When should you use a scenario-based Business Continuity Plan?
It is usually recommended that Business Continuity Plans are based on the worst case scenario – or an “all hazards approach”. However, sometimes management disagree and want a plan for a specific scenario.
Feedback from BCP Builder Community on LinkedIn:
Preparing for “Known knowns”
- On the whole Business Continuity planning is based around outcomes.
- The reason why you have no people, premises, ability to process data or the perception of your business is going down the tubes is irrelevant. What you have is a problem…now.
- This approach however only covers off the “unexpected” outcomes. Your business can be better prepared if thoroughly thought through Business Continuity plans are developed for known events. So if these “known knowns” are realized you have a prepared and validated response.
- So what are these “known knowns”? Well there are some global events which could impact any business. Cyber, Pandemic etc. But there are also location specific events which your location is exposed to which could impact you or part of your business, such as volcanic activity, earthquakes, hurricanes, tornadoes, monsoon, flooding, Olympics etc.
- Don’t have plans for everything but be aware some events have a long cycle and long warning that things are about to happen. Volcanoes can be quiet for decades or more.
- If you are downhill from a volcano, you should be paying attention to that. Others have a long cycle with little warning: earthquake / tsunami. Others have seasons but the exact path is not know until a few hours before the impact. Best to know how folks will react rather than just deal with one scenario.
- Seasonal impacts are a potential driver for scenarios, to create a loss event and exercise the response to consequences. A good place to look for inspiration is your agreed risk register or horizon scan reports.
- If your company is large enough, work with your risk department who will have a list of events they would be globally concerned about. Select from that list those which could impact you and supplement this with your specific local credible risks and threats.
- Scenarios are always valuable training aids. There’s nothing more daunting than a power outage in an engine room or boiler house and these are best practiced by scenarios first.
Planning for the Apocalypse
- What actually defines “worst case scenario”? Alien invasion? ” double jeopardy”? The Business Continuity Institute Good Practice Guidelines say keep it realistic, plausible, possible.
- Look at the assets at risk for loss in a disruption (people, places, processes) and base the plan on their recovery.
- If you plan for specific scenarios you could be there all day, based on a colleague’s imagination, or lack of. There has to be some pragmatism involved.
If you want to increase your Organizational Resilience, start with preparing a Business Continuity Plan and check out BCP Builder’s Business Continuity Planning Templates.
