Using BCP (business continuity planning) to reduce operational risks

When a business continuity plan is correctly used it can help reduce operational risks.Operational risk is the risk of loss experienced from internal processes as a result of external events. These internal processes could have failed completely or simply been inadequate.This does include calculating the legal risk as well but does not take into account business risk that is based in strategy or reputation.Some examples of operational risk are losses arising because of internal or external frauds, natural disaster, failed transaction processing or inability to meet the commitment of service, and the disruption of business or system failures.

There are basically five steps in developing and using a business continuity plan. These are: analysis, solution design, implementation, testing and organization acceptance, and maintenance.The complete process to develop a business continuity plan is far to complex to be fully developed here.Careful research by an organization's management to truly understand the needs of their organization is crucial.This can be followed by an in-depth analysis and solution design.These programs can be put into place in-house or a specialty consulting firm can be used in the design of the business continuity plan.That leads to the remaining three steps that become crucial in using the business continuity plan to reduce operational risk.Here is a brief examination of the remaining steps-

Implementation-A plan without implementation is simply words on paper.It really goes without saying that the plan must be put into place as the first step to determine if it will fit the organization's needs. The implementation phase, quite simply, is the execution of the design elements identified in the solution design phase. Work place testing to insure the quality and fit of the elements must first be tried so an analysis can be made of the plan. It is at this stage that elements can be modified to fit the needs of the organization before complete testing is proceeded with. After a thorough run-through of all elements has been tried then a company may move onto the next step.

Testing and organization acceptance-This is the stage where the purpose of testing is to achieve organizational acceptance that the business continuity plan satisfies the organization's recovery requirements. Plans may fail to meet expectations due to insufficient or inaccurate recovery requirements, solution design flaws, or solution implementation errors. Critical personnel responsible for the implementation of the plan will be identified at this stage. Personnel deficiencies may be discovered and need to be modified.Testing may include:

Crisis command team call-out testing
Technical swing test from primary to secondary work locations
Technical swing test from secondary to primary work locations
Application test
Business process test
At minimum, testing is generally conducted on a biannual or annual schedule.

After a subsequent period of testing management can gauge the organizations acceptance of the plan.This acceptance can be recorded and analyzed by Human Resources on the personnel level.If it is determined that changes need to be made they can still be done at this stage.

Maintenance-The last stage of the development of a concise BCP manual is the maintenance stage.This is generally broken down into three periodic activities. The first activity is the confirmation of information in the manual, and the essential need to educate all staff for awareness. This includes specific training for individuals whose roles are identified as critical in response and recovery. The second activity is the testing and verification of technical solutions established for recovery operations. The third activity is the testing and verification of documented organization recovery procedures. A biannual or annual maintenance cycle is typical.