Business Continuity Training and Testing: …

1 Business Continuity Training and testing : narrowing the Gaps Betty A. Kildow, CBCP, FBCI, Emergency Management Consultant Kildow Consulting 765/483-9365; 93nd Annual International Supply Management Conference, May 2008. Abstract. A plan is not a plan until it has been tested; it is only theory. A program of Training , exercises, and tests, moves plans beyond the concept stage, provides Training opportunities for employees, and helps identify needed corrections in procedures and plans. All employees are critical to the success of your Business Continuity Program and need to receive the appropriate level of education and Training . For most employees this will entail the basics what programs exist, the purpose of each, what it means for them, what they can expect from the organization when disaster strikes, and what the organization expects of them.

2 For Business Continuity Teams exercises and tests provide advanced Training and an opportunity to identify needed improvements to strategies and plans before a disaster occurs. You Have a Business Continuity What? Once a Business Continuity plan has been developed likely after going through several draft iterations it is important to make sure that the plan provides the guidance necessary to make the Business Continuity strategies work. Have all Business Continuity team members read and assess the plan document. Here are some of the questions to consider when assessing your Business Continuity plan: Does the plan address the requirements of the entire supply chain including the manufacturing process through the distribution process, spanning all movement and storage of raw materials, and in-process and finished inventory from point-of-origin to point- of-consumption?

3 From a supply chain perspective, does the plan take into account all internal and external links and interdependencies? Have consumer requirements been taken into account? Does the plan include strategies for maintaining full customer service and meeting all service level agreements? Does the plan fully document under what circumstances the plan will be activated and the team notified, who has the authority to do so, and how that will be accomplished? Does the plan tell those responsible for carrying it out: where they are to go, what are they are to do, and how they are to do it? Does the plan include a reporting structure? Is the plan user friendly and easy to read with step-by-step checklists for all team members? Does the plan consider people issues and provide Business Continuity team staffing that includes primary assignments and at least two backups for all Business Continuity team members and others assigned responsibility for continuing or restoring critical functions following a disaster in the event you can't contact them, they can't get to where they're needed, or they're not available?

4 Is there people redundancy, cross-trained personnel who can fulfill all identified critical functions should the primaries be unavailable? Does the plan include an attachment listing complete contact information for all external as well as internal key contacts, , customers, suppliers, and contractors? Are hard copies of the plan available off-site? Are there controls to track distribution of copies of the plan and make certain all plan holders receive all updates and revisions? Look for gaps. There are several areas of Business Continuity planning that are often overlooked or under-planned. One of these is disaster communication. Disaster Communication. Maintaining contact with employees, other company locations, customers, suppliers, contractors, regulatory agencies, shareholders, and other stakeholders is an essential part of the managing the disaster, and one that is often overlooked or given insufficient attention.

5 Post-disaster communication strategies need to be detailed in your Business Continuity plan. Additionally, being prepared to handle requests from print media, radio, and television can help ensure that the media does not become a secondary disaster. Situations, initially viewed as minor annoyances or small emergencies, may turn into a disaster if adequate communication is not maintained or if the media becomes interested. In particular for the visual medium of television, action events are perfect for newscasts. Therefore, fires, incidents resulting in injuries or fatalities, bombing, etc., will draw attention and be excellent candidates for a broadcast with film at eleven.. A serious problem and the way in which you opt to respond to the situation, including your crisis communication strategy, may represent a critical turning point in the way your company operates and in the way you are perceived by your stakeholders, including customers, suppliers, regulatory agencies, and the public in general.

6 It is important to consider and have a plan for keeping those who may have heard about the crisis and who have a vested interested in your company in the loop. This includes customers who need assurance that the products or services they receive from you will still be time at the quality level they expect. Employees will want to know what they are to do and how the crisis may impact them and their jobs. There are four components of effective disaster communication with stakeholders: (1) getting the right information to the right people at the right time; (2) the technical capability to communicate; (3) clearly communicating the information; and (4) rumor control to prevent misinformation. Your post-disaster communication with stakeholders will be more timely and effective if, before a crisis occurs, there is pre-assigned responsibility for keeping key contacts informed.

7 Identify who will establish and, as necessary, maintain contact, with whom, and how. As with all others who have disaster response responsibilities, have a backup for each person with primary responsibility should they not be immediately available when a disaster occurs. Create a database of key stakeholder contacts that is maintained and updated frequently. Prepare templates and sample letters to speed the process of getting written updates to stakeholders. Present your information to all stakeholders quickly and honestly. As appropriate, provide frequent updates on how you're doing in responding to and recovering from the disaster. Customers, while they will sympathize with your plight, need to know how your situation will impact them. Above all else, will the service/product you provide be delivered as scheduled?

8 Identify the groups and individuals with whom your company will need to communicate when a disaster occurs. Get input from throughout the organization. Include both those who have an actual need for information and those who believe that they need information. In the case of the latter group, remember that if you don't provide information, they will most likely get it elsewhere, or even create their own answers. If not already in place, consider developing and implementing a company policy that employees are not to give statements to the media. Not everyone is skilled at giving statements or interviews and having a no statement policy benefits both the organization and the employee. It protects employees from possibly being responsible for incomplete, incorrect, or proprietary information making its way to the front page of a newspaper or from being the source of a damaging sound bite on an evening news broadcast.

9 Educate employees about the importance of following the company's media policy and also provide them with information about to whom to refer media representatives contact. Include complete and accurate contact information. Having a reporter with a microphone ask for your opinion or having a news camera bearing down on you can be impelling. While reporters have the right to interview anyone they want to; everyone has the right to decline to be interviewed. A no comment policy and a person to whom to refer media representatives provide direction and make it easier for employees to decline to comment. The importance of acting promptly when responding to a disaster can not be it all, tell it fast, and tell the truth. To prepare for successful disaster communication, develop and regularly maintain notification lists, a list of immediate internal notifications to be made in each type of crisis ( , CEO, Public Relations Department, Security, Legal).

10 Designate how each person will be contacted and by whom. Include Business and home contact information including land line telephone, cell phone, PDA's, and e-mail. A helpful tool is a laminated card containing this information that is carried by those with crisis communication responsibilities. Keep all employees informed through use of an employee 800 number, e-mail, intranet, and electronic notification systems. Employees need to know when and where to report to work or that they are to stay at home until notified otherwise. Also consider how your company's Internet presence may be used to communicate your message when a crisis occurs. An additional pre-assignment may be a person(s) who will facilitate use of the Internet to contact identified stakeholders and keep them advised of the company's actions in responding to the crisis and possibly make information available to the general public.