Questions Your BCP Should Answer

If you didn't have a BCP yet, you probably have the data now to create one. This is an opportunity that should not be missed, but I'd like to caution you against a misconception.

In recent years, I've had the chance to review many BCPs. What I've noticed is that many plans pay ample attention to scaling up, organization, and communication, but less to the actual course of action when implementing the plan. The BCP is activated, but what can you rely on? Where do I have a measure in place, and where do I need to improvise because nothing is arranged? This aspect is often not sufficiently elaborated, and supporting information is missing. This can result in lost time, especially in situations where time is precious.

An organization delivers products and services, made possible by people working at locations with assets, possibly assisted by suppliers. This sentence contains the core elements of business continuity. Ideally, a business impact analysis has been conducted, making critical processes clear. The translation of these critical processes into these core elements and a supporting BCP is the next step.

Questions that your BCP should be able to answer at a minimum:

• What strategy do I follow in case of critical process failure: accept and hope for a quick recovery, reduce output, or implement an alternative process? Even if a process is critical, it doesn't mean that an alternative is readily available. The BCP should clearly describe the options.
• At what minimum level can I continue to deliver without losing our customers or societal role? Do I opt for reduced output for everyone or the most optimal output for specific customers and target groups?
• For which processes is remote work not an option because it cannot replace the office workplace?
• At what predictable moments is the organization most vulnerable? Think of payment runs, periodic campaigns, release moments, and the like.
• What do I minimally need in terms of people, resources, and other elements (core elements) to continue performing tasks? And what is needed for recovery and catching up on backlogs?
• What single points of failures or single points of knowledge exist (and have not been removed): unique knowledge among employees, use of specialized and/or location-bound equipment, single sourcing agreements?
• Do my suppliers have alternatives for the delivery of their products and services that are acceptable to us? What priority do I give to our suppliers if they run into trouble?

The above questions make it clear that a good BCP benefits from scenario analysis beforehand and is closely connected to business strategy. The answers come from the business and require clear choices and consensus. The fact that the choice may be slightly different during a crisis situation is evident. But the thinking has been done, and the foundation has been laid at the very least.