Kirsten McKnight's List: BCP/DRP

---

G. Patrick Pawling
3/19/2007
Monthly Online Risk Management Column

It's a shame to spend time, money, and resources planning for things that might never happen. But that's life in the big leagues - and if you have to do it, you might as well do it right.

One good starting point is to understand the differences between disaster recovery and business continuity. One easy comparison is compliance and corporate governance. While the two are inseparable, compliance might be thought of a series of specific situations - action items - while governance is the overall road map, the comprehensive framework that keeps companies out of compliance trouble - and more, if done right.

Though disaster recovery and business continuity are still often used interchangeably, thinking of them separately is helpful in terms of planning, budgeting, and ultimately, a company's ability to respond to challenges- whether a power outage, a terrorist attack, the death of company leaders, or even the sudden appearance of a disruptive new technology.

"I think of business continuity as more comprehensive," says Rich Ptak, founder and partner of Ptak, Noel & Associates, and a strategist with more than 30 years experience in systems product management. "It's more than just IT and data protection. It looks at the whole operation of the enterprise in a preemptive and holistic way."

Disaster recovery is often most focused on events such as power outages, IT attacks, natural disasters, and terrorist events. While disaster recovery can help an organization get back up and running more quickly in the event of those problems, a comprehensive business continuity plan can be more of a longer-term - or even preemptive - set of answers to an even wider set of challenges.

What happens if a company's leaders die in an airplane crash or a fire? What if a competitor introduces a completely disruptive new technology or product? Or, if a strategic supplier in another hemisphere goes out of business or is disabled by an earthquake or political instability? These aren't always considered during disaster recovery planning, but they can all certainly be disruptive - and should be part of an overall business continuity plan.

Another difference As Ptak notes, companies that focus on disaster recovery tend to focus more on, well, recovery, as opposed to prevention. "With business continuity you tend to focus more on avoiding problems," he said. "I mean putting in place the processes and procedures that not only maintain the operation of the business if there is an event, but also guide you in ways to avoid situations. A business continuity plan should also look at delegation of authority, backup plans for the transportation of goods and services, alternative suppliers - everything that ensures uninterrupted operation."

What to think about first? "The short answer is companies need to think about both business continuity and disaster recovery," said Ptak. "Most businesses are better served by starting with a business continuity perspective and then addressing disaster recovery."

Where a company starts to focus depends on its potential weaknesses. Is it IT? The supply chain? The fact is, no matter what you consider your most important elements, your people are central. Any plan must include guidelines for locating employees, allowing for their communication, and setting up a hierarchy of authority. Remember, it's not going to do much good to be able to recover your data if your employees don't know where or how to work.

G. Patrick Pawling writes frequently about technology, financial services and healthcare as part of his duties as lead writer and president of Pawling & Associates, a copywriting/marketing company serving clients in those verticals.

He can be reached at Pat@pawling.net.