…DR…Capacity…Capability…
Do you have an honest view of your ability to recover? How do you fix your resilience or recoverability, or even begin?
DR and BCP – How good is your DR and BCP capability? Ask anyone in a position of authority from the smallest firm to a well known national company and the response will likely be similar. “DR, BCP. Yeah we do that.” But when pressed, what you actually do for it, many many people don’t have a true grasp on it. There are lots of reasons for this. Some people truly don’t have a clue and just shrug it off. Others know the true state of their recoverability and just don’t want anyone to know for obvious reasons. Others are aware of their underinvestment in Business Resilience and it scares the pants off them. Still others think they have a good program but have no confidence that it will work.
Those are my observations from the unscientific research and work I have done in this field. We like to call it the ‘Dirty Little Secret’
Business Continuity, how could you not do that well? That’s an easy one. BC covers a broad spectrum of a business. I like to explain BC and DR as:
BC = people and DR = systems.
Whether BC or DR, to do them well, one needs to know what to protect and what to let go. Also, the amount of risk that can be absorbed by the business across its lines. This can be accomplished with a BIA, a Business Impact Analysis. Properly done it can actually save you money as you will know what and where to spend your scarce dollars to get the most bang for the buck. Refreshing it regularly (12-18 months) will ensure that you keep up with any growth or change in your business. Not only growth, but these days, contraction. You may be able to see where you can trim some of your spending.
DR and BC are similar to life insurance. Many times companies grow and grow and grow and DR/BCP gets put off until later. We need production systems, development systems, upgrade production….We can put off the DR upgrade to the next release. Once that is done, it is easy to put it off again and again. The result? Very similar to a family; young people get married and have a little insurance (enough to be buried if any at all.) Time marches on…a house, kids, cars… obligations. One day you take stock and oops, I have $10K of insurance and 1 million in needs.
Insurance, you can always go and buy and if you die before you get any….well, you won’t really care but your family will be pretty mad at you.
You business responsibilities on the other hand will have a direct impact on your livelihood. Fail to recover from a DR or BCP problem and you will be out of work. You may also be liable to regulators, state or federal authorities, and possible criminal liability if attestations of recoverability are made that turn out to be patently false. Rest assured, if you fail, the lawyers will be standing over the carnage looking to asses accountability. You do not want to be in that position.
Have an honest discussion with your CEO, CIO, COO or CFO. One or all of them are ultimately responsible for assuring the survival of the firm. If you or they don’t truly know the real score, conduct a test. If this is a problem, engage a contractor or consultant to design and administer one for you or to do an assessment.
If you know you are deficient, but not sure of where to focus, conduct a BIA. This will give you the tools to build a roadmap to recoverability. Whatever you do, don’t let your firm’s recoverability go unaddressed. You can make a difference and expunge the dirty little secret.
This post was prepared by John Manning, Associate Partner at Harvard Partners. 
He can be reached at john.manning@harvardpartners.com