Share this Question: How do I develop a Disaster Recovery Plan?
Answer: “Plans are nothing. Planning is everything.”
When General Dwight Eisenhower reflected on the monumental task of planning the invasion of Normandy in World War II, he summed up my core advice regarding the development of a disaster recovery plan in six words. Entire books have been written on how to develop effective disaster recovery plans, but any facilities engineer who forgets General Eisenhower’s simple truth will have wasted an inordinate amount of time and money.
An effective Disaster Recovery Plan (DRP) is a tool, not an end game, and certainly not a file-filler or a bookcase trophy. It’s an organic document that must be constantly tested, trained to, adjusted, and amended to address not only your company’s changing business conditions but a constantly changing world.
But first, back to the beginning—following is a high level overview to help you get started on developing a Disaster Recovery Plan tailored to your company’s needs. Today’s facilities engineer must make plans for disasters that are as varied as fire and flood, chemical spills and releases, ice storms, earthquakes, utility disruptions, and—unfortunately in today’s post-911 world— acts of terrorism here or abroad that disrupt your supply chain. While the threats may vary greatly, their impact is the same: all have the potential to interrupt production and other operations, causing untold damage to your bottom line. Even worse is the potential to injure or kill your employees or members of the public.
Step One: Laying the Groundwork
Developing an effective disaster recovery plan is an exercise in planning. Your first task is to build support and buy-in from management. You must build a solid business case addressing the concerns of management, employees and, in the case of a public company, investor scrutiny. To borrow a phrase from the game Monopoly, do not pass “Go” until management is squarely behind both funding the plan development and supporting the required ongoing training, testing, and amending. Management support must be both budgetary and highly visible—in fact the most successful plans include top management as active members of the DRP team. Don’t expect your C-suite members to attend team meetings but do require them to visibly support the program, schedule regular briefings, know their roles cold, and participate visibly and actively should a disaster strike.
Your second step is to identify and recruit key members of the DRP team. Effective and swift recovery from any disaster requires the talents of many individuals within an organization—this is not just a manufacturing challenge. To succeed in recruiting the best and the brightest across your organization (and those that don’t wither under pressure-cooker scenarios), make sure your recruiting efforts carry the gravitas of senior management. An e-mail from the CEO outlining the importance of developing a DRP works wonders. Your team members must have the seniority, experience, temperament, and authority to be able to analyze a wide variety of situations and make decisions quickly. When disaster strikes, the DRP team doesn’t have time to wait for purchase order approvals.
Bring representatives, with authority, on board from the following disciplines:
Next Step: Risk Assessment
In order to plan, you need to understand what you’re planning for. Develop a thorough risk assessment, identifying potential risks for each location. You need to be sure your playbook contains a comprehensive list of scenarios that could impact your operations. It’s helpful to categorize these risks into natural disasters, technology disasters, and those caused by human error, accident, or intentional acts.
For each potential threat or hazard, identify your facility’s vulnerabilities and clearly articulate any potential impacts on your company. Make sure your impact analysis goes beyond operations—you need to plan for effects on people, property, the environment and both your company’s financial health and reputation.
The risk assessment phase will likely uncover opportunities to eliminate, minimize, or mitigate some of your company’s vulnerabilities. Set up risk specific mitigation teams to address these opportunities on a parallel track with your DRP efforts, and be sure the work of both groups is closely coordinated.
Your final risk assessment step is to prioritize the risks, based on likelihood of occurrence and its potential impacts to your company, its people, property, or the environment. Spend some time developing your rationale and guidelines for prioritization—the time spent up front will make managing any scenario easier.
Plan Development: Where the rubber meets the road
Rolling up your sleeves and developing a solid, actionable disaster recovery plan requires diligence.
Each risk requires a scenario review and analysis, an action plan, a delineation of core team responders and roles, a discussion of appropriate response levels and escalation triggers and complete resource information. Additionally, specific functions—such as communications— require the development of a separate crisis plan.
Structure your plan so that it’s reader friendly and usable. Keep your language concise, use charts, as well as bolds and bullets in your text. Make sure technical information needed by the disaster recovery team is readily available. Tab sections in hard copies for easy reference (and hard copies are a must in today’s power dependent world of online information).
In my next column, I’ll delve into the specifics of creating a disaster recovery plan tailored to the requirements of your business, including resources you can access for more information. In my third column in this series we’ll look at managing an incident, as well as training and ongoing testing of your plan to ensure required course corrections keep you on top of changing risks.
Fair to say that General Eisenhower had it right. Until next time.
Richard Bilodeau, PE, is director of engineering at SMRT, architects and engineers (www.smrtinc.com). His 30 year career includes plant engineering positions in clean manufacturing. Richard has designed, operated, and supervised the construction of advanced technology facilities, numerous industrial projects, healthcare facilities, and corporate offices. He’s engineered clean manufacturing facilities for lithium-ion batteries, medical devices, electronics, and pharmaceutical clients. Richard can be reached at: TheFacilitiesGuy@smrtinc.com.
Answer: “Plans are nothing. Planning is everything.”
When General Dwight Eisenhower reflected on the monumental task of planning the invasion of Normandy in World War II, he summed up my core advice regarding the development of a disaster recovery plan in six words. Entire books have been written on how to develop effective disaster recovery plans, but any facilities engineer who forgets General Eisenhower’s simple truth will have wasted an inordinate amount of time and money.
