When it comes to your organization’s recovery plan, your business recovery checklists might just be the single most important ingredient. They are the engine of your recovery plan.
As we state in MHA’s Complete Guide to Creating and Implementing a Business Recovery Plan, “Recovery checklists guide you step-by-step through the process of getting your business back up and running” after a disruption. Without such checklists, your team would have no direction as to the steps and actions they would need to take to respond to and recover from a disruption and to resume business operations. I urge you to take checklists seriously.
If you’re still reading, I will assume that means you are taking them seriously. Great. Now, let’s roll our sleeves up and get to the heart of today’s post.
Having accepted the importance of recovery checklists, you might be wondering how to develop them for your own organization.
It all comes down to what I call the 4-3-3 Rule for Writing Business Recovery Checklists.
This rule states that in writing recovery checklists for your organization, you should:
That’s it: that’s the 4-3-3 Rule.
But you might be asking yourself: What are those things, impact scenarios and the rest?
Let’s take them one by one.
Impact scenarios are the ways that negative events can damage your business or operations. There are four main scenarios, and our aforementioned guide breaks them down like this:
You should devise a separate checklist for each of these four scenarios.
Note that we do not develop checklists for specific events, such as a hurricane or cyber attack. As always in business continuity, the event is almost beside the point. What we should focus on is the impact, and remedying and recovering from the impact.
Theoretically, there is an infinite number of events that could cause you problems, but the possible impact of those problems is basically limited to the four scenarios given above.
Recovery phases are the subtasks that make up the larger task of recovering from an event. As adapted from the MHA guide previously mentioned, the three phases of any recovery are:
Each of your four recovery checklists (remember, you’re going to develop a checklist for each of the four impact scenarios) should include steps covering these three phases.
We are now ready to put the final “3” in the 4-3-3 Plan, which is the key checklist qualities. These are the qualities that your checklists must have in order to be useful when it counts.
In my opinion, your checklists should be:
That’s all there is to the 4-3-3 Rule for Writing Business Recovery Checklists. To reprise it, in writing recovery checklists for your organization, you should:
Are you interested in learning more about what makes a good checklist? If so, I recommend that you check out the The Checklist Manifesto, by Atul Gawande (link goes to author’s website). It’s full of interesting stories and explains how well-designed checklists can improve outcomes in many endeavors.
| Task Description and Other Information | By Whom | Initial When Complete |
|---|---|---|
| Response Phase | ||
| 1. Based on the severity of the event, assess and determine the immediate impacts to critical finance and administration activities and report findings to the Crisis Management Team (CMT) as needed. | o ______ | |
| 2. The CMT will coordinate efforts with corporate communications to ensure the appropriate notification is provided to affected internal personnel (e.g., employees, contractors) and external IT stakeholders as needed. | o ______ | |
| 3. | o ______ | |
| 4. | o ______ | |
| 5. | o ______ | |
| Recovery Phase | ||
| 6. In the event of a long-term outage, the CMT leader may execute the enterprise recovery strategy that includes relocation of personnel (e.g., home) in order to continue supporting core activities. | o ______ | |
| 7. As needed, reprioritize current workloads and/or suspend nonessential (Recovery Time Objective 4) activities throughout the duration of the disruption. | o ______ | |
| 8. Obtain approval for potential exceptions to business-as-usual activities by the appropriate corporate stakeholders (e.g., risk management, information security) as applicable to the event. | o ______ | |
| 9. Identify orders that have been placed and contact vendors to request they hold and/or reroute deliveries as applicable to the event. | o ______ | |
| 10. If needed, coordinate efforts with the CMT to gain access to emergency checks and endorsement stamps that are maintained in the CMT command centers (on- and off-site). | o ______ | |
| Restoration Phase | ||
| 11. Upon receipt of the appropriate building permits, engineering certificates, and/or building inspections, re-occupancy to the affected site can be granted. The CMT will work with the required stakeholders (e.g., facility management) to implement the applicable measures in order to establish re-occupancy. | o ______ | |
| 12. Upon resuming business-as-usual operations at the primary work site:
· Ensure validation of all required systems, applications, and other IT-related components. Direct staff to report exceptions to the help desk. · Implement a process to ensure that any manually tracked data is keyed online and brought current. |
o ______ | |
| 13. The phone system administrator will complete the task of rerouting phone lines back to the primary facility, a process that will be transparent to customers. | o ______ | |
| 14. | o ______ | |
| 15. | o ______ |