An even narrower approach might be:
Document all the payroll procedures and recovery processes to ensure that paychecks are always on time and that the automated vacation balance tracking system is available even during an electrical outage.
Note that this scope statement does not include time clocks, exception reporting, or interfaces with your accounting system.
Most people do not have any idea of what a disaster plan would look like. They imagine some large book just sitting on the shelf. In this situation, you could demonstrate the usefulness of the plan by building it a piece at a time. You might build the part that covers the core utilities for a facility (electricity, gas, telecommunications, water, and heating and air conditioning). As you review with the sponsor how these essential services will be recovered after a disaster, the sponsor will begin to see the usefulness of your work. If your company has multiple sites, it might work better for you to build the plan one site at a time.
TIMELINES, MAJOR MILESTONES, AND EXPECTATIONS
The output of a scope statement is to build a list of goals for the project. These are specific results against which the success of the project will be judged. Detail any expectations as to a completion date or major milestone dates. If this project is in response to an internal audit item, then the due date might be when the auditor is scheduled to return. If the Board of Directors required this to be done, then progress reports might be due at every directors meeting. Ensure all key dates are identified and explain why they were selected.
The term “expectations” can also be described as the criteria for success. Be clear in what you are asking for. A business continuity plan should only include critical processes. A critical process is usually defined as a process whose interruption would cause a material financial and operational impact over some time interval that you define (5 percent or greater of quarterly revenues is standard). You can’t plan for what to do down to the front door being stuck open. That level of detail would be too difficult to maintain. Focus on the critical business functions and the processes that support them. Your long-run goal is that the business continuity planning process will become an integral part of how business will be conducted in the future.
Some example criteria for success include:
Every department’s continuity plan must provide for employee and visitor safety by detailing to them any dangers associated with this device or type of technology.
Each department’s continuity plan must be understandable to anyone familiar with that type of equipment or technology.
A business continuity plan will be submitted for every critical piece of equipment or critical process in the facility.
At the end of the project, the Business Continuity Manager will submit a list of known weaknesses in the processes or equipment along with long-term recommendations to address them.
All continuity plans will be tested by someone other than the plan’s author and certified by the department manager as suitable for the purpose.
This project shall commence on June 1 and be completed by December 31. By that time, all plans must be complete, tested, and approved by the department managers.
In terms of a timeline, the length of your project will depend on how supportive the team members are of this effort, how complex your operations are, and how detailed your plan must be. Generally, these projects have an initiation phase and then the various departments break off and work in parallel to write their respective plans. During this phase, they also perform initial testing of the plan. At the end, all the plans are compared and modified to avoid duplicate mitigation actions and to ensure one person’s mitigation step doesn’t cause problems for someone else. The capstone event is the system-wide disaster test.
As a general guideline, most plans can be completed in about six months, depending on the project’s scope, the degree of management support, the number of locations to be included in the plan, and the amount of resources available. One month is spent on the start-up administration and training. About three months are needed to draft and test the departmental plans. Be sure to stay on top of these people so they don’t forget about their plans! The final synchronization and testing should take an additional two months. However, as your team members are probably assigned to this project part-time, their level of participation will vary based on their availability. The Business Continuity Manager must be flexible but, in the end, is responsible for driving the project to its completion.
One of the indicators of the seriousness of a project is the presence of a separate budget item to support its activities. It is the Business Continuity Manager’s responsibility to track the funds spent on the project and to demonstrate the benefit they provided. If a separate budget is not available, then clear guidelines on a spending ceiling for the project must be set.
Among the items to include in the project budget are:
The Business Continuity Manager and key team members should attend formal business continuity planning training to obtain a thorough grounding in its principles. This speeds the project along and removes some of the guesswork of building a plan.
You may need to pay a consultant to advise the project and mentor the Business Continuity Manager as the plan is being developed.
Sometimes the folks with the most knowledge about your processes are not available during normal working hours. For these people, you may need to schedule meetings on weekends or off-site to gain their full attention. This may incur overtime expense or the cost of a consultant to backfill the person while they work on the plan.
