Most of the time when organizations suffer significant operational disruptions, the outages can be traced to one of two common business continuity failures: deficient recovery strategies and inadequate testing. Fortunately, there are steps every company can take to fortify its position in these critical areas.
Related on BCMMETRICS: How Do BCM Offices Fail?
Let Us Count the Ways
There are many reasons business continuity programs fail. In my experience, the majority of failures and also the most serious failures are caused by two particular shortcomings: underdeveloped recovery strategies and a lack of realistic testing.
When an event occurs, either one of these weaknesses can be damaging. If both are present, it can lead to a one-two punch that knocks a company to its knees.
When I meet with companies to talk about their BC programs, there is often an elephant in the room: the inadequacy of their recovery strategy. It’s the big problem that everyone knows about and no one wants to acknowledge.
A recovery strategy, of course, is the overall approach an organization uses to restore a business or IT process. Recovery strategies set forth the steps an organization should take to resume its mission-critical business processes and computer systems and applications in the event of a disruption.
Unfortunately, most companies’ recovery strategies range from underdeveloped to nonexistent. Organizations with deficient recovery strategies have little to no idea what they need to do to recover the business if and when they are hit with an outage.
Most of the time when a company’s recovery strategy is lacking, the problem can be traced to one of the following:
If any of these problems exist, it can be enough to keep your program from working when you need it most.
Thankfully, there are things an organization can do to strengthen its recovery strategies. Here are a few of them:
When an organization’s recovery strategies are underdeveloped, it is essentially gambling with its future. By crafting and fully implementing sound strategies, the organization is well on its way to being able to face the future with confidence.
The other common cause of business continuity failures is omitting to conduct realistic recovery exercises. Having well-considered recovery strategies is essential. But the only way to find out if those strategies work is to test them through rigorous exercises.
The following are some of the most common problems we see with companies’ BCM exercise programs:
Any organization whose testing program has these problems is not really testing anything, it’s only fooling itself. It’s also squandering a precious opportunity to identify and close gaps, thereby reducing the chances it will experience a business continuity failure.
The good news is, there are a number of straightforward steps a company can take to make sure its exercise program truly validates its recovery capability. They include:
By taking these steps, an organization can ensure that its testing program provides meaningful validation rather than false comfort.
The two problems that cause the majority of business continuity failures as well as the most serious failures are undercooked recovery strategies and inadequate testing. When an event occurs, these problems can combine to deliver a one-two punch that knocks an organization to the canvas.
Fortunately, organizations can easily take steps to protect themselves against these shortcomings, such as taking their BIA and risk assessments into account in devising their recovery strategies and conducting exercises. Companies that take steps to strengthen their position in these two areas reap the benefits of greater resiliency and recoverability.