Right time to ensure efficiency of BCP spend

big on budget Despite the current tough times, companies that already have a business continuity management (BCM) program should not look for ways to cut expenses relating to their business continuity plans (BCP).

Instead, they should see how to get a better return on what they have already invested in BCM, and stop spending time on low-value BCM activities.

The following are some areas to consider in keeping your BCP processes relevant.

• Chop down the emergency notification "call tree": Maintaining lists of employee phone numbers takes way too long to contact everyone. People forget their lists and mobile phone channels are jammed in a disaster. Instead, just get the HR department to keep a current list of employees by the emergency exit door. If the fire wardens can grab an accurate list of all employees to take to your evacuation assembly point, a company can figure out who's missing. Co-workers will have numbers for the missing ones in their mobile phones.
  Many companies have automated this process with emergency notification systems (ENS), but none of the big providers--RapidReach, 3N, MessageOne, MIR3, EnvoyWorldWide--has a switch in Asia yet, so all calls are routed through North America or Europe, therefore making companies spend more on their BCP.
• Training: Train the company's BCM team, HR department, security guards, auditors and anyone else who's interested in first aid, damage assessment, emergency management (mitigation, preparedness, response, recovery), crisis intervention (para-counseling and peer support), security screening (objects and people) or crisis communication (speaking to the press). Those are areas that are important for organizational resilience, but are often overlooked, under-trained or assumed to be public-sector responsibilities.
  The return on investment (ROI) on competent, relevant training is high: employees learn new skills they can use immediately, making the organization more resilient.
• Use the recovery facility: After building one, a company should not let it grow cobwebs. Crank it up, send some people to work there. When the influenza panic started last month, one prominent Singapore company split its employees--including executives--between its Raffles Place office and its remote recovery site.
  Sticking the boss at a recovery site out in the boonies for a few days, using an ancient PC and eating expired instant noodles out of a cupboard, will make it abundantly clear that a company has underspent, not overspent, on BCM facilities.
  A radical idea: can a company turn its backup site into a full-time office, permanently splitting employees? The ROI on the backup site would skyrocket instantly.
• Test first, plan later: There's nothing like the embarrassment that follows an inept performance in a simulated disaster exercise to answer that burning question, "Do we really need a BCP?"
  Before the entire BCM program is eliminated, the BCM professional should suggest a tabletop meeting for a Friday afternoon. Find a scenario that everyone agrees is plausible: power outage is always good, infectious disease is certainly plausible these days. Also, a couple of employees can play roles such as grief-stricken next-of-kin and rude reporters.
  A copy of the BCP should be placed on the table so anyone can refer to it. If the scenario is a power outage, turn out the lights and turn off the aircon. It will be very unlikely anyone who participates will suggest cutting the BCM budget after that.

Nathaniel Forbes is the director of Forbes Calamity Prevention in Singapore, and is a member of the Business Continuity Institute (MBCI) and the International Association of Emergency Managers (IAEM). He is also a ZDNet Asia blogger.