An effective Disaster Recovery Plan (DRP) is a tool, not an end game, and certainly not a file-filler or a bookcase trophy. It’s an organic document that must be constantly tested, trained to, adjusted, and amended to address not only your company’s changing business conditions but a constantly changing world.
But first, back to the beginning—following is a high level overview to help you get started on developing a Disaster Recovery Plan tailored to your company’s needs. Today’s facilities engineer must make plans for disasters that are as varied as fire and flood, chemical spills and releases, ice storms, earthquakes, utility disruptions, and—unfortunately in today’s post-911 world— acts of terrorism here or abroad that disrupt your supply chain. While the threats may vary greatly, their impact is the same: all have the potential to interrupt production and other operations, causing untold damage to your bottom line. Even worse is the potential to injure or kill your employees or members of the public.
Step One: Laying the Groundwork
Developing an effective disaster recovery plan is an exercise in planning. Your first task is to build support and buy-in from management. You must build a solid business case addressing the concerns of management, employees and, in the case of a public company, investor scrutiny. To borrow a phrase from the game Monopoly, do not pass “Go” until management is squarely behind both funding the plan development and supporting the required ongoing training, testing, and amending. Management support must be both budgetary and highly visible—in fact the most successful plans include top management as active members of the DRP team. Don’t expect your C-suite members to attend team meetings but do require them to visibly support the program, schedule regular briefings, know their roles cold, and participate visibly and actively should a disaster strike.
Your second step is to identify and recruit key members of the DRP team. Effective and swift recovery from any disaster requires the talents of many individuals within an organization—this is not just a manufacturing challenge. To succeed in recruiting the best and the brightest across your organization (and those that don’t wither under pressure-cooker scenarios), make sure your recruiting efforts carry the gravitas of senior management. An e-mail from the CEO outlining the importance of developing a DRP works wonders. Your team members must have the seniority, experience, temperament, and authority to be able to analyze a wide variety of situations and make decisions quickly. When disaster strikes, the DRP team doesn’t have time to wait for purchase order approvals.
Bring representatives, with authority, on board from the following disciplines:
- Senior management: buy-in/plan approval/public face
- Finance and Purchasing: funding and supply procurement/ expenditure management/vendor relations
- IT: systems recovery and/or management
- Logistics: planning/staging recovery efforts
- Operations: your lifeline to getting manufacturing up and running
- Security and Emergency Response: their department
- Sales: customer relations/communications conduit/ income stream champions
- HR: employee and family issues
- Legal: Make sure your legal rep is capable of enabling the process, not manufacturing roadblocks. You need a problem solver, who can address red flags, not surrender to them.
- Government relations: Don’t underestimate the value of this function. Strong government relations allowed one manufacturer to bring their operations online during a massive regional power failure days before power was fully restored.
- Communications: Your lifeblood to emergency responders, your employees, the press, your Board of Directors, your investors, your customers, and vendors— anyone with the power to impact the health of your company both immediately and for the long term.
Next Step: Risk Assessment
In order to plan, you need to understand what you’re planning for. Develop a thorough risk assessment, identifying potential risks for each location. You need to be sure your playbook contains a comprehensive list of scenarios that could impact your operations. It’s helpful to categorize these risks into natural disasters, technology disasters, and those caused by human error, accident, or intentional acts.
For each potential threat or hazard, identify your facility’s vulnerabilities and clearly articulate any potential impacts on your company. Make sure your impact analysis goes beyond operations—you need to plan for effects on people, property, the environment and both your company’s financial health and reputation.
The risk assessment phase will likely uncover opportunities to eliminate, minimize, or mitigate some of your company’s vulnerabilities. Set up risk specific mitigation teams to address these opportunities on a parallel track with your DRP efforts, and be sure the work of both groups is closely coordinated.
Your final risk assessment step is to prioritize the risks, based on likelihood of occurrence and its potential impacts to your company, its people, property, or the environment. Spend some time developing your rationale and guidelines for prioritization—the time spent up front will make managing any scenario easier.
Plan Development: Where the rubber meets the road
Rolling up your sleeves and developing a solid, actionable disaster recovery plan requires diligence.
Each risk requires a scenario review and analysis, an action plan, a delineation of core team responders and roles, a discussion of appropriate response levels and escalation triggers and complete resource information. Additionally, specific functions—such as communications— require the development of a separate crisis plan.
Structure your plan so that it’s reader friendly and usable. Keep your language concise, use charts, as well as bolds and bullets in your text. Make sure technical information needed by the disaster recovery team is readily available. Tab sections in hard copies for easy reference (and hard copies are a must in today’s power dependent world of online information).
In my next column, I’ll delve into the specifics of creating a disaster recovery plan tailored to the requirements of your business, including resources you can access for more information. In my third column in this series we’ll look at managing an incident, as well as training and ongoing testing of your plan to ensure required course corrections keep you on top of changing risks.
Fair to say that General Eisenhower had it right. Until next time.
Richard Bilodeau, PE, is director of engineering at SMRT, architects and engineers (www.smrtinc.com). His 30 year career includes plant engineering positions in clean manufacturing. Richard has designed, operated, and supervised the construction of advanced technology facilities, numerous industrial projects, healthcare facilities, and corporate offices. He’s engineered clean manufacturing facilities for lithium-ion batteries, medical devices, electronics, and pharmaceutical clients. Richard can be reached at: TheFacilitiesGuy@smrtinc.com.
No comments:
Post a Comment