Is Your Business Continuity Plan up to Scratch?

By Craig Atkins, Managing Director, 1-Fix Limited

Covid-19 has been a great test of company’s business continuity plans. The firms that had solid plans jumped into action to implement them, with varying degrees of success, and those that didn’t have them – or hadn’t reviewed them since drafting them years ago – quickly scrabbled around to get themselves operational.

The heartening thing with this whole situation has been that, on the whole, most companies have been able to adapt and get themselves back up and operational in a very short time period, indicating that their continuity plans were well designed and executed.

However, it is not all sweetness and light. As the MD of an IT managed services provider I’ve seen some great examples of both good and bad business continuity plans, and I’ve got a couple of examples of recent real life failures of those plans to share with you so that hopefully you don’t make the same mistakes that these companies did.

Buying equipment at the last minute…

The first example is from a company in the service industry sector. They had what appeared to be an excellent business continuity and disaster recovery plan, and they ran regular tests and scenarios against the plan – something that many other firms don’t do, or at least not regularly. They felt like they were well prepared for most disaster scenarios, as they already had 75% of their workforce working remotely (although crucially not the admin & back-office teams).

Their plan had a full process for what should happen if the office is inaccessible, which was then implemented once lockdown had been announced. The plan stated that initially, they would provision some key business-critical staff with spare IT equipment that was kept on-site, and then over a period of a few days they would source and supply the remaining staff with computers and remote communication tools once they had determined how long the office would remain inaccessible.

Unfortunately, the plan they had designed, although ideal in the scenario of office inaccessibility through natural disaster, terrorism, or other threats isolated to their own business, had not considered what should happen in the event of all businesses being forced to do the same thing.

When they came to source the equipment for the staff to work remotely it was almost impossible to get all the items they needed, due to high demand. Luckily, they managed to source enough equipment – and loosen their “bring your own device” policies to allow home users’ machines to be utilised for work – so they adapted short term.

Longer-term, their revised plan is to switch many of their older desktop machines for laptops which can be easily taken off-site in the future. They are also planning to keep a smaller cache of equipment available at a second site location in case a disaster rendered all the main office machines unserviceable.

Managing the phones…

Craig Atkins

In a very similar manner to the first example an accountancy firm with 30 staff had considered the scenario of their office being unavailable, but they had not foreseen it being for longer than a few weeks. Their plan had determined that a longer office closure would have resulted in a temporary re-location to a service office environment, and the sourcing of a new site if the closure was permanent.

They had been considering upgrading their telecoms for some time but were still ‘sweating the asset’ of a traditional PBX phone system that was physically located in their office.

Their disaster plan for their communications was to forward the calls from their inbound number to an emergency mobile phone, take messages and ask their staff to use their own communication devices to make calls back to the customers.

Unfortunately, once this plan was put into action it was very quickly apparent that it was flawed. Firstly, the plan relied on one member of staff to take all the calls inbound to a company that previously had 30 staff available to answer the phone. Secondly, due to self-isolation the person who had the phone was unable to pass it over to another staff member to help share the duty.

They attempted to work around the issue by trying to forward calls to multiple staff mobiles, but it soon became apparent that their fixed-line phone system was a millstone around their neck when it came to flexible working. There was also the compliance issue of a lack of call reporting and metrics from staff using their own devices to make calls and the reputational issues caused by bad lines, poor signal, and the inability to present the corporate number on outbound calls.

Thankfully the major VoIP network providers were still able to onboard new clients while in the midst of the pandemic, so this company were able to get their staff set-up with softphones on their computers or mobiles and pushed through a very quick migration of their phone numbers onto the cloud.

What if’s

Having put our continuity plans to the test during Covid-19, the most important thing for all businesses is that we now take the time to analyse what we did well, what we could have done better, and what didn’t work at all. Finally, don’t be afraid to play devils advocate when analysing the plan – ask lots of “what ifs”, after all, I’m sure not many of us expected the “what if” of a global pandemic but we’re all going to finish with a better, tested continuity plan at the end of it all!