Temporary help might be needed for administrative assistance, such as documenting the wiring of your data networks, transcribing notes for those without the time or inclination to type, or conducting an asset inventory.
It is a good practice to build team spirit for the project to carry you over the rough times. This might be shirts, hats, special dinners, performance bonuses, and many other things to build team cohesion. It is amazing what bringing a few pastries into a meeting can do for attendance. Visible recognition also helps to maintain the team’s enthusiasm.
VISIBLE ONGOING SUPPORT
If the goal of this project was to determine which employees deserved to have their pay doubled, you would be inundated with folks clamoring to join your team. Unfortunately, an assignment to a business continuity planning team may not be considered a high-profile assignment. This could discourage the enthusiastic support of the very people you need to make this project a success. To minimize this possibility, the visible, vocal, and ongoing support of the sponsor is very important.
Once the sponsor and the Business Continuity Manager have agreed on the scope, the sponsor should issue a formal memo appointing the Business Continuity Manager in a letter to the entire organization. This letter should inform all departments of the initiation of the project and who has been appointed to lead it. It should also describe the project’s scope, its budget or budget guidelines, and major milestones and timelines, as well as alert the other departments that they may be called on to join the project and build their own recovery plans. This memo will detail who, what, where, when, why, and how the project will unfold. The closing paragraph should include a call for their assistance in ensuring the project will be a success.
The sponsor should provide periodic updates to senior management on the progress of this project, which should include milestones met and problems that need to be overcome. Regular visibility to senior management can go a long way toward the continued support of each department with which you’ll be working.
SELECTING A TEAM
Once the sponsor and the coordinator have defined the scope of the project, the next step is to create a team. As you begin the project and start selecting your team, be ready for a chorus of resistance. Some departments will be indignant about being forced to join this project since they already have a plan (it’s just no one can find it). Even if they have a plan, it does not mean that it is a good plan, or it may have interdependences with other areas and needs to be linked to other plans. Some will already have a plan being developed, but under scrutiny you see it has been under development for the last 10 years.
So, with the naysayers in tow, prepare to select your team. In the case of existing, workable plans, ask that a liaison be appointed. For the plans under development, ask that those hardworking people join the project team. As for any parsimonious financial people trying to kill your project’s training request, ask the sponsor to override objections and allow the team to attend training on the latest business continuity best practices.
IDENTIFY THE STAKEHOLDERS
While forming your team, take time to identify the project’s stakeholders. A stakeholder is anyone who has a direct or indirect interest in the project. Most stakeholders just want to know what is going on with the project. Stakeholders need to be kept regularly informed about the project’s progress or problems with which they need to assist.
For all stakeholders, identify their goals and motivation for this project. Based on this list, you will determine what to communicate to them, how often, and by which medium. Some stakeholders’ interests are satisfied by a monthly recap report. Some will want to hear about every minor detail. Form 1-2 (see companion url) is a Stakeholder Assessment Map. Use it to keep track of what the key stakeholders are after in this project so you do not lose sight of their goals. The strategy is an acknowledgment that you may need to apply some sort of specific attention to an essential person to keep them supporting this important project.
FORM THE TEAM
The size and makeup of your team depends on how you will roll out the project. In the very beginning, it is best to start with a small team. Always respect people’s time. Don’t bring anyone into the project before they are needed. The initial team lays the groundwork for the project by arranging for instructors, coordinating training on building disaster plans, or helping to sharpen the focus of what each plan should contain.
The core team should consist of the sponsor, the Business Continuity Manager, an Assistant Business Continuity Manager, and an administrative assistant. This group will prepare standards, training, and processes to make the project flow smoother.
Several other key people will eventually need to join the team. You may want to bring them in early or as they are needed. This may include people such as:
Building Maintenance or Facilities Manager. They can describe what mitigation steps are already in place for the structure, fire suppression, electrical service, environmental controls, and other essential services.
Facility Safety and Security. They should already have parts of a disaster plan in terms of fire, safety, limited building and room access, theft prevention, and a host of other issues. If these plans are adequate, this may save you from writing this part of the plan. Be sure to verify that these plans are up to date and of an acceptable quality.
