Designing the entity’s business continuity approach

We can’t solve problems by using the same kind of thinking we used when we created them.

- Albert Einstein.

This section provides guidance on how to design the entity’s business continuity approach to minimise the effects of disruptions to each critical business process for which a maximum tolerable period of disruption and recovery time objective has been established.

Minimising the effects of disruptions to critical business processes involves:

  • identifying and evaluating options to minimise the effects of a business disruption; and
  • selecting alternative activities and resources.

 

Identifying and evaluating options to minimise the effects of a business disruption

For each of the critical business processes identified and ranked in the business impact analysis, options are needed to:

  • reduce the likelihood and consequence of the disruption to the activities and resources on which the critical processes rely; and
  • implement alternative activities and resources to be used following a business disruption and activate plans to recover and restore normal operations.

Evaluating options available to ensure the continuation of business will identify alternative activities and resources to be used if a business disruption event occurs. Alternative activities and resources may be a combination of different services or redundancy retained ‘just in case’ (for example a hot, warm or cold site).22

Variations to, or redesign of, existing activities and resources should be considered as a means of reducing the exposure to, or consequence of, the disruption of a critical business process.

In selecting alternative activities and/or resources, it is important the following activities and/or resources are addressed as part of the business continuity planning process:

  • people;
  • facilities (including buildings and equipment);
  • technology (including IT systems/applications);
  • telecommunications; and
  • vital records.

People
People, including contract personnel, are the vital resource in ensuring continuity of business. An unexpected loss of key/experienced personnel, or a team, can have significant consequences for an entity’s capacity to achieve its objectives.

The business continuity approach needs to include treatments for people, which incorporates:

  • communication strategies – communication channels and messages for different groups such as continuity team members, entity staff, external stakeholders, and the general public;
  • human resource issues, including;
    • short-term replacements and training;
    • sustained reduced staff capacity disruptions (for example, due to a pandemic
      occurring); and
    • employee payroll;
  • issues relating to the specific business disruption; and
  • the psychological effects of the disruption on staff morale – this may include trauma counselling for staff both during and after the event.

Case Study – Human resource issues

The State Library of Victoria is a public sector entity which aims to ensure that the documentary resources of significance relating to Victoria and Victorians are collected, preserved and made available and that Victorians have access to worldwide information resources. In the course of its business continuity planning, it identified an inherent risk in ensuring sufficient access to a skilled team of specialists to assist in the conservation and preservation of its unique cultural heritage material in the event of a disaster, or major incident that affected the integrity of the Library’s collections. As a result of undertaking a business impact analysis and developing a business continuity plan, the library has effected increased cross agency collaboration. A memorandum of understanding has been entered with allied organisations that will enable the shared use of expertise and resources in the event of major emergencies affecting the State’s unique cultural heritage. By using expertise in allied organisations the number of experts available in the event of a major emergency was increased five-fold without any additional cost. Issues regarding cross party indemnification have also been resolved, and work practices to give effect to this plan have been established.

Source: State Library of Victoria.

 

22 Alternative sites provide a data centre and work area held in readiness for use during a business continuity event. A ‘hot’ site is fully equipped and provides immediate access (for example the data centre is permanently connected to the entity’s primary or back-up systems, there are operational workspaces, printers, telephones etc), a ‘warm’ site is partially equipped (for example, the data centre is capable of accessing the entity’s system, but the data processing and work area needs to be configured), and a ‘cold’ site is a basic work area with data centre access that needs to be configured to resume operations (for example it has electrical and telephony connections, but no equipment – such as a hotel’s conference facilities).

 >Contents

>Workbook

>Feedback

Back

Next