Business continuity planning: How to plan the plan Business continuity planning: How to plan the plan

Business continuity planning: How to plan the plan
30 Sep 2015

Sara outlined the potential types of scenarios which would call for a business continuity plan (BCP) to be enacted for payroll across her 20 countries. These included IT infrastructure, natural disasters, country infrastructure failures, vendor collapse, banking issues, internal staff turnover, heath epidemic, country collapse and others.

“Wow”, she thought. “Do I have all the data, contact information, and configuration to handle a disaster? What are the main points of handling the enactment of a BCP? How do I create test plans for each situation? Ok, One step at a time. What are the critical items I need to make sure I can enact a plan?

Communication plan

What are the critical components of a communication plan?

• Who is notified if an issue occurs?
• How are they notified? Phone, text, email?
• Who has the authority to declare a disaster and enact the plan?
• Who is the backup to each of the key individuals to the BCP? Do they have the knowledge and authority to enact the BCP if needed?
• How is the communication plan cascaded throughout the organisation to the appropriate people?
• If notification is required, is there a phone tree/ alert process? Is this process automated or does it require human intervention? If human intervention is required, are there backups for each branch in the tree?

Sara started making a list of key individuals that need to be notified for each location. Some reported up to regional centres and that caused her to think about potential time zone issues and responsibility levels.

Document the current process and contingent process

• Is the current process documented for each country?
• Is the BCP process documented for each country?
• Are people trained on both the current process and the BCP process?
• Is the process documentation accessible in the case of an emergency? A BCP is no good to anyone if it is saved on the share drive at work and the share drive is down as part of the disaster. Sara was not sure her current process documentation was up to date, so she took another look at the flow charts. Now the charts are updated, she can use these as a baseline to create the alternative flows for each BCP scenario.

Where should she keep the documentation? If the scenario was a down server or a power outage, the people enacting the BCP may not have access to the documentation if housed on the server. Sara has to give more thought on where the best place would be to keep these documents, perhaps a separate share drive that is not related to any of the scenarios?

Data

What data needs to be gathered for the BCP document?

• Phone numbers, emails and secondary contact details are needed for all participants in the communication plan.
• A hierarchy and decision tree needs to be established to ensure the notification is processed properly to have the quickest turnaround or issue identification, determination of enactment of the BCP and communication to all people affected as appropriate.
• Back up bank details in case an international wire is needed

Gathering this data is a good start to ensure that the BCP is robust enough to handle most scenarios. Sara believes additional data may need to be gathered as each scenario is reviewed.

Plans for each type of situation

• IT issue: This typically occurs when a system or technological infrastructure fails. Depending on the sophistication of the country, many companies will have a full fail over site for large payroll programmes. Smaller programmes or countries without strong IT infrastructure may simply have a back-up copy of the software and data. In this case, it may take several days to restore.

• Banking issue: If a bank is unable to transfer funds because of local country disruptions or system failure, a company should have a second bank ready to transfer the funds. Additionally if a local bank is compromised, then a company should be able to wire funds directly to employees to meet payroll. In that case, international wire instructions should already be available as a part of the BCP data.

• Vendor issue: If a vendor is unable to perform its duties, a company may have to use the prior month’s calculations, minus the one-time occurrences and run an estimated payroll. This is where documentation of current process is critical, so the company knows exactly the functions the vendor performs, so filings can be made and funding completed on time. The payroll will need to be reconciled the following month with the vendor if it recovers or with a new provider.

• Natural disaster/country collapse: In this case, the whole country may not be operational. These scenarios are often hard to predict, but have a very high impact on payroll processing and delivery.

In many cases a BCP will require an alternate site for processing, or usage of prior period date and international banks for delivery.

Sara had other scenarios to consider, but these were her first to document. Each one had its unique set of challenges and requirements. Although daunting at first, she now felt she had what she needed to build a robust BCP. Now completed, she hopes that she will only ever need to use the BCP once a year - for testing.

