To help focus managers and other parties in the development of a plan, Mellinger outlines 10 steps in that process. He acknowledges that all steps should carry the same level of importance, and certain steps apply to some facilities more than others, depending on the type of organization and region of the country in which the building resides.
Key 1: Obtain commitment from top executives. To sell top management on the need for a BCP, managers must engage people at all levels of the organization.
"(Business continuity planning) covers an entire organization," Mellinger says. "It takes everybody."
Managers know too well the challenge of obtaining support, particularly monetary support, for initiatives that do not have an immediate payback for the organization. But if managers can illustrate the potential business and operational impact of a disaster on all areas of facilities, managers will be more successful in securing funds, Mellinger says.
Key 2: Identify and quantify assumptions. Mellinger says the first step in this process requires managers to ask, "What are my organization’s key business functions, and what functions are absolute for the organization." Managers need to determine the operations and functions their organizations simply cannot do without and build a plan around restoring those operations as soon as possible.
"You need to know where the pain hits to develop recovery objectives," Mellinger says.
After determining an organization’s top functions, Mellinger says managers will realize the BCP tends to follow more of a strategic- or mission-driven model, rather than the organization’s business model.
Key 3: Actively manage risk. To identify the potential threats and hazards that could impact a facility, managers first should consider the location of their buildings. Managers then can use an equation to manage the risk of a potential disaster. Mellinger’s equation — Risk = Probably x Impact — helps managers determine the disasters or threats their BCP should address.
For example, most facilities can suffer a power outage, regardless of their location. But in California, the probability of an outage could be a four on a one-five scale, while in Minnesota, the probability might be a two on that scale.
If the California facility is a hospital, the impact of a power outage on operations also will be a four or five on a one-five scale. If the Minnesota organization is a K-12 school district, the impact would be smaller because of the predictable operations and occupancy of classrooms and school facilities.
In this scenario, managers of the hospital in California should make power outages a primary component in the BCP. The risk to the Minnesota facility does not warrant the time and resources to include recovering from power outages as part of the plan because of the low probability and low impact.
"Some things are improbable or so low impact that you don’t worry about them," Mellinger says.
Another component of actively managing risk is identifying single points of failure, he says.
"Look for the weak link in the chain," he says. "Look for the place where if you put some pressure on it, it’s going to cave."
Key 4: Keep people safe and secure. This key is critical for every manager in every facility. No matter the actions managers take during a disaster, they should maintain focus on the health and safety of occupants and visitors, Mellinger says.
In assessing occupant safety as part of BCP, managers need to consider evacuations, shelter in place, emergency kits, first aid, CPR, and the requirements for people with disabilities or other special needs.
Shelter in place is somewhat new to business continuity management, Mellinger says. The strategy provides occupants a place to go within a facility when they are told to remain in one area,
Key 5: Resume operations quickly and efficiently. Mellinger says the most important thing in a crisis is knowing the individual in charge. He suggests a chain of command that is six-people deep. Resuming operations effectively will require managers to involve what Mellinger considers the three pillars of the organization on which BCPs are built: human resources, information technology (IT), and facilities.
Key 6: Verify planning and validate its success. Drilling is the primary way building occupants will remember the proper actions to take in an emergency.
"If you don’t do it, it’s not going to get into peoples’ brains," Mellinger says. "You don’t remember what you don’t do."
Mellinger also suggests managers open a newspaper, find the worst possible thing that could happen to their facilities, and talk about the way their organizations would handle such a disaster. That type of dialogue also is a critical component in debriefing after responding to an event or a drilling session.
"Debriefing should be the next step in any incident you encounter, big or small, period," Mellinger says.
Key 7: Spread the word. Continuing with the communication theme, managers should develop awareness programs, involve everyone in the facilities, and collaborate with key departments. Collaboration is an important, yet uncommon, part of the BCP process, Mellinger says.
Key 8: Maintain the plan and ensure it is accurate. Managers should make sure changes within the three pillars of an organization focusing on BCP — facilities, IT, and human resources — are reflected in the plan. Managers also should account for changes to building systems and components to ensure technicians can address those systems appropriately before, during, and after a crisis.
Key 9: Debrief, review and revise after each disruption. Taking a close look at disruptions will help managers determine if a trend is occurring.
"Is there a trend?" Mellinger asks. "Is there something happening repeatedly? The only way you’re going to see (a trend) is with data."
Key 10: Don’t panic. Mellinger issued a call for calm during a disaster. Regardless of how effective and comprehensive the BCP, panic can deal a devastating blow to all the hard work that went into developing the plan.
Mellinger talks about three typical scenarios facilities face related to BCP. Some managers know they need to develop a BCP but think it is too labor-intensive. Another group believes maintaining the plan takes too much time. The third group has an effective BCP, but nobody knows what is in the plan.
Regardless of the state of an organization’s BCP, managers can take lessons from these 10 steps to better prepare for an emergency and return their facilities to normal operations more quickly.
How to Define a Business Continuity Plan
Business Continuity Strategy: 10 Key Steps
