Running Legal Like A Business - Ch. 13 - Business Continuity
In a September 2020 Business Continuity post, I noted that having been in charge of maintaining a company business continuity plan or two, my principle take-away is that a plan is not worth two cents if it cannot be accessed and put into action quickly.
In my experience* business continuity plans are out of date the moment they are approved and have elements that are ill-conceived. By definition "emergency response" will have gaps. Inevitably following an emergency incident in a company setting, people have a tendency to emphasize appreciation for people coming together and to focus on went well. For people whose usual responsibilities are not operational security and safety, it can be culturally difficult to facilitate discussions around what could be improved for next time.
In Running Legal Like A Business by Connie Brenton and Susan Lambreth, PLI Press, 2021 chapter 13 author Kathryn Scourby, a Certified Business Continuity Professional (CBCP), gives a succinct 15 page primer introducing the topic. She covers assessment, response planning, documenting the plan and empowering a crisis response team, and evaluation. She provides a structured terminology and a number of considerations that can support strong planning conversations.
Among the recommendations Scourby makes, one I particularly like is her recommendation that the written plan is in a checklist format. A checklist approach allows one to quickly assemble resources under stressful conditions. In the evolution of my own home emergency plan to checklists, I was influenced by James Murphy speaking of airplane jets standard operating procedure manual with sections for normal operations and emergency operation in his book Flawless Execution.
Scourby also speaks to people being your first line of defense and the importance of a Crisis Management Team (CMT). The CMT corps in turn needs to be able to marshal additional colleagues with specialized expertise or level-headed generalists, as the circumstances require. Personally, if my business does not otherwise necessitate a strong security or safety resource, I'd prefer a committee facilitator to have practical field operations experience with a humanitarian rescue organization or the military.
Scourby also speaks to training and gives emphasis to actual drills and exercises. Practical application is essential to surfacing gaps and mitigating them. She recommends 3 levels of testing:
- Structured walkthrough testing
- Component testing and
- Full operations testing.
Over the past several weeks watching Russia invade Ukraine, one is acutely aware of how insufficient advance company plans may prove in action, and the need for people who can flex, improvise and otherwise think well on their feet. Irrespective of your formal role in your company's business continuity planning, this chapter provides good guidance for mental and practical preparation.
---
*In my present position I have no responsibility or insight into the company business continuity - nothing in this post is indicative of my present employer.