Apparently, a large number of important paper personal records were lost as a result of the recent tsunami in Japan, which reminded me of some of the more difficult conversations that I’ve had with some of my clients regarding paper records.
These conversations go along the line of the client stating that some paper records that they keep are vital, and that all sorts of catastrophic consequences will result if they are lost or destroyed. On receiving this information, I usually suggest to that the client that they scan the documents and hold the electronic copies off-site. All too often the reply to this suggestion is that this would cost too much money (and this is before the client has found out how much it should cost!)
So, the records are vital, but not so vital that the client is prepared to pay to protect them. When I point out this contradiction, and suggest that, actually, the records can’t have any value, the client just continues to claim that the records are vital. Are these people stupid, or am I missing something here?
How many organisations have a Business Continuity Planning horizon of greater than a month? From my experience, the answer is not very many. A lot claim to, but their planning usually covers what to do in the first few weeks in detail, after which it is something along the lines of “We’ll rent a new office”. This longer term strategy for a disruption is known, technically, as “Post Incident Acquisition”.
Under normal circumstances, that is when an incident that affects just a small area, such a strategy would probably be OK, but if the incident causes wide-scale disruption over a large area, would such a strategy be viable? So, for example, if your business is in an area that has been destroyed by a tsunami, how many other businesses would also be looking to acquire premises? You might not be able to find anything within a reasonable travelling distance for your staff, and what then?
This shouldn’t be a major problem for an organisation that has a large number of dispersed premises, but for an organisation based at just a single location, this could well mean the difference between being able to recover and not.
As the saying goes, “The proof of the pudding is in the eating.” The proof of the benefits of Business Continuity will, therefore, be seen when an organisation suffers from an incident that causes disruption. There are lots of case studies around showing how organisations successfully used their Business Continuity Plans in response to a disruption, but there are no meaningful studies to compare these against organisations that were affected by similar incidents and which did not have Business Continuity Plans in place.
Why is this? Why has nobody undertaken such a study? Is it too difficult, too expensive, or might the results demonstrate that organisations that hadn’t implemented Business Continuity coped just as well as organisation that had? I’m positive that Business Continuity does make organisations both more resilient and better able to respond to incidents that cause disruption, but it would be nice to see this demonstrated.
Why am I mentioning this now? It’s because there have been two recent events that should provide the opportunity for undertaking such a study. These are the floods in Queensland, Australia, and the earthquake in Christchurch, New Zealand, which provide just the sort of conditions for a study to be undertaken that compares how organisations that had implemented Business Continuity fared compared to those that hadn’t. Anyone for the first PhD in Business Continuity?