Business Continuity Plan, an indispensable investment against disasters

The world is encountering a number of disasters which are putting at stake the lives of people and the survival of businesses. Many organizations are suffering huge financial losses and the question that needs to be asked is how many of them have workable plans to ensure their survival in an event of disaster? This is when a Business Continuity Plan makes total business sense.

One of the priorities of every business, no matter its size, is to protect its future and reputation, and it must always be prepared to face any disaster at any time by having an up-to-date and tested Business Continuity Plan (BCP) showing how to ensure that critical business functions will be available in the event of a disaster.Organisations are always exposed to internal and external threats, thus putting their goodwill at stake and the priority of every business is to continue operation, in the event of a disaster, while maintaining competitive advantage and value system integrity. The achievement of this goal is possible only by having an up-to-date and tested BCP which is in fact a roadmap for continuing operations after a disaster has affected an organisation.

Many senior executives perceive a business continuity process as too costly, time-consuming and/or requiring a large amount of resources that would otherwise be directed in the generation of revenue. This approach makes them ignore or defer the investment in business continuity, believing a disaster would not strike their organization.

In today’s world, a business continuity plan (BCP) is an indispensable investment and should not be viewed as an option but rather a prerequisite of an organisation’s risk management program. A business continuity plan usually includes at least two main parts, firstly an Incident Response Plan and, secondly, a Recovery Plan. An Incident Response Plan is a set of procedures that clearly defines the actions to be taken immediately after an incident; for example, how to evacuate the building, who to call for help, etc. while a Recovery Plan shows how to resume business critical activities within the recovery time objective (RTO).

A BCP is mandatory for all banking institutions in Mauritius and the document and processes need to be regularly updated and tested. Grant Thornton has always encouraged its clients to put in place a workable BCP which is invaluable to a business.During the recent floods in March, small and big businesses and government institutions have been impacted, causing disruptions in daily operations. A number of disastrous events that occurred around the world have demonstrated that although high impact, recovery is possible and institutions with good continuity plans will survive.

Some 10 years back, entire emphasis was laid on disaster recovery plan (DRP) which was essentially focused on the recovery of information technology only.Today, due to the complexity of businesses, BCP has taken lead where it looks at the recovery of the entire critical business process and information technology has become only one of its critical dependencies.

The investment required to set up a BCP can be outlined as the following:

Consultancy services for the elaboration of a BCP taking into consideration guidelines and standards such as BS 25999 (British Standards Institutions (BSI) standards subject to the size of an organization.

Time is a crucial factor to be taken into account while working on a BCP as the creation of such a roadmap will take the time of senior management and selected employees from each department. 

Should a business decide to implement a BCP after a disaster, management needs to consider some of the following aspects: the size of the organisation, the Recovery Time Objectives (RTOs) which is the amount of acceptable time whereby an organization accepts not to operate after an event of a disaster (it is worth noting that less the RTO the more the cost); the Recovery Point Objectives (RPOs), which is the amount of data that an organization accepts to lose in the event of a disaster.

The benefits of having a workable BCP will surely outweigh the expenditure incurred in the creation of the BCP.

Should management believe that a BCP is too costly to put in place, then it could start first by working on the recovery of the IT department by setting up an IT Contingency Plan (ITCP), then consolidate the ITCP into a Disaster Recovery Plan (DRP).Once the DRP is in place, management can work on how to recover the critical business processes by consolidating the DRP into a BCP.

Grant Thornton offers Business Continuity Management (BCM) services to its clients and business partners in order to give them a technological edge in this fiercely competitive business world. It also offers an end-to-end IT service around the following service heads: IT Consultancy Services/IT Audit service, Process Consultancy Services, Quality Assurance Services, Facility Management Services. The methodology for IT consulting starts by aligning all IT initiatives with the strategic business objectives of an organization. The firm has acquired extensive experience in a wide variety of organizations, including governmental bodies, private companies, para-statal bodies and financial institutions in various sectors such as Banking, Textile, Distribution, Financial and others, in both Mauritius and India.