This is a debatable point but possibly acting upon an outdated strategy will be time, money and energy misspent in recovering something that is incorrect or no longer needed.
Change is inevitable … A plan can easily get out of date as staff turnover, new business units are created or decommissioned, IT systems are changed, removed or added, risks affecting the business change or the priorities of the business have changed.
Given the resources typically spent to get a BCP in place in the first instance, it makes good sense to undertake some regular maintenance to ensure it stays current. The longer this is put off, the greater the chance that the whole thing will need to be re-visited down the track.
Maintaining the BCP needn’t be hard but it has to be assigned as someone’s specific responsibility and priority.
Nominating a BCP Manager or Co-ordinator is the first step. It is their responsibility to maintain the overview of all of the planning documents and resources in the organization and to ensure they are kept up to date, even if they are delegating tasks to others.
Ensure the BCP Manager is empowered by Senior Management in this role, making sure the stakeholders that may need to be involved know this is an important task they will be asked to participate in.
Determine a frequency for updates that is realistic and achieveable and stick to it. Schedule out review dates ahead of time, put them in stakeholder’s diaries and schedule review meetings well in advance if necessary.
Include BCP and IT DR considerations in the ‘impact analysis’ for all new projects, not just IT but business projects as well. This may mean adding a section into the organisation’s Business Case and IT Change Request templates. New projects should be considered in the light of impact on existing strategies and business continuity provisions. New IT systems should have their IT Disaster Recovery provisions planned for within their business case and implementation projects if necessary so that the new systems are not left without sufficient coverage.
Not all organizations are able to invest in a full-time BCP Manager so instead the responsibility gets tacked on to someone’s existing role, with varying degrees of success.