Over-emphasising the place of IT in business continuity plans could increase the time it takes a department to recover from a crisis, the Business Continuity Institute (BCI) has warned.
Speaking at an HP-sponsored roundtable ahead of next week's Business Continuity Expo in London, Bill Crichton, HP consultancy manager for European business continuity services and a member of the BCI's executive committee, said that focusing on IT systems that enable data recovery does not in itself translate into immediate business recovery.
As well as making technical provisions for outages, Crichton said that departments should draw up detailed plans, which define clearly the roles that employees would be expected to undertake during a crisis.
Companies should also document the processes staff should follow to ensure continuity of business, he said.
To demonstrate readiness, Crichton advised organisations to regularly audit their business continuity plans against live scenario tests.
"Businesses need to validate the basic assumptions behind whatever plans they currently have in place, and the most basic one is that having a fallback IT resource is all you need," he said.
Martin Atherton, principal analyst at Freeform Dynamics, made a similar point in a report last month published by CA.
"Technology can help with some of these challenges, but only if deployed as part of a broader strategic imperative which combines business leadership, personnel training and flexible processes and policies," Atherton said.
David Bason, IS director at law firm Shoosmiths, who was speaking at the same roundtable as Crichton, said his first-hand experience of scenario testing had emphasised the benefits of defining roles and processes.
He said it was only after Shoosmiths began live testing that it was able to refine its continuity plan to encompass the way staff worked in a crisis.
"In the event of a network failure, some workers might say, 'there is no point me sitting at my desk because I cannot do my work I might as well go home'," said Bason.
By clearly demonstrating that there are productive things that employees can be doing in these circumstances, Bason said business continuity immediately became more effective.
Also present at the roundtable was Jon France, business continuity manager at LexisNexis, who said his firm's experience had emphasised the need to "consider your neighbours" when conducting a risk assessment.
"Our datacentre was cordoned off by police during the fallout from the Buncefield oil refinery explosion in 2005, which meant continuity plans had to handle the situation," he explained.
"There is a myriad of things that can go wrong, but departments should focus plans for the end impact on the business, and at the heart of this is its people and its processes."
Comment on this article: [email protected]