This week, motorists were stranded for up to 9 hours on Sydney’s F3 Motorway due to a traffic incident. Emergency plans to implement ‘contra-flow’ arrangements to get the traffic moving again were not implemented until many hours into this incident whilst people endured hours waiting in their cars with no water being distrubuted to them and no way out.
While the facts of the matter are yet to fully emerge and the reasons behind this failure to successfully execute the traffic emergency plan are not yet published, we can consider how this type of scenario can happen to any organization, even if they have business continuity plans in place if they are not thoroughly tested.
Often an organization will have a plan outlined on paper about how a given scenario will be handled. The reality, with all of the real life complications and human factors, is often quite different. This is why we exercise and test the plans.
Real life complexities are difficult to capture in your paper plans because you cannot always envisage the multiple factors that may impact on your recovery processes.
Consider factors that may affect how your recovery plan is executed and how your organization would handle it:
1. An evolving status report
Initially you are told that the incident is not too severe and will be rectified within the hour but then as time progresses it worsens in severity and time frame estimates keep gradually creeping out.
Do you know what your ‘drop dead point’ is, how long can elapse before invoking your plan?
What is your ‘maximum tolerable outage’? How long can the ‘estimated incident recovery time’ be before it is worthwhile to invoke.
Are you getting your updates from a well informed primary source? Do they understand the need for an accurate estimate?
2. Delegation of authority
What if the CEO or appointed Business Continuity Command Team is un-contactable during this incident?
Is there a backup person nominated who is definitely going to be available in their place?
Does the backup person have the complete authority to make decisions which may involve the major ramifications and expenditure?
Has this backup person been trained in how to co-ordinate the communication and oversight of recovery from an incident?
3. Communication Protocols
Imagine the chaos created if various staff members were contacted by different media outlets. Because they have not been given clear guidelines that only the ‘Communications Manager’ may issue any statements to any external parties these well meaning staff members offer their understanding of where the current situation is at. Conflicting or incorrect information is then released to the public.
How will staff react in an incident if they have not had their expectations set about who will communicate what to them?
In a state of confusion people will try and contact their supervisor, their co-workers, whomever they can get a hold of to find out what they should be doing. Just like Chinese Whispers, various accounts of what is going on and what should be done are spreading throughout the organization.
Consider the alternative. All staff have been trained in your business continuity protocols and understand how communication will occur in an incident. There are clear roles for who will co-ordinate recovery efforts and known backup persons should the nominated person be unavailable.
All staff know that there is a communication tree whereby the status updates and requirements will be communicated to them by their business continuity team leader. They know there is a hotline number and an intranet site they can log onto where the ‘Communication Manager’ will post regular updates of information that staff need to know.
Testing your plans thrashes out the finer details, highlights shortcomings and also gets all of the parties involved familiar with the plan and their role.
It is during this process that chain of communication and authority issues can be uncovered and resolved before the plan needs to be enacted in real life.