Time Estimate to Create Business Continuity Plan
Business continuity planning - how long should it take?
By Mel Gosling
Working as a business continuity consultant, one of the most frequent questions I am asked by potential clients is "How long will it take to produce a business continuity plan, and what will it cost?" The cost is specific to each organisation and depends on many things, but my answer to the first part of the question is "It should take about three months, and never more than six." Why do I say this, and is it realistic?
Business continuity planning should be a continual process, and not something that is undertaken just once and put carefully on one side to be used in an emergency. However, most organisations treat the initial development of a business continuity plan as a once off project, subsequently deploying the plan and handing over to an operational department for maintenance.
Like any project, the development of a business continuity plan requires a special use of resources over a fixed period of time to produce a desired outcome. That outcome is an effective business continuity plan suitable for the needs of the organisation that it can deploy. Unfortunately, the nature of that outcome is such that it is constantly changing, making it a good bet that as soon as the plan is completed it will be out of date.
Consider, for a moment, the things that will make up the plan (contact details for staff, customers, and suppliers, business units, their functions and priorities for recovery, recovery plans, vital equipment, information, and materials, IT systems, etc.), and you will realise that the chance of something changing whilst the plan is being developed increases exponentially with time. In fact, the larger and more complex the organisation, the greater this chance becomes.
Some of these things are more volatile than others (for example, the contact details of at least one member of staff changing is more likely than a change in the priority for recovery of at least one business function), but over the course of a year a large number of things are going to change, some of which will materially affect the effectiveness of the plan. (This is why many business continuity professionals advocate undertaking a business impact analysis every year.)
The implication of this for the project to develop a business continuity plan is that the longer it takes to develop the plan, the more likely it is that it will have to be re-worked before it can be deployed. Re-working the plan to change a few names and addresses is pretty simple and takes just a few minutes, but what if a new and critical business unit has been established that needs a hot standby facility that wasn't identified in the plan? How long will it take to complete this re-work?
Of course, the amount of re-work before deployment will depend on the complexity and volatility of the organisation, but as a general 'rule of thumb' I use 2.5 percent (one day in forty) cubed. The effect of this is to estimate 3 days re-work on a 60 day project, 27 days re-work on a 120 day project, and a whopping 216 days re-work on a 240 day project.
These things are cumulative of course, so even if you get the agreement to spend another 216 days after your 240 day project, you'll find that things have changed again so that at the end of the additional 216 days, you'll still be faced with another 157 days of re-work. In reality, things don't go so smoothly, and re-works will either take longer than the estimate or cannot be completed at all because the resources devoted to the project have been released.
All this goes to demonstrate that business continuity planning should be a continual process, but if you want to have any chance of initially developing a plan as a project and then deploying the plan (which is what most organisations do), it also demonstrates that your project needs to have a relatively short timescale. And this is why my answer to potential clients is "It should take about three months, but never more than six." Any more than six months and you are getting into the danger zone of a never ending project, or into the danger zone of having the project 'canned' because it's not producing results or having the Plan ignored because it is out of date.
How to achieve this is another story.
Mel Gosling is managing director Merrycon Ltd
MAKE A COMMENT
•Date: 3rd September 2004 •Region: UK/World •Type: Article •Topic: BC general
Rate this article or make a comment - click here
Source: https://continuitycentral.com/feature0120.htm