|
|
|
Before Your BCP
Attention and resources for business continuity planning in developing countries have been extremely limited, until recently. The December 2004 tsunami, repeated acts of terrorism, SARS and fear of future epidemics have increased business & government attention, particularly in Asia, to continuity of operations. Budgets remain small, however. Some companies have tape backup for important data, but little else for disaster recovery, and no BCP. Companies and organizations often ask, therefore, what they can do to prepare for disasters when they don't yet have a fully developed BCP. This article lists actions they can take for little cost and small amounts of time, whether a BCP is in place or not. Support and active participation by senior management remain, as everywhere, the key ingredients of success. 1. Appoint a Crisis Management Team (CMT) The single most effective step you can take is to get senior management of your organization involved in thinking about your organization's response to crises. You can do that in many ways, but we've found that establishing a CMT - without specifying the kind of crisis that might occur - gets management's attention. With recent news headlines, it's hard to argue against this simple step. We recommend that a CMT have five (5) or seven (7) members, particularly in cultures where consensus is highly-valued. You want broad ‘buy-in', but you don't want any tie votes in a crisis. Every division or business line does not need to be represented. You want decision-makers who can be calm in difficult circumstances. The CMT should include representatives from these parts of the business, either as full members or as ex-officio members:
A CMT should meet at least four (4) times per year (approximately quarterly), and more often if they are serious about being prepared. What should they do at the meetings? Complete the items in this list. Ask managers' PA's or secretaries to help block out time for these meetings. 3. Succession Plan Each member of the CMT should have a designated successor - an individual who can make decisions for the CMT member if he or she is unavailable in a crisis. This can be a sensitive subject, particularly in Asia; it is best discussed in private, but before a crisis. The CMT should complete the succession form at the end of this article, and a copy of it should be kept as the start of a BCP document. 4. Quorum How many members of the Crisis Management Team are necessary to make binding decisions? We recommend that the consent of at least two (2) members of the CMT be required to activate your organization's BCP (for example, to relocate employees, to authorize contact with external parties or to activate backup computer systems). Any two (2) members of the CMT should be able to make the decision to declare a disaster and activate the recovery plan; the decision should not require the participation of the chief executive. If the assent of only one person will be required to activate the plan, only the Managing Director (President, CEO) should be able to make the decision to activate your organization's plan by herself or himself - and only if no one else is around to participate in making the decision. [REP] It should be possible for members of the CMT to participate in the activation decision without being physically present at a CMT meeting - using teleconference facilities. During Indonesia's 1998 regime change, members of one bank's Singapore-based crisis team were huddled on a beach in Indonesia, frantically calling on mobile phones for emergency evacuation, when the decision to activate the crisis plan was required. No decision to activate a recovery plan should be taken without consultation with the IT Manager, HR Manager and Facilities (Property Manager), or their successors, if time permits. 5. Travel Policy Your CMT members should establish and observe a travel policy, such as: no more than two (2) CMT members may travel in the same conveyance (e.g., airplane, taxicab) together at any time. Remember: many more people perish in automobile wrecks than in plane crashes. Write me to tell you the story about the European bank's executives who were hospitalized after their taxi crashed - on their way to a disaster exercise! The policy should require at least two (2) members of the CMT to be present at your facility - or at least in the same city as your facility - at all times. You can't be sure CMT members will be able to get home in an emergency. Air travel was temporarily suspended in September 2001 in Australia, about as far away from New York as one can get. Someone must be responsible for ensuring compliance with whatever travel policies are adopted - another good reason to have the PA's and secretaries of the CMT members helping you. 6. Activation Triggers Speed in decision-making is critical in an emergency. The CMT should collectively decide certain "trigger" points - conditions or times after which some action (such as putting a backup facility on alert) will be taken, no matter what else happens. For example, how long can employees sit idle if electrical power is lost before the CMT decides to relocate staff to a location that has electrical power? Suggested conditions and times are in the Declaration or Activation Triggers table at the end of this document. Use these as ideas to get the CMT thinking. 