Frequently Asked Questions (FAQs)

foundation of a business continuity plan
business continuity planning vs. disaster recovery
crisis management
who gets involved in business continuity planning
reasonable timeframe to get a plan in place
how long will the plan take to develop
can the plan be accomplished in phases
where do I start planning
must planning go beyond recovery of IT functions
how to reduce impact of single or sole source supplier
can I learn the planning process myself
advantages and disadvantages of planning software
possible effects of terrorist activity
planning beyond evacuating the building

Links

Green Oak Solutions' Links section supports the key aspects of an effective Business Continuity Management program by highlighting resources to support the key actions in planning and response. Visit our Links page for more information.

Business Continuity Planning - FAQs

What would you consider to be the foundation of a Business Continuity Plan (BCP)?

The foundation of any business continuity plan is the protection, prevention and mitigation of risks. Most facilities are subject to risk of fire and/or explosion risks, or adjacent transportation exposures. Other locations may be threatened by natural hazards such as flood, hurricane, or earthquake. Business risks can also include product contamination, regulatory violations, environmental damage, or employee injury. The identification of which risks your company is exposed to is the natural starting point for any BCP. Once identified, risks can be quantified as to severity so that a prioritized loss prevention and response strategy can be developed.

We believe that mitigation is the purest form of planning, and that all planning efforts should first ask the question as to whether a given risk can be mitigated, versus being planned "around."

Other issues, such as senior management commitment and a company's will to develop the plan are critical; however, the foundation of the plan should be mitigation of key risks. Where risks cannot be reasonably mitigated, then plans should be developed to address the residual exposure that remains due to unmitigated exposures.
[Back to top]

What is the difference between Business Continuity Planning and Disaster Recovery?

The term continuity infers that there is no break in service. A comprehensive Business Continuity Plan is designed to get the business back to the state of affairs where it was before a loss. The process, simply put, is to identify potential risks, determine how best to reduce these risks, what risks will impact the business most, and how to develop plans that will limit the extent of operational downtime. These plans can address events both minor and major in magnitude, with the ultimate goal of maintaining customer satisfaction.

The term Disaster Recovery would imply that the organization has suffered a loss of a large magnitude. This may even involve events of regional impact such as earthquake or hurricane that will strain available local resources. Your disaster recovery plan will address these worst case scenario occurrences. In the field of Business Continuity Planning, Disaster Recovery also refers to restoration of computer operations, and this is a specialized area of recovery planning. Technology and systems available today will allow “shadowing” or “mirroring” of data.
[Back to top]

What is Crisis Management?

Green Oak Solutions suggests that a Crisis Management Plan (CMP) be developed as part of every Business Continuity Planning effort. The CMP can be used at facility level, and can also be developed at the Corporate level to address key risks at the Enterprise level.

The intent of Crisis Management is to limit the extent of negative impacts to important organizational values, functions and services. As such, the focus of a CMP is to keep an incident from increasing in intensity and adversely affecting an organization. An organization can have a crisis with no loss of people, facilities or technologies.

Review the "Operation of the Business Continuity Plan" flowchart in our resources section to see how the CMP fits into the overall response sequence.
[Back to top]

Who will need to be involved in the Business Continuity Planning (BCP) process?

The process will need senior level sponsorship– Vice President or Director level sponsorship shows that it has the backing of senior management.

Project Management - We suggest that companies assign a project manager to oversee the overall development project.

Site Management - If a project spans between multiple locations each location should have a project manager to spearhead the local planning effort.

Project Owner - Every plan should be owned at two levels. The administrative owner is responsible for overall plan administrative aspects such as maintenance, updating, storage and retrieval of the plan. The content owner of the plan is assigned at the plans operations level and this responsibility is usually given to the team leader for a given plan. Content ownership refers to the responsibility to keep the document up to date and current in the context of the particular plan.

Project Participants - Ideally the process will involve the following individuals plus their key members of staff:

Facilities Manager
Controller
Human Resources Manager
Production/Operations Manager
Safety/Security Manager
Logistics
Individual business unit managers or directors
Technology: IT/IS, logistics or other technology support
Quality Assurance
Legal
[Back to top]

I have been told by Corporate that my division needs to get a Business Continuity Plan in place by the end of this quarter. Is this reasonable?

The development of a full and complete BCP varies by company and type of business.

Completion of all of the planning elements we recommend may be possible in three months; however, the bulk of our engagements take a bit longer. The use of our proprietary templates allows for quicker project completion. The primary factors that drive this are the amount of time that the project manager has to spend on the project, the size and complexity of the location, and the number of planning elements that need to be developed.
[Back to top]

How long will it take to get the plan developed?

