Business Continuity Planning (BCP)

Business Continuity Planning (BCP) is an interdisciplinary concept used to create and validate a practiced logistical plan for how an organization will recover and restore partially or completely interrupted critical (urgent) function(s) within a predetermined time after a disaster or extended disruption. The logistical plan is called a Business Continuity Plan.

Business Continuity is the ability of a business to continue its operations with minimal disruption or downtime in the advent of natural or intentional disasters. BC begins with a plan that addresses all risks and secures systems that are vital to business operations.

A BCP must factor in all the risks, and should ensure continued availability, reliability, and recoverability of resources. It should balance the costs of risk management with the opportunity cost of not taking appropriate action.

A business continuity plan should provide an enterprise-wide risk-based approach, covering People, Processes, Technology and Extended Enterprise to ensure continuing availability of business support systems and minimize disruption risks.

Most corporate today outsource support functions and rely on third-party support for non-core business operations (like logistics). So the plan should also extend to external entities like customers, partners and suppliers. BCP must also address business risks like:

* Customer end risks
* Supplier end risks
* IT hardware and software risks
* Business core process risks
* Business partner risks

The development of a BCP manual can have five main phases:
* Analysis
* Solution design
* Implementation
* Testing and organization acceptance
* Maintenance

Impact analysis (Business Impact Analysis, BIA)
An impact analysis results in the differentiation between critical (urgent) and non-critical (non-urgent) organization functions/ activities. A function may be considered critical if the implications for stakeholders of damage to the organization resulting are regarded as unacceptable. For each critical function, two values are then assigned:

* Recovery Point Objective (RPO)- the acceptable latency of data that will be recovered
* Recovery Time Objective (RTO) - the acceptable amount of time to restore the function

Solution design
The goal of the solution design phase is to identify the most cost effective disaster recovery solution that meets two main requirements from the impact analysis stage

Implementation
The implementation phase is execution of the design elements identified in the solution design phase. Work package testing may take place during the implementation of the solution.

Testing and organizational acceptance
The purpose of testing is to achieve organizational acceptance that the business continuity solution satisfies the organization's recovery requirements. Testing can include crisis command team call-out testing, technical swing test from primary to secondary work locations, technical swing test from secondary to primary work locations, application test and business process test.

Maintenance
Maintenance of a BCP manual is broken down into three periodic activities. The first activity is the confirmation of information in the manual; roll out to ALL staff for awareness and specific training for individuals whose roles are identified as critical in response and recovery. The second activity is the testing and verification of technical solutions established for recovery operations. The third activity is the testing and verification of documented organization recovery procedures. A biannual or annual maintenance cycle is typical.


CURRENT STATE
The Information Risk Management (IRM) practice of KPMG-India recently conducted a survey to check the preparedness of Indian industry. The results of the survey were shocking:
* 79 percent of the respondents do not have a documented and tested BCM (Business Continuity Management) plan.
* Among the respondents highly dependent on IT, 64 percent do not have a corporate-wide BCM plan in place to address business disruption risks.

The survey covers more than 100 private and public sector organizations spread across various industry segments. (See box on page 26 for a snapshot of the survey results).

A Gartner Research report titled 'What is Crisis Management' indicates something similar. Gartner says only 15 percent of Global 2000 enterprises have a full-fledged business continuity plan.

EXAMPLE FROM INDIA-WIPRO

Sources
1. http://www.publicsafety.gc.ca/prg/em/gds/bcp-eng.aspx
2. http://www.firstsource.com/differentiators/Business-Continuity-Planning.aspx
3. http://www.wipro.com/investors/pdf_files/Wipro_Business_Continuity.pdf
4. http://en.wikipedia.org/wiki/Business_continuity_planning
5. http://howe.stevens.edu/Research/ATT/ReportAllSep1004_v3.pdf
6. http://nonprofitrisk.org/tutorials/bcp_tutorial/intro/1.htm

Scenario Planning

Scenario planning is a model for learning about the future in which a corporate strategy is formed by drawing a small number of scenarios, stories how the future may unfold, and how this may affect an issue that confronts the corporation.

Traditional forecasting techniques often fail to predict significant changes in the firm's external environment, especially when the change is rapid and turbulent or when information is limited. Consequently, important opportunities and serious threats may be overlooked and the very survival of the firm may be at stake. Scenario planning is a tool specifically designed to deal with major, uncertain shifts in the firm's environment.

Scenarios are carefully crafted stories about the future embodying a wide variety of ideas and integrating them in a way that is communicable and useful. Scenarios help us link the uncertainties we hold about the future to the decisions we must make today.

Scenario planning has its roots in military strategy studies. Herman Kahn was an early founder of scenario-based planning in his work related to the possible scenarios associated with thermonuclear war ("thinking the unthinkable"). Scenario planning was transformed into a business tool in the late 1960's and early 1970's, most notably by Pierre Wack who developed the scenario planning system used by Royal Dutch/Shell. As a result of these efforts, Shell was prepared to deal with the oil shock that occurred in late 1973 and greatly improved its competitive position in the industry during the oil crisis and the oil glut that followed

The scenario planning method works by understanding the nature and impact of the most uncertain and important driving forces affecting the future. It is a group process which encourages knowledge exchange and development of mutual deeper understanding of central issues important to the future of your business. The goal is to craft a number of diverging stories by extrapolating uncertain and heavily influencing driving forces. The stories together with the work getting there has the dual purpose of increasing the knowledge of the business environment and widen both the receiver's and participant's perception of possible future events. The method is most widely used as a strategic management tool, but it is also used for enabling group discussion about a common future.

Scenario Matrix



Typically, the scenario planning process is as follows:
· identify people who will contribute a wide range of perspectives
· Comprehensive interviews/workshop about how participants see big shifts coming in society, economics, politics, technology, etc.
· cluster or group these views into connected patterns
· group draws a list of priorities (the best ideas)
· sketch out rough pictures of the future based on these priorities (stories, rough scenarios)
· further work out to detailed impact scenarios (determine in what way each scenario will affect the corporation)
· identify early warning signals (things that are indicative for a particular scenario to unfold)
· monitor, evaluate and review scenarios

Some of the benefits of scenario planning include:
* Managers are forced to break out of their standard world view, exposing blind spots that might otherwise be overlooked in the generally accepted forecast.
* Decision-makers are better able to recognize a scenario in its early stages, should it actually be the one that unfolds.
* Managers are better able to understand the source of disagreements that often occur when they are envisioning different scenarios without realizing it.

Some traps to avoid in Scenario Planning:
1) treating scenarios as forecasts

2) constructing scenarios based on too simplistic a difference, such as optimistic and pessimistic

3) failing to make scenario global enough in scope

4) failing to focus scenarios in areas of potential impact on the business

5) treating scenarios as an informational or instructional tool rather than for participative learning / strategy formation

6) not having an adequate process for engaging executive teams in the scenario planning process

7) failing to put enough imaginative stimulus into the scenario design

Sources
1. http://www.netmba.com/strategy/scenario/
2. http://www.valuebasedmanagement.net/methods_scenario_planning.html
3. http://en.wikipedia.org/wiki/Scenario_planning