7. Notification Call ‘Tree' Upon declaration, CMT members should notify selected individuals, who in turn notify other individuals, who notify other individuals, until everyone has been contacted. This is a Notification Call Tree. It is time-consuming to update a large call tree with everyone's current phone numbers, but it costs almost nothing. It's a good way to get the Human Resources department involved; they are most likely to have accurate phone numbers for employees. Don't list only employees' office numbers. You need mobile phone numbers, home numbers and pager numbers. Testing the speed and accuracy of your organization's Call Tree can be conducted even without a BCP. Pick a target elapsed time (say, one hour to contact all employees), then try it to see how long it really takes. This test should be scheduled each calendar quarter. Automated Alternative Many companies with well-developed BCP's now automate the notification process, using a computerized system. There are many emergency notification systems and services available; some are just becoming available in Asia. The initial cost is offset by much shorter time to contact everyone in an emergency, because automated systems can reach multiple employees simultaneously by phone, SMS and pager. Alternative: ‘Call Pool' Instead of trying to call out everyone, give all employees one phone number to call in, and give everybody instructions to report in to that number as soon as they can after an evacuation or other emergency. I describe this as a ‘Call Pool'. The phone number should be in a telephone exchange well away from your office, in case the phone network near your facility isn't working. The number can be staffed, or be answered by voice mail. The sole purpose is to account for all employees as quickly as possible by having them phone the pool. 8. Disaster Phone Number A call tree may not reach everyone if phone lines are unavailable, or if one ‘branch' of the call tree isn't contacted. In addition to a call tree, you establish a dedicated, automated telephone number for employees to call for recorded information. This number, unlike the Call Pool, is outbound - for the CMT to record verbal updates for distribution only to employees. Give all employees the number the day they are hired.
In an evacuation, employees should know where to go and how to get there. They need an assembly point, at which they can be counted and given instructions. As a guideline, an assembly point should be a distance away from your building equal to one-and-a-half times the height of your building. You don't want your colleagues standing under any falling debris. The big danger you're trying to avoid: flying glass from broken windows. The assembly point must not be where emergency responders (police, fire, ambulance) are going to set up their staging area if there is an emergency at your building. Note: our experience in the developing world is that public-private sector cooperation in emergency management is an emerging concept, and that liaison with emergency services may not be possible. 10. Emergency Cards To help employees remember, print and distribute issue plastic cards to all employees. The cards can show the call pool and disaster telephone numbers, a rough map to the assembly point, and the names of CMT members and their mobile phone numbers. Ask Human Resources to make and distribute the cards to employees. One bank in Russia gives every employee a credit-card sized plastic card with its disaster phone number on one side, and a map to their evacuation assembly point on the other. 11. Evacuation Rehearsals Do you know how long it really takes to get all your employees out of the building? A fire drill doesn't tell you: it's often announced in advance, and not all employees participate. Assume it takes two seconds per person to pass through the building's exit door. Multiply the number of people in the building times 2 seconds; divide the result by 60 seconds to get the number of minutes. It's likely to be a lot longer than the property manager has estimated! Evacuating, marshalling and roll call at the assembly point are good activities in which to involve the Facilities and HR managers. Hint: if the CMT doesn't participate, you can't be surprised if employees don't participate. 12. Site Assessment Team If your facility is damaged - or if you don't know whether it's damaged - the CMT will want to know the condition of the building as quickly as possible. Ask the Facilities manager to form a Site Assessment Team, staffed by individuals who can assess the condition of the building, and the condition of computers and networks. These individuals don't have to be employees; they should have damage assessment competence. Without these people, your CMT will be forced to depend on public authorities (fire, police) or insurance claims adjusters. Note: air quality assessment will be vital to determine if employees can work in the building safely. After one fire in Asia, a bank (whose offices were not damaged) had to send employees who worked in the building home with stinging, watering eyes, even though the authorities and property manager decided the building was suitable for occupancy. 14. Your Building or Property Manager Your organization depends on the building or property manager to maintain the facility's infrastructure, and to act as a representative to the public authorities in an emergency at your building. It is a good idea to establish a good, working relationship with the building management - before an emergency. Topics to talk about with the property manager, in which your organization has a strong interest, include
The list of actions in this article is not complete. If you have additional suggestions or questions, we would very much like to receive them, at our office in Singapore (+65 6324-3091) or at info@calamity.com.sg. Our web site address is at the bottom of this page. Please include your name and your organization's name in your email. Nathaniel Forbes started Forbes Calamity Prevention (FCP), Asia's oldest business continuity planning company, in Singapore in 1995. FCP prepares and manages BCP and emergency response plans for the overseas offices of multinational companies, with a focus on Asia.
|