Again the amount of time that it takes to develop the plan depends upon the complexity of operations at your facility, and the number of people involved in the development of a plan along with the amount of time that they have to devote to the project.
[Back to top]

Will I need to develop the entire plan now, or can this be accomplished in phases?

We believe that all elements of the Business Continuity Plan should be developed in a sequential manner. If a commitment to planning exists, then all elements of the plan should be developed. If only a portion of the plan is developed, then your response approach is incomplete.

At a minimum the plan should include the Emergency Response Plan, Crisis Management Plan, and Business Recovery Plans for operating units.
[Back to top]

My company may have several critical functions that will need a recovery plan, where should I start?

The best place to start is to carry out a Needs Assessment to review all areas of the business and to get acceptance from all areas of the business as to the most critical functions and then to proceed on from there. The Needs Assessment allows management to identify the primary areas of concern, and properly prioritize the planning activities. It defines and analyzes the organization, and then identifies criticality within the company. It specifically focuses attention upon functions which will cause impairment of multiple portions of an organization if lost or curtailed.

If carried out correctly, the Needs Assessment can be expanded to also entail a high level Business Impact Analysis. Many times the Needs Assessment can supplant the need for a full Business Impact Analysis. See our white paper on the value of Needs Assessments in the resources section of the site.
[Back to top]

I already have plans in place for my IT department; surely I don’t need to do anything else?

At many organizations, plans may exist at an intuitive level, be part of normal operations planning, or may even be formally documented. One area that is typically addressed is recovery of computer operations.

While it is beneficial to have plans for recovery of specific and critical business functions, a complete business continuity plan will deal with the recovery of all areas of your operations. Technology overall is a critical enabling function required by businesses today in order to maintain efficient operations. Planning in this area is critical; however, we approach technology as one of many critical functions within the organization.

To have an effective plan, you need to consider all of your critical functions, and not just IT or technology.
[Back to top]

If it is determined that an exposure exists due to a single or sole source supplier, is there anything I can do about it?

There are several strategies that can be employed to reduce the impact of a single source supplier. First, it should be determined if the supplier has a business continuity plan of their own (i.e. backup manufacturing facility), and how effective the plan will be. We suggest that the project involve purchasing staff who are responsible for identification of suppliers.

Another strategy will involve cultivating alternate suppliers for these components, such that the secondary source will provide only a portion of the total needs, yet their output could be increased over a short period of time to meet 100% of total demand. This is a difficult issue that frequently surfaces due to excess manufacturing capacity being limited, and companies' desires to align with single source suppliers.
[Back to top]

Can I do the work myself with some training?

Green Oak Solutions recommends that project managers who are assigned the duty of developing a Business Continuity Plan be trained in process and in the methods of developing the plan. We have designed our site for this purpose. There is a tremendous amount of educational materials available on the web that can support a self education effort.

As part of every project we conduct, we engage in the education of the project manager and the teams that are put in place as part of the plan.
[Back to top]

What software is used to document the plan, and can I use it?

There are various types of software available to document the plan. Green Oak Solutions has developed a set of proprietary plan templates that we make available to clients we are working with on plan development. These are word processing based templates that have been developed in order to streamline the process of developing your plan.

There are numerous commercially available products that are specialized to Business Continuity Plan development. These programs require specialized training in their use and are generally quite expensive to license, especially when considering a multiple location license or a web based version.

We believe that it is best to develop plans using word processing software that the majority of people are comfortable with. There is no specific training needed for this software, and plans developed using this method can be updated throughout the organization by team members assigned update responsibility.
[Back to top]

How might my company be affected by future terrorist activity?

That will depend largely on the nature of your business, the extent of international operations, name/brand recognition, or other factors that may make your business a target of terrorist activity. An analysis of the potential threat and existing security measures will help you determine your exposure to a direct terrorist attack. A more likely scenario will involve terrorist attacks to the public sector utilities and service providers. You should ask yourself “What if?” there was a disruption to vital services such as electrical power, telephone, natural gas, or mail delivery. The answers to these questions will help you develop a plan for each possible occurrence.
[Back to top]

My company has an Emergency Plan to get employees out of the building but nothing after that. Where should we start?

Emergency Response Plans are a critical aspect of your plan; however, these plans themselves do not do enough on their own to produce full Business Continuity. In many cases, the Emergency Response Plan will contain an incident. Often, these plans alone are not sufficient.

Green Oak Solutions recommends that your Business Continuity Plans also include plans for Crisis Management, Damage Assessment and Facility Restoration, Crisis Communications, and Business Recovery Plans for recovery of operations.

[Back to top]