Labor Union Representative. In union shops, the support of the union makes everyone’s job easier. Show union leadership how a carefully created plan will help keep their members working and they will be very helpful.
Human Resources. The HR people have ready access to up-to-date information about the individuals who are important to the plan.
Line Management. These individuals tend to know the most about what is critical for getting the work done in their areas of responsibility.
Community Relations. A disaster may affect more than just your operations. You may need help from the surrounding community while recovering from a disaster.
Public Information Officer. This is your voice to the outside world. The role is critical in getting accurate information out to customers and vendors when dealing with a disaster.
Sales and Marketing. These people know your customers the best and can provide insight on what level of service is required before customers begin to fade away.
Finance and Purchasing. These people know your vendors the best and can provide insight on what kind of support you can expect from vendors while recovering from a disaster.
Legal. You need more than just common sense during an emergency. Your legal team can provide important insight on the legal ramifications of activities performed in response to an emergency.
The next step is to make a few tool standardization decisions. The company’s technical support staff usually makes these decisions for you. Announce to the group the standard word processing program, spreadsheet, and, most important, the project management software everyone will need on their workstations. Most people have the first two, but few will have the project management software already loaded. Be sure that as people join the team, copies of the software are loaded onto their workstations and training is made available on how to use this tool.
Provide example templates for the recovery documents. This step will ensure that the same type of information is found in all plans under the same headings. Also, it is easier to start writing if the basic document layout is already determined.
You will get the best results by investing some time training team members on how to write their portion of the plan and providing administrative help if they have a lot of paperwork to write up (such as network wiring plans). Every person reacts differently to a new situation, and being assigned to this team is no exception. If you will take the time to assemble a standard format for the plan and a process to follow to write it, then people will be a lot more comfortable being on the team.
A project of this type will generate a lot of paper. If possible, the accumulation of the various plans, wiring diagrams, manuals, and so on should be shifted from the Business Continuity Manager to an administrative assistant. An administrative assistant will also free the Business Continuity Manager from having to coordinate team meetings and track the project costs. Although these tasks are clerical in nature, they may also be given to the Assistant Business Continuity Manager. Another value of appointing an Assistant Business Continuity Manager is that it provides a contingency backup person in case something happens to the Business Continuity Manager, as this person will quickly learn about all aspects of the plan.
Once you are ready to roll out the project plan to the world, pull in representatives from the various departments involved. When tasking the department managers to assign someone, ensure they understand that they are still responsible for having a good plan so that they send the proper person to work on the team. This person need not know every aspect of their department, but they should understand its organization, its critical hardware and software tools, and its major workflows.
Depending on the project’s scope, you might end up with someone from every department in the company. This would result in too many people to motivate and keep focused at one time. Break the project down into manageable units. Start with an area you are most familiar with or that needs the most work. Involving too many people in the beginning will result in chaos. Plan on inviting in departments as you begin to review their area. An example is fire safety. Although it touches all departments, it is primarily a Safety/Security department function.
Given all this, just what skills make someone a good team member? An essential skill is knowledge of the department’s processes. This allows the team member to write from personal knowledge and experience instead of spending a lot of time researching every point in the plan. Members should also know where to find the details about their departments that they don’t personally know. Another useful skill is experience with previous disasters. Even the normal problems that arise in business are useful in pointing out problem areas or documenting what has fixed a problem in the past. And of course, if team members are to write a plan, they need good communications skills.
Department managers should appoint a representative to the business continuity planning project team by way of a formal announcement. However, the Business Continuity Manager must approve all team members. If someone with unsuitable qualifications is sent to represent a department, they should be sent back to that manager with a request to appoint someone who is more knowledgeable about that department’s processes. When rejecting someone from the team, be sure to inform your sponsor and the originating manager as to why that person is unsuitable.
