Beyond the first 48 hours: can the business continuity plan go the distance?

• Author: Samson, Phil
• Position: Business Continuity

When Hurricane Sandy plowed into the U.S. eastern seaboard last October, it was the latest in a growing list of reminders showing just how easily the complex interconnections of our modern economy can fray and snap, leaving companies literally in the dark.

Organizations with a good crisis management plan in place may feel buttressed against the initial impacts of a major event, but what happens after, when the various strands of a company's operations and supply chain don't quite come together the way they did pre-crisis?

To effectively address large-scale disasters and their aftermath, today's complex organizations need a comprehensive business continuity management program. Designed to see companies through crisis to the restoration of operational effectiveness and the preservation of brand, business continuity management is the foresight that changes "What do we do now?" into "Here's what we do, and here's how we do it."

Keep Calm and Carry On

Business continuity management is a comprehensive program that helps a company react quickly and effectively when faced with unplanned interruptions, anticipating and mitigating the revenue loss, reputation, compliance and expense management impacts of a crisis. An ongoing process, it includes identification of natural or man-made events with the potential to disrupt business activities, preparation for those events (and prevention of them, where possible), mitigation of the effects to achieve operational recovery and post-execution analysis to promote greater resilience during future events.

[ILLUSTRATION OMITTED]

[ILLUSTRATION OMITTED]

It is much more than crisis management. During Hurricane Sandy and other recent catastrophes, established and tested emergency response and crisis management plans did what they were designed to do: helping companies through the first 48 hours by providing a command-and-control structure that addressed the immediate needs of safeguarding company employees, property and critical data. Essentially, carrying everything to a metaphorical high ground as the floodwaters rose.

For many companies, though, that wasn't enough. In the days following the event, those companies found that inadequacy of planning scope or the failure (or nonexistence) of testing, had left significant gaps in their preparedness for a fractured operating landscape, leading to a significantly slowed recovery process.

A Perfect Storm

In a crisis like Sandy, impacts tend to cascade. Many companies affected by the storm found that complex systems and processes that in normal times increase the speed, flexibility and efficiency of business did exactly the opposite when stressed by the storm's effects and after-effects.

Communication systems failed. Transportation networks ground to a halt. Vendor connections and supply chains were frayed. Just as a confluence of unusual meteorological factors turned...