Ask yourself whether the priority should be given to crisis management or plan development when funds are limited.

In an ideal world, with unlimited funds and resources, business continuity managers would develop well rounded, fully tested, comprehensive business continuity plans, whilst at the same time putting together carefully chosen, regularly exercised, crisis management teams. However, the reality is that for the vast majority of organizations, business continuity management activities are compromised by limited budgets and insufficient time and resources. Therefore some prioritization must take place. This is the first in a series of Continuity Central articles which will attempt to explore the prioritization process and the reasons behind the budgetary and resource decisions that business continuity managers make.

Plan development and crisis management are both key areas of business continuity but where should the priority lie? Where funds and resources are limited is a better to try and focus on both areas or should one area be given the lion’s share of resources to the detriment of the other?
In true business continuity style the way to make the decision is to start with a risk assessment:

1) Scenario one: split funds and resources equally between the two areas.
This would mean that both plan development and crisis management could be covered up to a point. However, there is a substantial risk that both areas will be compromised with the result that the business continuity plan is not as good as it could be and neither is the crisis management team. Both could fail to perform well during an invocation.

2) Scenario two: focus funds and resources on plan development.
Here a detailed business impact analysis would be conducted and the major risks identified. Mitigation and recovery strategies would then be determined. This would result in a document that fully details the steps that will be taken to restore the company’s mission critical assets within the required recovery time objectives for the incidents that have been considered. However, since little resource has been put into developing the crisis team there is a strong risk that the plan will not be correctly used and implemented during an incident and that, if a scenario occurs which goes beyond the boundaries of the business continuity plan, there may be panic and confusion rather than strong crisis leadership and rapid decision making. One of the major lessons learned from September 11th was that many companies with well-prepared business continuity plans failed to handle the crisis effectively because the disaster created conditions which were beyond the scope of the plans.

3) Scenario three: focus funds and resources on crisis management.
Here the bulk of the limited resources are used to develop an excellent crisis management capability. A team is selected for its experience; its decision making capabilities; its ability to perform well under severe pressure and to be able to think ‘outside the box’. The team is frequently exercised and is strongly developed using team-building techniques. The advantage in this scenario is that the crisis team can respond to any potential incident and can quickly develop appropriate recovery strategies, even if these had not previously been envisioned. However, there is a strong risk that, because the focus has been on crisis management, rather than on business continuity plan development, the information that is needed to implement the disaster recovery strategies that the crisis team develop might not be available or might take a long time to acquire.
From the above it seems clear that a compromise solution is required. The benefits seem to fall on the side of having a strong crisis management team; but some element of business continuity plan development is necessary to ensure that the team has the necessary information and that the required pre-planned disaster recovery arrangements have been made. This is the MINIMISED PLAN and

MAXIMISED TEAM approach:

MINIMISED PLAN
Keep the business continuity plan document to the absolutely bare minimum - no complicated procedures and processes, just simple information that the crisis management team can use as the basis of taking action and decisions.

MAXIMISED TEAM
Build the best team possible with your internal resources and add external resources where necessary to strengthen the team and fill the gaps. Use psychometric testing to help with this process. Train the team and exercise it again and again. Encourage lateral thinking and positive leadership. Ensure that your team can always be quickly contacted and that members know the exact location of primary and secondary Emergency Operations Centers and muster points. Ensure that each team member is backed-up by a deputy. The team should be empowered to make all necessary decisions for the company, should include key directors and managers and must have a clear leadership structure.

The above approach requires a particular ‘breed’ of business continuity manager to facilitate it. This person will no longer be primarily a planner but instead will be a ‘people person’. Analytical skills will still be needed but will take second place to team building and training abilities.

Source: David Honour link