The people on the initial project team are the logical ones to spread the good word of business continuity planning back to their departments. Time spent educating them on the continuity planning principles and benefits will pay off for the company in the long run. They can also learn more about the company by proofreading the plans submitted by the other departments. This has an additional benefit of broadening the company perspective of many of the employees. Use Form 1-3 (see companion url) to map out the responsibilities of each member of the team.
ROLLING OUT THE PROJECT TO THE TEAM
Team meetings are an opportunity to bring everyone together so they all hear the same thing at the same time. This is when you make announcements of general interest to everyone. It is also a good time to hear the problems that the team has been encountering and, if time permits, to solicit advice from the other team members on how to approach the issue. A properly managed meeting will keep the team members focused on the project and the project moving forward.
In the beginning, conduct a project rollout meeting with an overview of why this project is important and an explanation of what you are looking for. This is your most critical team-building meeting (you never get a second chance to make a good first impression). In most meetings, you will work to bring out from the people their thoughts and impressions on the project. But at the first meeting, be prepared to do most of the talking. Lay out the roles of each player and set their expectations about participation in the project. Information makes the situation less uncertain and the people can begin to relax. This is your first big chance to teach, cheerlead, and inspire your team! Sell your project to them!
The team members should leave the meeting with a clear idea that this project is of manageable size—not a never-ending spiral of work. Use this meeting and every meeting to informally teach them a bit about business continuity planning.
As the project progresses, you will be surprised how hard it is to get business continuity information out of people. Some people are worried that others will use it to dabble with their systems. Some folks just don’t know what they would do in a disaster and intend to ad lib when something happens, just like they always have. Have patience, ask leading questions, and get them to talk. When they have declared their plan complete (and you know it is only a partial plan), conduct a meeting with the team member, their manager, and the sponsor to review the plan. Step through it item by item. By the time that meeting is over, team members will realize that they will be accountable for the quality of their plans.
PLANNING THE PROJECT
Refer to the sample plans included in the companion url for ideas to include in your plan. Any plan that you use must be tailored to your site and management climate. Always keep your plan in a software tool like Microsoft Project. Such programs will recalculate the project’s estimated completion date as you note which tasks are complete. It can also be used to identify overallocated resources.
Okay, now it is time to build the project plan. This is best done with input from your team. There are four basic processes to building your plan: identifying the activities, estimating how long each task will take, deciding who should do what (or what skills this person should have), and then sequencing the tasks into a logical flow of work. The general term for this is a work breakdown schedule, which describes it quite nicely.
IDENTIFYING THE ACTIVITIES
What must be done? Your core project team members can be a great help here by identifying the steps they see as necessary to complete this project. Although some tasks will logically seem to follow others, the focus here is to identify what needs to be done. How deeply you “slice and dice” each task is up to you. Unless it is a critical activity, you should rarely list any task that requires less than eight hours of work (one day). The times in the sample plan are calendar time, not how long the task will take. This is because your team members may only work on this project part-time.
Write a brief paragraph describing each task. This will be very useful in estimating the time required to complete it. It also keeps the task’s scope from spiraling out of control. You may understand what you mean for a task, but remember, someone else will probably execute the task, so an explanation will be very useful.
Always document your planning assumptions. A planning assumption is something that you believe is likely to be true but you are not sure. Each assumption has a risk of being false. Assumptions enable planning to move forward. For example, one assumption is that specific people will be available at a specific date to perform a task in the plan. This is not a fact because there is a risk they will quit, become ill, etc. Still it is reasonable to assume it is true. As assumptions are proven to be true or false, they can be marked as “complete” on the list.
When discussing the plan with others later, this explanation of what you were thinking at the time the plan was drafted will be very useful. By listing your assumptions, you can discuss them point-by-point with the team and your sponsor to avoid areas that the plan should not address and to identify why a specific course of action was followed. The sponsor may also confirm assumptions as true.
Along with the assumptions, list all the known constraints for the project. This might be a specific due date to meet a business or legal obligation; it might be project funding issues or even a limit on the number of people available to be on the team. A major benefit of listing your project constraints is that upon examination they may be less than you think or can be used to prevent the scope of the project from expanding.