Any business needs to consider the possibility of disruption, damage to or loss of business continuity. To fully understand business continuity, it is necessary to appreciate the nature of disruption and its ability to fully or partially halt business.
While utilities have prepared for many different emergency scenarios, few of them have considered a pandemic of this magnitude and duration. While the health and safety of personnel and customers is always the primary concern, “keeping the lights on” also remains at the top of the list. Yet keeping the lights on when employees need to quarantine or become sick is not a trivial task.
We are left to ask: How do you prepare for further disruptions, and how do you transition back to normal operations? How do you classify “critical personnel”? How do you guarantee backup?
To respond to any disruption, you need an understanding of the minimum essential requirements for the business to operate and have full awareness of the critical vulnerabilities. The issue to consider is the difference between loss of function and total devastation.
Contingency Planning Is Essential
The right team in a utility can identify critical business processes, resources, relationships and other information that will be essential in assessing the potential impact of a disruption.
It is imperative to explore interdependencies between systems, business processes and departments; the significance of the risk of points of failure; responsibilities associated with service-level agreements; staff and space that may be required at a recovery site; special supplies or communication equipment needed; location and availability of information; and cash management and liquidity necessary for recovery.
Disruptive events cannot be predicted with certainty, so good contingency planning needs to provide a flexible range of responses — prepared ahead of time — that can be applied during any event, such as:
- Have you established incident response and business continuity procedures?
- Have you established disruption warning and communication procedures?
- Have you established suitable business recovery and restoration procedures?
- Can you identify the resources that you need to implement your plan?
- Have you made people aware of their responsibilities?
- Did you invest in making sure that people are competent to execute their responsibilities?
Resilience Is Key
Resilient organizations are characterized by forward-thinking, and the willingness to take managed risks. Resilience analysis identifies activities and objectives, quantifies impacts of a disruption, and informs appropriate response strategies and priorities.
Resilience is not an outcome itself but an organizational characteristic that can be developed. Organizations comprise people, so organizational resilience is also a factor of the ability of people to recover from major setbacks. This covers several aspects, such as making sure internal communications are effective both peer to peer and up and down the management structure. It is not just about making sure staff are well-equipped to do their jobs, but also making sure staff are mentally prepared. Personnel resilience can thus be developed and improved by training, given enough time.
A systematic process is required for an organization to restore its operations a working state that is as close to normal as possible. The process helps:
- Evaluate potential effects of an interruption to critical business operations.
- Determine the most crucial business functions and staff and technology resources needed for operations to run optimally.
- Establish the time frame within which functions need to be recovered to return to a normal working state.
Additionally, it may be necessary to include subjective rankings of the importance of specific processes, and the dependencies on them for normal operations. These then enable estimates to be made of the quantitative impact associated with a specific business function, the staff needed to recover important systems, and the time and steps required. Data assets may be among the most fragile and temporal of assets, and often the m to quantify in terms of cost value to an organization.
It is critical that personnel responsible for disaster recovery recognize and create coordination opportunities during pre-disaster planning and that roles and responsibilities are understood in advance. Successful recovery depends on all recovery stakeholders having a clear understanding of pre- and post-disaster roles and responsibilities.
At a time where we have all been thrust into atypical situations, it is critical to identify strategies for recovering smoothly while not creating additional vulnerabilities.
Authors: Mark Knight and Dirk Mahling are principal consultants, 1898 & Co., part of Burns & McDonnell.