The response components of an organisation’s business continuity management program are the elements most critical to the organisation’s successful negotiation of a business interruption event, but also the most vulnerable to failure.
Typically there is a vast difference between the theoretical response on paper, and the actions actually taken during a crisis, especially if the plans have not been tested using a realistic scenario.
Even the best tested and validated plans may not anticipate all contingencies, but if validated by a testing process they will certainly work better to minimise the impact of the incident on the organisation, and achieve faster recovery times.
Methods to maximise the effectiveness of incident response plans include:
- Understand your potential incidents – be aware of the different scale of business impacts posed by foreseeable and realistic business interruption events, and set in place standards and processes for who needs to be involved in the response, and the necessary timescales for response and recovery, based on the severity of the incident and the criticality of the required service.
- Define and communicate roles, responsibilities and authorities – everyone in the organisation needs to know the part they are to play in responding to a business interruption event, and know it without having to refer to written plans. Define and document these details, then inform and train all personnel. Also ensure that induction and regular refresher programs are in place.
- Test and check – run a realistic test based on a scenario which is relevant to the organisation’s operations, and don’t forget to throw in a few unexpected factors like the hypothetical absence of a critical team member.
- Continually improve – review the business continuity plans and training programs based on the outcomes of the test exercise, and schedule regular tests and reviews so that plans are continually updated and improved. This should include re-examining the assumptions regarding expected business impacts, which may change over time.
Please contact QRMC for more information.
