I have had a lot of experience dealing with such projects from both a client as well as vendor perspective. Below is my take on the subject.
The Business is Essential to Business Continuity Planning
My prior experience when working for a major global bank and when running a large ICT Consultancy Firm has shown that all too often the terms Disaster Recovery and Business Continuity are (incorrectly) considered to describe the same thing, that is, the recovery of IT system after a disastrous event. This has led to a trend for the responsibility of creating and maintaining a Business Continuity Plan (BCP) to be left to IT. However, Disaster Recovery (DR) should not be confused with Business Continuity, for which DR is only a subset dealing primary with IT. Business Continuity Planning (BCP) must include areas of business, not just the IT functions.
The experience of producing DR Plans puts an organisation’s IT department in a good position to enable and facilitate the BCP process. However for BCP to have any chance of success, it is imperative that all functional parts of the business take an active part in the development of the Business Continuity Plan. Furthermore, long term success is dependent on the business taking ownership of the plan once it has been produced and dedicate the required resources to keep it up to date.
One of my previous customer’s had direct experience of this. A few years ago, this customer’s IT department undertook a project to produce a Business Continuity Plan for the wider business. However, the BCP process had not been sufficiently explained to the business, which resulted in a lack of resources from the various functional departments. Without sufficient business involvement, the project inevitably failed. Shortly thereafter, the Risk department of the same company took the lead in producing a Business Continuity Plan. However this time around, the process and the requirements were first explained to the Managing Director and the various departmental directors. It was made clear that for BCP to succeed, the business as a whole must be involved and resources made available. Once the plan had been produced, the business must take ownership of the plan and ensure it is maintained and kept up to date. With the broader business onboard, this second BCP project was successful.
When it comes to BCP, often it is the process rather than the end artefact that is of the most value to an organisation. The process of planning for business continuity stimulates thinking on processes, organisation, suppliers, customers etc and ways to keep the business operating if a disaster were to occur. The process of testing the BCP either reinforces these ideas or (if it is found that the processes detailed in the plan are no longer viable), forces new solutions to these problems to be found. This is also true for the maintenance of the plan. The maintenance process allows the business to increase their awareness of the BCP and to re-examine their business to verify that the details of the plan reflect the needs of the current business.