Choosing the right business continuity (BC) strategy for your business will depend on your business’ tolerance for disruption and recovery objectives.
Deciding on the right business continuity strategy is key to developing the appropriate business continuity arrangements and measures that give your business resilience. These shouldn't be seen just as a single strategy for the business, but applied to different functions within your organisation, individual assets or resources.
Establishing the correct business continuity strategy is part of the “design phase” of the business continuity lifecycle. It will be dependent on the recovery time objectives of the business or the specific operation, which are in turn dependent on the business’s tolerance for disruption - both of which should be determined in the “analysis” phase.
Your business continuity strategy will be geared to how quickly the operation needs to be recovered.
My recovery time is measured in minutes or hours
To achieve Resilience, you should consider a Diverse Site strategy. This will mean undertaking the business activities at two or more geographically diverse sites, so that operations can be switched from one to another as both sites are “live”. This strategy usually delivers a high degree of resilience, but it can also be very costly and may not protect an organisation if the incident has a worldwide reach, such as a pandemic or computer virus.
For this to work there will also need to be autonomous business systems, so the loss of one site doesn't "take out" business functionality at the other.
My recovery time is greater than a few hours but less than a day
In this scenario a replication strategy can work well, provided there is the capability to undertake the business activities at another geographically diverse site and to move the people to the replica site after an incident; both sites are fully functional, one site is live and the other dormant; a replica site could be a provided by a third party (for instance a competitor with whom a reciprocal agreement is in place) or by the organisation itself. This strategy will work provided:
The staff can be moved to the replica location quickly enough to resume the delivery of the product or service within the recovery time objective (RTO).
Staff are both able and willing to work away from their normal site for what could be a prolonged period of time.
My recovery time objective is greater than a day and I have alternative locations
Use of a Standby Facility that can be made operational within your RTO. This could be obtained from a third party or provided by the organisation itself (particularly if a facility has been temporarily shut down but capable of being made operational at short notice). This can work well for office based activities and it also relies on staff being both able and willing to work away from their normal site for what could be a prolonged period of time.
My recovery time objective is days but my recovery time is greater
In this scenario there are two options to consider which might well combine - increasing your tolerance for disruption and therefore your RTO or outsourcing your activities.
Increase tolerance for disruption
Just-in-Time and lean processes create this challenge, and one of the options is to increase the RTO. This will inevitably require holding buffer stocks which will need to have physical separation from the production process. This might be achieved for instance by increasing stock levels held by a distribution company.
This strategy can be particularly suitable for manufacturing, where the cost of having diverse sites, replicas or standby facilities may be prohibitive; some or all of the activities required to deliver a product or service can be subcontracted to a third party.
Outsourcing
Where this is viable and subcontract arrangements have been set up in advance, then it's critical that the designs, templates, tooling, moulds and stocks of parts and raw materials can be deployed immediately to the subcontractor’s site regardless of what has occurred.
For products and services that have a longer RTO it might be possible to wait until after the incident before entering into a contract, but these arrangements need to take into account geographic diversity in the event that the incident affects the subcontractor as well.
Such an arrangement also opens scope to develop reciprocal arrangements.
My recovery objective is measured in days or weeks
Where the Business activities have their RTO measured in days or weeks, this may be as simple as having a list of requirements and suppliers that can provide them at short notice and ordering the facilities required after the incident has taken place.
Insurance
Insurance, when properly arranged, can provide financial compensation for loss of assets, increased costs of working, business resumption and protection for associated legal liabilities. However, it is unlikely to provide cover for the full expense of an incident including the loss of customers, impact of shareholder value or loss of reputation and brand image. It is important therefore, that the continuity options selected are consistent with the organisation’s insurance cover. However, a particular form of Business Interruption Cover known as Additional Increased Cost of Working can allow you to “throw money at the problem” when correctly arranged. This can have a bearing on the viability of other continuity strategies that are adopted and can inform better business continuity planning decisions.
I have months to recover my business
Where the RTO is measurable in months. It may be appropriate, if the delivery of the activity, product or service does not require any specialist equipment/facilities/skills that are difficult to obtain, to wait until after the incident to decide on a business continuity strategy that allows for the recovery of a product or service.
For advice on how to choose the right business continuity strategy for your company please get in touch for a discussion.
