Every organization faces risks – and some of those risks may result in disruptions or other ‘incidents’. An effective response to an incident requires many things. We’ve combined them into a 5-part “Incident Horizon”: Planning, Preparedness, Initial Response, Planned Response and Extended Response. In this blog we look at the composition of one of those phases of the Incident Horizon.
Protect the Most Valuable Asset – People
Protecting an organization’s most precious asset – its people – should be the first objective of the response to any business disruption. Whether part of the Business Continuity (BCM) Program or not, Evacuation and Emergency/Safety Plans should be part of every organization’s preparations and initial response.
Taking those First Steps in the Right Direction
All the other Planning and Preparation that goes into a viable BCM Program enables that organization, following any disruption of day-to-day operations, to quickly make the right moves, in the right direction to respond effectively to whatever the situation presents. There need be no confusion, no running about moaning “What’ll we do? What’ll we do?” An organization that has planned and prepared its people will use the ‘muscle memory’ gained from exercises, drill and test to step forward with confidence.
A thorough Planning phase should have gathered the necessary intelligence to make an enterprise-wide assessment of the impact of any disruption. Not just the immediate impact (a building unavailable, an IT application off-line, etc.) but also the downstream people, processes and technology that may be impacted by the ‘ripple effect’ of the initial problem.
And because the Incident Management Team (IMT) has practiced – through drills and exercises – performing Impact Assessments, they are able to do so quickly and effectively.
Put the Wheels in Motion
Armed with an Impact Assessment, and backed by the intelligence compiled in the Planning phase, the IMT can quickly determine what must be done:
- Who must be notified (staff, Management, stakeholders)
- What impacted work can be transferred
- Which impacted employees may need to be relocated
Because proper Planning has linked Recovery Plans to the assets (facilities, teams, processes, technology, suppliers) they are designed to recovery or respond to, the results of the IMT’s Impact Assessment allows them to quickly identify and invoke the appropriate Plans to respond to the event.
To Declare or Not to Declare – Is that the Question?
We’ve all heard stories (perhaps apocryphal) of organization that lost millions while trying to decide whether or not to declare a disaster and invoke their Disaster Recovery Plan. Recent studies have shown that the average loss incurred due to a business disruption is $110,000 an hour. If a disruption occurs decisions must be made quickly and accurately.
Why can’t organizations make quicker decisions? Because they don’t have sufficient available information to help the IMT or executives make those decisions. With proper Planning, and the experience gained through periodic testing of both the IMT and Recovery Teams, the information for decision support is in place, and participants know how to leverage that intelligence to make timely and accurate decisions.
Intelligence-based Initial Response
Through proper Planning and thorough Preparedness, the initial response to any business disruption can be both quicker and more effective than an ad hoc response. There’s no time lag while gathering facts (they’re already available), and less time consumed or effort wasted determining what strategic direction to take – because the decision-making support has been built into the BCM program.
When your organization has constructed the framework, built the muscle memory and developed the confidence to make its initial response without hesitation, it is truly on the road to Incident Readiness. All it needs are the tools to sustain recovery activities – no matter what the cause of the disruption, or the time required to return to normal.
