Business continuity planners are not in the business of sugarcoating Business Continuity Programs (BCP) and Disaster Recovery Plans (DRP). People, either in organizations or individually, benefit most from hearing the truth, no matter how it hurts, forthrightly.
As a BCP consultant myself, I am basically engaged by clients to look into their security threats, safety hazards and vulnerabilities. All words related to threats, hazards and vulnerabilities, of course, connote negative meanings. It does not mean, however, that I would like to demean anybody by stating such words to describe professional observations. I simply do not want to sidle up to the issue so delicately that the reader does not fully realize the gravity of the situation. It is like describing a “deathtrap” as a “space-saving technique” inside a facility.
Understandably, it is against human nature to dwell on things that either connote or attract negativity. People, collectively and individually, seek and seize only the best that life has to offer, regardless if it is based on needs-to-have or the secular nice-to-have. You see, society at large frowns upon at stories of death, disease and destruction. No wonder why Noah, a righteous man and a flood hero, was ridiculed by the townspeople of his time when he built an ark, the first ever survivable mobile alternate command center, in preparation for a God sent disaster, which was the great deluge.
Nothing changed much after a thousand years and thousands of less great floods… and counting. A business continuity planner, the modern day Noah minus the divine intercessions, is still likened to a doomster and a pessimist by the uninitiated. For this reason, preparedness, for the most part, take a back seat. People, in general, would rather listen to inspirational gurus preach about life, purpose-driven or otherwise, especially after suffering from a great loss or awful life experience than to lend an ear beforehand to a business continuity planner who skillfully expounds worst-case scenarios that may include something as dreadful as the Ten Plagues of Egypt.
“Unexpected” is the most common word one would hear from victims in a disaster aftermath. Perhaps, that is the same way the people that mocked Noah in ancient times thought of as they grasped for their last breath. On the other hand, the biblical hero, whom I consider as the first business continuity planner, might have said “I told you so” the same way it is being uttered now in frustration by modern day planners.
Indeed, it is proverbial that hoping for the best tags along expecting for the worst. Simply put, hope alone is not a continuity plan and it would definitely not make one ready for disaster. The best things an enterprise could hope for are growth and expansion amidst the global crisis. Harsh reality, however, could unleash significant business disruptions (SBD) ahead, turning boom into bust. Some scenarios even abound stories of death, disease and destruction which may be downright unpleasant and distracting for each of the four types of general events under a Business Continuity Program (BCP), which are as follows:
- Loss of Workforce,
- Loss of Facility,
- Loss of Power, and
- Loss of IT/Network.
However, it is more objectionable to hear an organization offer the same lame excuse that things happen unexpectedly given its responsibility, capability and opportunity to mitigate the risks in advance taking into account the following:
- Corporate policy changes,
- Warnings of natural disasters such as earthquake, typhoon, and flood,
- Any incident causing property damage such as fire, smoke, or water damage,
- Any incident impeding facility access such as closure due to labor unrest, emergency building evacuation due to bomb threat, or external threat such as terrorist attack to a nearby facility, and
- Any external malfunctions, which potentially could cause an SBD, such as loss of power and telecommunications systems.
So, what you have in the aforementioned scenarios is an interesting kind of psychological stalemate that while they connote negativity, they help attract stability. Indeed, in every crisis there lies some opportunity. All the hard practice and preparation by means of a BCP will come into play when disaster strikes. It must be understood though that a worst-case scenario or simply the “worst” in planning is the definitive result of Risk Assessment (RA) and Business Impact Analysis (BIA). Without the “worst” in planning, the best – objectives and resources – of an enterprise is just not good enough in emergency situations. Precisely, BCP strategies and procedures are generally based upon worst-case scenarios such as the total destruction or loss of a critical facility. It is, therefore, the basis of an organized approach to risk mitigation, emergency response and recovery activities following an unplanned incident or SBD, avoiding confusion, and reducing exposure to error.
Nonetheless, at this point, there is a lack or absence of interest in worst-case scenarios given the human tendency to always look at the bright side. It is simply taboo to discuss those things. Dare discuss the specter of something going wrong and you would probably run the risk of earning the ire of your colleagues for being the “negative thinker” in your organization. If this were not the case, then almost all of the enterprises in the country including the Philippine government would have a BCP in place to implement.
Meanwhile, we have witnessed in the recent natural disasters that struck the country that organizations that do not address such negative issues in advance often find themselves suffering the effects later. In view of this, there is a need to push the “positive thinkers” aside because it is time to put the “worst” in planning in the agenda. Talk it up to the executives and the board. If assistance is needed, there are now qualified business continuity planners who could be called upon by enterprises to do the job. Well, at least, as soon as an enterprise realizes that individual comfort zones, either personal or political, do not necessarily contribute to a secure and safe business haven.
In a BCP context, an enterprise goes for growth but tackles worst-case scenarios and how it can overcome them. BCP works like a stress test tool that determines the amount of risks an enterprise can manage to improve resiliency under different scenarios. A business continuity planner, on the other hand, works like a trained technician who monitors the early warning signs of inflexibility to deal with uncertainties. In essence, helps an enterprise challenge its most basic business plan assumptions.
Certainly, it is not negative after all to assess the dark side of things when it could very well provide an environment to appropriately manage the vast majority of crisis scenarios in business today. An enterprise is there for growth and expansion to make money, increase shareholder value and beat the completion on all levels. The best thing about the “worst” in continuity planning is that it could help an enterprise achieve those business objectives.
