Determining Business Continuity Strategy

Avalution Team Avalution Team | Jul 09, 2009

Chess SmallAn effective Business Continuity strategy is typically two-fold. It includes risk reduction activities to take place before an interruption occurs, as well as response activities to mitigate impact when it does. Business Continuity professionals have the task of allocating their limited resources in the most efficient way possible to achieve maximum risk and impact reduction. This task can appear daunting when considering a company with a wide variety of business areas. To simplify the resource allocation decision both before and after a crisis, it is helpful to have a defined framework in which to organize and evaluate information. A framework not only allows the professional to assess existing information, but also makes it possible to quickly incorporate new information into their assessment so that areas can be re-evaluated during an interruption and an effective recovery strategy can be developed.

At first glance, the decision of which areas to allocate the most resources to seems simple – identify the areas that are most important to the financial health of the business and invest the most to protect and recover those.  However, when a company has many areas that are relatively similar in criticality, this logic may not truly capture the information necessary to make the best decisions.  Additionally, criticality may be hard to measure; for example, the potential impact on the company for product lines in their beginning stages is difficult to predict.

A large manufacturer struggled with this very problem. The organization has considerable assets distributed over a large number of different product lines and because they value the safety of their customers most, they know that they can’t evaluate criticality alone. To emphasize this point, some of the newer programs that may contribute the most to their future business success are still in the research phase and thus are not generating revenue.  The organization wants an efficient prioritization of products that will minimize the impact of an interruption on both present and future revenues, while also minimizing the impact to the customer.  Effectively, they want a recovery order that effectively allocates business continuity resources and can be continually modified to incorporate new information.

After much consideration, management has decided to add an additional characteristic to evaluate each product line: recoverability.  This is a measure of the amount of resources it takes to recover following an interruption.  By incorporating both criticality and recoverability, they have created a decision matrix that can be used in resource allocation.  The matrix is pictured below:

julia pic

By locating each business area within the matrix, management can generate a prioritization of areas for both risk reduction and recovery.  For example, an area high in criticality but also high in recoverability difficulty does not justify as much effort towards risk reduction as an area at mid-level criticality with low recoverability difficulty.  In the same line of thought, an area that is high in criticality but low in recoverability difficulty will be targeted for protection immediately following a crisis, while an area also high in criticality but easily recoverable will not be focused on initially.  Without the matrix, these conclusions would be hard to reach in a stressful situation.

In addition to simplifying the decision-making process before and after an interruption, the matrix allows management to add new areas at any time or shift existing ones, continually improving their recovery strategy to ensure that recovery objectives reflect current operations.

By taking a holistic look at each area of the business before a crisis occurs and identifying the key decision metrics, the business continuity professional can construct a decision-making process from which an effective analysis can be conducted.   This analysis will enable management to make more efficient resource allocation decisions for both risk reduction and response activities, mitigating the impact of a crisis on your organization.