I think sometimes we get carried away with the potentially sensational nature of emergency management and disaster recovery planning. I have worked with a number of individual agencies, companies and consortiums who want to do table top exercises for huge, sensational scenarios with borderline Armageddon-like impacts.
Whereas, I am fine helping them prepare for and execute such exercises, I like to warn people that, in terms of business continuity planning, these scenarios are less likely and, believe it or not, potentially less challenging to individual businesses than the isolated and less spectacular building outage due to fire, power-failure or some other similar, mundane event.
Sure the emergency response and triage following an earthquake, tsunami, dirty bomb, etc., will be spectacularly challenging and chaotic, but, if you want to exercise your ability to recover critical business processes, you should consider the following issues.
Remember, in the aftermath of a huge, wide-area disaster:
- Your customers are impacted and may not have a demand for your services during the crisis.
- Your competition may be impacted and not in a position to take market-share from you.
- Given the nature and newsworthiness of the event, the expectation that you are in business will be impacted. The marketplace will be more tolerant of your downtime.
The greater business continuity challenge is…
- If the disaster only happens to you.
- Customers are seeking your services and less understanding that you cannot perform.
- Your competition is fully functional and ready to take your customers away.
- You do not have marketplace empathy.
So, again, I simply wish to caution you as you plan your next table top exercise; focus on what you want to test. If you want to exercise your emergency response posture and the organizations in place to respond to a wide-area disaster, okay, go with the big event. But, if you want to exercise your ability to get back up and running in a scenario where the demand for your services and competitive environment remain constant, maybe just the good old building fire is the best way to go.
I know these types of exercises are less fun to plan and conduct, but the small, independent business interruption event is still the most likely scenario to occur and, if you are not in position to efficiently and effectively respond to that, maybe you can hold off an simulating the end of the world until you are.