Although, as discussed in my previous blog, the terminology is sometimes different, business continuity planning professionals follow a pretty standard, cyclical planning methodology as depicted in this Wikipedia article: http://en.wikipedia.org/wiki/Business_continuity_planning
Even though the methodology is cyclical, first time planners need a starting point and, working under the assumption that the organization they are planning for has no plan in place, they begin in the Analysis Phase. I suggest that this is a mistake.
Every organization has a business continuity plan – it’s just that some of them have not formalized, approved or documented their plans. For many of these organizations, by default, their business continuity plan is to respond to the disaster ad hoc and figure out what to do during the crisis.
I believe that planners can get a quicker start in the planning process and stronger management buy in for the need to strengthen and improve their business continuity plans (or crisis management, or disaster recovery, or emergency response plans) if you start the methodology at the testing phase.
By first performing a Table Top Exercise to discuss, with the management teams, how the organization would respond to a business interruption event today, you will quickly understand the planning objectives, assumptions and expectations of the management team.
Through my years of experience I have witnessed, time and time again, the frustration of management teams after months and months of analysis to identify risks, conduct business impact analysis and define recovery requirements, and yet no one has put together the baseline plan of who calls who when the alarms go off.
I think planners have become a victim of our own methodology and have forgotten the importance of first providing a simple baseline response plan before we try to put in the perfect business continuity plan. I think it is like putting together a football team and designing the playbook with intricate blocking schematics, pass patterns, trick plays, etc., with never teaching the basic football techniques.
Assume a plan exists. Test that plan and allow your business partner, in the process, to discover the weaknesses and fallacies of this plan and lack of documentation to support it, so that they now better understand the need for planning analysis and we better understand their immediate concerns.