 

By Michele Honomichl

 

Sara outlined the potential types of scenarios which would call for a business continuity plan (BCP) to be enacted for payroll across her 20 countries. These included IT infrastructure, natural disasters, country infrastructure failures, vendor collapse, banking issues, internal staff turnover, heath epidemic, country collapse and others.

“Wow”, she thought. “Do I have all the data, contact information, and configuration to handle a disaster? What are the main points of handling the enactment of a BCP? How do I create test plans for each situation? Ok, One step at a time. What are the critical items I need to make sure I can enact a plan?

Communication plan

What are the critical components of a communication plan?

• Who is notified if an issue occurs?
• How are they notified? Phone, text, email?
• Who has the authority to declare a disaster and enact the plan?
• Who is the backup to each of the key individuals to the BCP? Do they have the knowledge and authority to enact the BCP if needed?
• How is the communication plan cascaded throughout the organisation to the appropriate people?
• If notification is required, is there a phone tree/ alert process? Is this process automated or does it require human intervention? If human intervention is required, are there backups for each branch in the tree?

Sara started making a list of key individuals that need to be notified for each location. Some reported up to regional centres and that caused her to think about potential time zone issues and responsibility levels.

Document the current process and contingent process

• Is the current process documented for each country?
• Is the BCP process documented for each country?
• Are people trained on both the current process and the BCP process?
• Is the process documentation accessible in the case of an emergency? A BCP is no good to anyone if it is saved on the share drive at work and the share drive is down as part of the disaster. Sara was not sure her current process documentation was up to date, so she took another look at the flow charts. Now the charts are updated, she can use these as a baseline to create the alternative flows for each BCP scenario.

Where should she keep the documentation? If the scenario was a down server or a power outage, the people enacting the BCP may not have access to the documentation if housed on the server. Sara has to give more thought on where the best place would be to keep these documents, perhaps a separate share drive that is not related to any of the scenarios?

Data

What data needs to be gathered for the BCP document?

• Phone numbers, emails and secondary contact details are needed for all participants in the communication plan.
• A hierarchy and decision tree needs to be established to ensure the notification is processed properly to have the quickest turnaround or issue identification, determination of enactment of the BCP and communication to all people affected as appropriate.
• Back up bank details in case an international wire is needed

Gathering this data is a good start to ensure that the BCP is robust enough to handle most scenarios. Sara believes additional data may need to be gathered as each scenario is reviewed.

Plans for each type of situation

• IT issue: This typically occurs when a system or technological infrastructure fails. Depending on the sophistication of the country, many companies will have a full fail over site for large payroll programmes. Smaller programmes or countries without strong IT infrastructure may simply have a back-up copy of the software and data. In this case, it may take several days to restore.

• Banking issue: If a bank is unable to transfer funds because of local country disruptions or system failure, a company should have a second bank ready to transfer the funds. Additionally if a local bank is compromised, then a company should be able to wire funds directly to employees to meet payroll. In that case, international wire instructions should already be available as a part of the BCP data.

• Vendor issue: If a vendor is unable to perform its duties, a company may have to use the prior month’s calculations, minus the one-time occurrences and run an estimated payroll. This is where documentation of current process is critical, so the company knows exactly the functions the vendor performs, so filings can be made and funding completed on time. The payroll will need to be reconciled the following month with the vendor if it recovers or with a new provider.

• Natural disaster/country collapse: In this case, the whole country may not be operational. These scenarios are often hard to predict, but have a very high impact on payroll processing and delivery.

In many cases a BCP will require an alternate site for processing, or usage of prior period date and international banks for delivery.

Sara had other scenarios to consider, but these were her first to document. Each one had its unique set of challenges and requirements. Although daunting at first, she now felt she had what she needed to build a robust BCP. Now completed, she hopes that she will only ever need to use the BCP once a year - for testing.

 

By Michele Honomichl