Why Business Continuity Plans Fail
There are many excuses that organizations can make on why a BCP is not needed, but the reality is that when the rubber meets the road and tragedy strikes, organizations that don’t have a plan will have a very hard time recovering. According to research by the University of Texas, only 6 percent of companies suffering from a catastrophic data loss survive, while 43 percent never reopen and 51 percent close within two years.
Business Continuity plans often fail for the following reasons:
1. Too few Involved in the Whole Process
a. Small recovery teams, which require all individuals involved to be spread too thin, or making the mistake that only a select few staff need to know about the plan, make it impossible to execute the plan.
2. Lack of Testing
a. Plan is never tested or not tested often enough. A plan that sits on a shelf is not really a plan. The creation of a Business Continuity Management System ensures that testing to validate the plan and to train the staff is completed regularly.
3. Failure to Prioritize
a. Necessary staff, finances, or time is not allocated to the plan. Too many organizations make business continuity planning part of ‘other duties as assigned’ when giving an employee annual objectives. Or they don’t budget any money for the development and ongoing maintenance of a plan. Companies only want to plan for success; it is contrary to human nature to plan for overcoming obstacles to the plan.
4. Cost Prohibitive
a. Business Owners think that only large corporations can afford a plan. Plans do not need to be costly. Companies look at the cost of recovery software, and the start up costs of developing a plan and decide it is too expensive. But plenty of plans are created on standard word processing and spreadsheet software already used by a company.
5. Lack of Support from Management
a. The mentality that thinks, nothing will ever happen to us. I’ve heard various excuses from ‘Our offices are in a suburb, what do I have to be worried about?’ to ‘I’ve been in business for years already, and nothings happened, what’s going to happen now?’ us.
b. If we don’t admit that we need a plan, perhaps we never will. This is a great excuse, otherwise known as the ‘Bury your head in the Sand’ theory. But we all know while this may work occasionally, most often it just causes the problem to get larger.
c. If something would happen, our organization will not be affected by it. The we are too big, important or (you fill in the adjective) to fail mentality. The reality is for the select few organizations that this may hold true for, have plans already.
Don’t be another statistic; develop a Business Continuity Management system today.
Lisa DuBrock is a Partner and IT Compliance Practice Manager for The Radian Group, LLC. You can contact her via email.